6

We created a default environment on AWS Elastic Beanstalk using their Python "sample app". After some time, the logs show a large number of POST requests with bodies like this:

b'0x%5B%5D=ridho'
b'0x%5B%5D=androxgh0st'
b'0x%5B%5D=Graber'
b'0x%5B%5D=anarchy99'

These names smell pretty fishy. I guess %5B%5D encodes square brackets []?

Could someone explain what these people are trying to achieve?

djvg
  • 473
  • 5
  • 11
  • 6
    I googled one of the names and got this as the top hit: https://thedfirreport.com/2021/02/28/laravel-debug-leaking-secrets/ – schroeder Oct 07 '21 at 12:59
  • 2
    @schroeder: Thanks! That matches the description nicely: "Detections: Web requests to root/.env or post data that includes 0x[]:androxgh0st (hard coded string in smtp.py)." – djvg Oct 07 '21 at 13:45
  • I'm noticing the exact same thing - but I am capturing POST method data on my homepage to monitor what is coming in. I registered a BRAND NEW DOMAIN and this was happening within 2 hours, so clearly these bots have a way to identify new domain registrations.

    array(1) { ["0x"]=> array(1) { [0]=> string(11) "androxgh0st" } }

    array(1) { ["0x"]=> array(1) { [0]=> string(6) "Graber" } }

     – Dale Clifford Mar 23 '22 at 06:37
  • I’m voting to close this question because it is simple to look up the usernames to determine the type of attack here. – schroeder Feb 26 '24 at 22:04

0 Answers0