스프링 부트 이거 해킹 시도 당한건가요 ..?

Question

개인 웹 프로젝트 개발 중에 약속이 있어 스프링 부트 서버를 켜두고 나갔다 왔었습니다.근데 집에 와서 확인해보니 제가 밖에 있던 시간동안 이상한 로그가 많이 찍혀있더라구요누가 해킹을 시도한건가요..? 최근 이틀 동안 DB 테이블도 랜섬웨어에 2번이나 걸려서 좀 찜찜하긴 하네요아래와 같은 로그들이 찍혀 있었는데 진짜 해킹 시도일까요 ? 2022-05-02 18:24:51.989 WARN 5488 --- [nio-8080-exec-1] o.s.web.servlet.PageNotFound : No mapping for GET /script 2022-05-02 19:48:11.740 WARN 5488 --- [nio-8080-exec-5] o.s.web.servlet.PageNotFound : No mapping for GET /securityRealm/user/admin/search/index 2022-05-02 20:04:59.436 WARN 5488 --- [nio-8080-exec-6] o.s.web.servlet.PageNotFound : No mapping for POST /mifs/.;/services/LogService 2022-05-02 20:29:51.738 WARN 5488 --- [io-8080-exec-10] o.s.web.servlet.PageNotFound : No mapping for GET /manager/html 2022-05-02 20:41:41.782 WARN 5488 --- [nio-8443-exec-2] o.s.web.servlet.PageNotFound : No mapping for GET /api 2022-05-02 21:33:12.340 WARN 5488 --- [nio-8080-exec-1] o.s.web.servlet.PageNotFound : No mapping for GET /script 2022-05-02 21:59:33.884 WARN 5488 --- [nio-8443-exec-4] o.s.web.servlet.PageNotFound : No mapping for GET /manager/html 2022-05-02 23:40:48.911 WARN 5488 --- [nio-8080-exec-4] o.s.web.servlet.PageNotFound : No mapping for POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 2022-05-03 00:52:27.681 WARN 5488 --- [nio-8080-exec-6] o.s.web.servlet.PageNotFound : No mapping for GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php 2022-05-03 01:03:02.017 WARN 5488 --- [nio-8080-exec-7] o.s.web.servlet.PageNotFound : No mapping for GET /script 2022-05-03 01:28:53.670 WARN 5488 --- [nio-8080-exec-9] o.s.web.servlet.PageNotFound : No mapping for POST /GponForm/diag_Form 2022-05-03 01:28:53.685 INFO 5488 --- [nio-8080-exec-9] o.apache.coyote.http11.Http11Processor : Error parsing HTTP request header Note: further occurrences of HTTP request parsing errors will be logged at DEBUG level. java.lang.IllegalArgumentException: Invalid character found in method name [h&#43;/tmp/gpon8080&ipv&#61;0...]. HTTP method names must be tokens at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:419) ~[tomcat-embed-core-9.0.62.jar:9.0.62] at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:271) ~[tomcat-embed-core-9.0.62.jar:9.0.62] at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) ~[tomcat-embed-core-9.0.62.jar:9.0.62] at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:890) ~[tomcat-embed-core-9.0.62.jar:9.0.62] at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1743) ~[tomcat-embed-core-9.0.62.jar:9.0.62] at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) ~[tomcat-embed-core-9.0.62.jar:9.0.62] at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) ~[tomcat-embed-core-9.0.62.jar:9.0.62] at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) ~[tomcat-embed-core-9.0.62.jar:9.0.62] at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) ~[tomcat-embed-core-9.0.62.jar:9.0.62] at java.base/java.lang.Thread.run(Thread.java:835) ~[na:na] 2022-05-03 02:19:06.246 WARN 5488 --- [nio-8080-exec-9] o.s.web.servlet.PageNotFound : No mapping for GET /status.asp 2022-05-03 02:19:06.792 WARN 5488 --- [nio-8080-exec-8] o.s.web.servlet.PageNotFound : No mapping for GET /w/home.asp 2022-05-03 02:19:07.352 WARN 5488 --- [nio-8080-exec-2] o.s.web.servlet.PageNotFound : No mapping for GET /index.htm 2022-05-03 02:19:07.874 WARN 5488 --- [nio-8080-exec-5] o.s.web.servlet.PageNotFound : No mapping for GET /index.htm 2022-05-03 04:43:43.959 WARN 5488 --- [nio-8080-exec-6] o.s.web.servlet.PageNotFound : No mapping for GET /script 2022-05-03 05:28:08.131 WARN 5488 --- [nio-8080-exec-7] o.s.web.servlet.PageNotFound : No mapping for GET /console/ 2022-05-03 06:11:39.075 WARN 5488 --- [nio-8080-exec-9] o.s.web.servlet.PageNotFound : No mapping for POST /Autodiscover/Autodiscover.xml 2022-05-03 07:05:54.931 WARN 5488 --- [io-8080-exec-10] o.s.web.servlet.PageNotFound : No mapping for GET /_ignition/execute-solution 2022-05-03 07:16:57.719 WARN 5488 --- [nio-8080-exec-9] o.s.web.servlet.PageNotFound : No mapping for GET //robots.txt 2022-05-03 07:16:57.724 WARN 5488 --- [nio-8080-exec-8] o.s.web.servlet.PageNotFound : No mapping for GET //sitemap.xml 2022-05-03 07:16:57.804 WARN 5488 --- [nio-8080-exec-3] o.s.web.servlet.PageNotFound : No mapping for GET //.well-known/security.txt 2022-05-03 07:24:48.969 WARN 5488 --- [nio-8443-exec-5] o.s.web.servlet.PageNotFound : No mapping for GET /robots.txt 2022-05-03 07:24:49.054 WARN 5488 --- [nio-8443-exec-4] o.s.web.servlet.PageNotFound : No mapping for GET /favicon.ico 2022-05-03 07:24:55.626 WARN 5488 --- [nio-8443-exec-2] o.s.web.servlet.PageNotFound : No mapping for GET //robots.txt 2022-05-03 07:25:13.863 WARN 5488 --- [nio-8443-exec-7] o.s.web.servlet.PageNotFound : No mapping for GET //.well-known/security.txt 2022-05-03 07:25:15.222 WARN 5488 --- [nio-8080-exec-4] o.s.web.servlet.PageNotFound : No mapping for GET /favicon.ico

