: Apache (XAMPP 1.8.0) access.log/Intrusion Detection Concern [I originally posted on SO but it earned me a Tumbleweed badge. This looks like a better venue for the question.] I have Apache (XAMPP

[I originally posted on SO but it earned me a Tumbleweed badge. This looks like a better venue for the question.]

I have Apache (XAMPP 1.8.0) running on Vista Pro x64. A couple times now I have seen a pattern like the example below in access.log. Concerning is the "attack" seems to somehow shift from a public IP to a valid private IP on my network (happens to be the WAN address of one of my routers).

Two questions: How is this possible, and what happens if the "attacker" stumbles on a valid request?

I've googled this to no avail.

177.0.X.X - - [03/Jun/2012:08:19:34 -0400] "GET /phpMyAdmin-2.5.4/index.php HTTP/1.1" 403
177.0.X.X - - [03/Jun/2012:08:19:34 -0400] "GET /phpMyAdmin-2.5.5-rc1/index.php HTTP/1.1" 403
177.0.X.X - - [03/Jun/2012:08:19:34 -0400] "GET /phpMyAdmin-2.2.6/index.php HTTP/1.1" 403
177.0.X.X - - [03/Jun/2012:08:19:34 -0400] "GET /phpMyAdmin-2.5.5-rc2/index.php HTTP/1.1" 403
192.168.15.3 - - [03/Jun/2012:08:19:56 -0400] "GET /phpMyAdmin-2.5.6-rc2/index.php HTTP/1.1" 403
177.0.X.X - - [03/Jun/2012:08:19:56 -0400] "GET /phpMyAdmin-2.5.6-rc1/index.php HTTP/1.1" 403
177.0.X.X - - [03/Jun/2012:08:19:56 -0400] "GET /phpMyAdmin-2.5.5-pl1/index.php HTTP/1.1" 403
192.168.15.3 - - [03/Jun/2012:08:19:59 -0400] "GET /phpMyAdmin-2.5.7/index.php HTTP/1.1" 403
192.168.15.3 - - [03/Jun/2012:08:20:01 -0400] "GET /phpMyAdmin-2.5.7-pl1/index.php HTTP/1.1" 403
192.168.15.3 - - [03/Jun/2012:08:20:02 -0400] "GET HTTP/1.1" 400 1060 "-" "-"

10.01% popularity Vote Up Vote Down

: Show other domain using DNS instead of iframe I have two domains bought at different providers and I would like http://aaaaa.com to show http://bbbbb.com/aaaaa. Is this possible using only DNS?

@Miguel251

Posted in: #Dns #Iframe #Redirects

2 Comments

: Tool for custom web based reporting from your db? I am looking for online reporting tool that I can design my own reports . reports should be totally custom and based on my own schema so

@Miguel251

Posted in: #Database #Graphics #Reporting

1 Comments

: How can IIS 7.5 have the error pages for a site reset to the default configuration? A mishap occurred with web.config to accommodate a subsite existing. I made use of “<location path="."

@Miguel251

Posted in: #403Forbidden #Error #HttpCode500 #HttpCode503 #Iis7

2 Comments

: How to throttle email server wide on a shared server? I have multiple programs that send email on a shared server with a relatively low email limit. These programs are completely separate and

@Miguel251

Posted in: #BulkEmail #Email

2 Comments

Login to post a comment!

1 Comments

Sorted by latest first Latest Oldest Best

@LarsenBagley505

It may have to do with how XAMP is configured with your local server and how routing is setup to send web traffic to your server.

It's actually common to see bots scanning your server for vulnerabilities and common scripts such as phpMyAdmin.

On linux I would add them to hosts.deny, in apache you can ban them with your .htaccess file.

If the attacks are internal check your router and see who has those IP's on your network.

10% popularity Vote Up Vote Down

Feed

: Apache (XAMPP 1.8.0) access.log/Intrusion Detection Concern [I originally posted on SO but it earned me a Tumbleweed badge. This looks like a better venue for the question.] I have Apache (XAMPP

More posts by @Miguel251

: Show other domain using DNS instead of iframe I have two domains bought at different providers and I would like http://aaaaa.com to show http://bbbbb.com/aaaaa. Is this possible using only DNS?

: Tool for custom web based reporting from your db? I am looking for online reporting tool that I can design my own reports . reports should be totally custom and based on my own schema so

: How can IIS 7.5 have the error pages for a site reset to the default configuration? A mishap occurred with web.config to accommodate a subsite existing. I made use of “<location path="."

: How to throttle email server wide on a shared server? I have multiple programs that send email on a shared server with a relatively low email limit. These programs are completely separate and

Login to post a comment!

1 Comments

Back to top | Use Dark Theme