Suspicious activity on contact form, what are their intentions?

Question

I've just started receiving several emails per second and I think it's likely someone is trying to exploit my contact form. I've taken steps to protect my site, I'm just curious what it is they're trying to do.

Some examples:

..À¯
sample%40email.tst and sleep(7.738) 
acunetix_wvs_invalid_filename
\";cat /etc/passwd;\"
../../../../../../../../../../windows/win.ini\0.tst
/../..//../..//../..//../..//../..//etc/passwd\0.tst
\";print(md5(acunetix_wvs_security_test));$a=\"

The only one I can really guess at is cat /etc/passwd, after that they don't make much sense. Does anyone have any info or further suggestions?

The third and last lines pretty much show all you need to know. They're probably using the Acunetix Web Vulnerability Scanner to test your site and see what vulnerabilities they might be able to exploit. — Iszi, Nov 26 '13 at 20:20
Thanks for that, I didn't think to look for a vendor name and it hadn't show up when I Googled the terms. — Scott Helme, Nov 26 '13 at 20:24
If someone is interested here I published full list of exploits https://stokito.wordpress.com/2017/02/23/acunetix-web-vulnerability-scanner/ — Sergey Ponomarev, Feb 23 '17 at 13:34

score 7 · Accepted Answer · answered Nov 26 '13 at 20:16

It looks like an automated fuzzing test/attack that is looking for a number of different vulnerabilities.

Based on what you have provided they are trying to access the file system or execute directory traversal attacks, but I suspect as time goes by they will try basically every type of attack there is.

Tools like Burp Suite will provide ways to automate these types of attacks by allowing you to specify which HTTP parameters you want to target as well as providing an attack payload that looks for a number of different vulnerabilities (SQL Injection, XSS, path traversal etc.)

You can probably block the IP for now, but I would make sure that you site is secure because they will probably be back. Also, you are probably receiving emails because they are testing your "contact us" form or something like that. I would check your logs, because they are likely hitting many other pages as well.

Thanks for the response. My site is sat behind CloudFlare so I've identified and blocked the offending IP address. This seems to have stopped the attack, for now. — Scott Helme, Nov 26 '13 at 20:29

Suspicious activity on contact form, what are their intentions?

1 Answers1