Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

My wordpress logs show 404 errors to URLs having the following pattern:

http://example.com/path/++GET+http:/example/+0,48595,73506+-

Web searches do not return answers because of the plus and minus symbols. Note that the second http is followed by a single slash. Accessing my site with a corrected URL (where I use a double slash after the second http) returns a 404.

My logs show fifty errors each day from different IP addresses, where each IP address tries the same file three times.

I am curious to know what type of exploit this may be. It seems to have something to do with the GET request method.

Ideas?

share|improve this question

1 Answer 1

Maybe it is just a stupid bot. I have daily 404s from different IP adresses trying to access urls like http://www.example.com/http://facebook.com/ or http://www.example.com/sms:+43123456789. The user agent of the bot I always see is something like Java/... This bot tries to follow all links, href, src, etc he can find.

Check if you maybe have the text (+0,48595,73506+-) somewhere on the referring page and what user agent is sent.

PS: If you want to search for something with a minus you can quote in on google like site:example.com "-text" will search for text on example.com which that contains "-text". However, I think this will only find visible text on your page and not links, etc.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.