platanus · Answer

네 앞으로 많이 보시게 될겁니다.

Dierslair · Answer

취약점 찾는 bot들이 찔러보는거에요

yeori · Answer

이 집 비었나싶어서 함 던져보다 200나오면 그때부터 타겟이 됩니다. robot.txt같은건 검색엔진이 요청했을 수도 있구요.

Ramspord · Answer

헐 배포 안 된 서비스도 해킹 당할 수 있군요 ㅜㅜ 대처법 같은건 없나요??

이프얼스와일포 · Answer

저도 AWS 개인 프젝 예전에 올려두었을때 로그에 막 이거저거 많이 찎히더라구요 언제는 한번 톰캣 매니저 켜둿더니이색히들이 매니저로 들어와서 기본 admin 계정 로그인해서해킹용 jsp 를 심어놨었습니다 그 jsp 안에는 쉘 명령어 수드륵하게 적혀있었구요.....

DeadWhale · Answer

헐

혜초모여 · Answer

헐 이런 일도 일어나게 되는군요

Mambo · Answer

일반적으로 실제 서비스는 WAF를 두어서 예상하지 못한 국가에서 접근하는 것 또는 허용된 아이피 대역만 접근하도록 규칙을 두기도 해요.

스프링 부트 이거 해킹 시도 당한건가요 ..?

8개의 답변

#boot 목록