Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
DomainKey-Status: good
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
        s=beta; d=gmail.com;
        h=received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
        b=bUYNcPeMaM1O9/rPz5oXnnGTNzce2UTwtfDFWI+BEe5LACUy3qz3JAS+l+Mh0wxflDf2Xuf8PM+x352OBoOhuFzTp2ImNYADeqh/n/r0ei+lJ5MRGFuOTeIb/bpMU6dwSBWHaN2K3WXBx2fojzmW8LYFcyQEMM2MS7ne61cJz6M=
Message-ID: <e498c1660610051157n52a58b69l510de004688068c7@mail.gmail.com>
Date: Thu, 5 Oct 2006 14:57:01 -0400
From: "Joshua Slive" <joshua@slive.ca>
Sender: jslive@gmail.com
To: users@httpd.apache.org, ed@alcpress.com
In-Reply-To: <45253527.9090309@alcpress.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <45253527.9090309@alcpress.com>
Subject: Re: [users@httpd] Apache/PHP and obfuscated URLs

On 10/5/06, Ed Sawicki <ed@alcpress.com> wrote:
> I see that Apache 2.0 does not convert an obfuscated URL
> into its canonical form. For example, with this URL:
>
> http://www.example.com/url/hack
>
> I see the Web page and the access log shows this:
>
> 10-05 07:41 "GET /url/hack HTTP/1.1" 200
>
>
> With this obfuscated URL:
>
> http://www.example.com/%75%72%6C%2F%68%61%63%6B
>
> I get a 404 error page and the access log shows this:
>
> 10-05 07:41 "GET /%75%72%6C%2F%68%61%63%6B HTTP/1.1" 404
>
> However, the error log does not log this 404 error with
> the default LogLevel.
>
> Two questions:
>
> 1. Why doesn't Apache log the error when other 404 errors are
> logged ?
>
> 2. I'm pleased that Apache doesn't convert obfuscated URLs
> into canonical form, but I'm wondering why attackers have
> success using obfuscated URLs when attacking Apache sites
> where the Web apps are written in PHP. I do not know or use
> PHP.

That URL is actually a special case because it contains an encoded
slash, which is considered an especially dangerous item.  See the
AllowEncodedSlash directive.  It should get logged anyway.  If you can
show that it isn't getting to the error log in 2.2, then you should
report it as a bug.

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org