|
Nathan reported today that he has been seeing a new trend of web scanning against his webservers looking for /info/whitelist.pac. The scanning he has observed is over SSL. He has been observing this activity since the 22 Aug. [22/Aug/2014:18:55:32 -0500] xx.12.93.178 GET /info/whitelist.pac HTTP/1.1 Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Is anyone else seeing similar activity against their webservers? ----------- Guy Bruneau IPSS Inc. gbruneau at isc dot sans dot edu |
Guy 523 Posts ISC Handler Sep 19th 2014 |
| Thread locked Subscribe |
Sep 19th 2014 7 years ago |
|
Interesting, I have not seen this in any mainstream scanners (nessus, nexpose, etc). I was able to throw together a quick google dork that produced interesting results.
intext:"findproxyforurl(url, host)" filetype:pac There is a Wikipedia on this file: http://en.wikipedia.org/wiki/Proxy_auto-config there were 3 .gov sites I found with a modified version of the google query above |
Landon 1 Posts |
| Quote |
Sep 19th 2014 7 years ago |
|
whitelist.pac is related to proxy servers. If you are certain that this is recon activity, there is a possibility we have some new exploit for proxy servers.
|
Landon 2 Posts |
| Quote |
Sep 19th 2014 7 years ago |
|
Common to modify PAC files and route web traffic through malicious proxies.
This could be some scan related to identifying internet facing systems... possibly related to https://github.com/n0wa11/gfw_whitelist/blob/master/whitelist.pac? |
Landon 1 Posts |
| Quote |
Sep 19th 2014 7 years ago |
|
I've had 2 of these scans on an Apache web server (on an Ubuntu box) I'm running from a home laptop. First was 2NOV next was 6NOV. Both returned 404. I'm not running a proxy but do have SSH open as well as HHTP/HTTPS, for those who are curious.
|
ucnt 2 Posts |
| Quote |
Nov 9th 2014 7 years ago |
Sign Up for Free or Log In to start participating in the conversation!
https://www.sans.edu
