前の記事 ≪:2011年6月7日 管理人のブックマーク
次の記事 ≫:電話を使ったWEBサービスを構築する際に使えそうなフレームワーク「Pl...

phpMyAdminクローラーの恐怖

2011年06月08日-はてなブックマーク

スポンサード リンク
[PR] 英単語を忘却曲線アプリを使って超効率よく記憶する方法
サーバを立てているとログに怪しいアクセスが出るのは日常的なことですが、とあるサーバにphpMyAdminクローラーの恐怖のログが残っていたのでシェアします。



Apacheのログを見ていたら下記のようなログを見つけました。
/path/to/www/ は apache のDocumentRoot です。

phpMyAdminを使っている方で、レンタルサーバ等を使っている場合、public_html 以下等に設置しているかと思いますが、クローラーは片っ端から存在しそうなパスを総当りしてきます。
URLが存在すれば200ステータスで検知してそこにphpMyAdminがあるみたいなことが分かってしまいます。(phpMyAdminだけ狙っているようでもなさそうですが)

仮に、MySQLのパスワードを設定していない人がいた場合はrootでDBを消されたり、データを盗まれたりする危険性があったのでシェアしてます。
素でphpmyadminをmysqlのアカウント設定なしに設置するのは絶対に辞めたほうがいいですね、という証拠ですね。
[Sun Jun 0X XX:XX:16 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/scripts
[Sun Jun 0X XX:XX:16 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/admin
[Sun Jun 0X XX:XX:16 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/db
[Sun Jun 0X XX:XX:17 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/dbadmin
[Sun Jun 0X XX:XX:17 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/myadmin
[Sun Jun 0X XX:XX:17 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/mysql
[Sun Jun 0X XX:XX:17 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/mysqladmin
[Sun Jun 0X XX:XX:17 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/typo3
[Sun Jun 0X XX:XX:17 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpadmin
[Sun Jun 0X XX:XX:18 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin
[Sun Jun 0X XX:XX:18 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpmyadmin
[Sun Jun 0X XX:XX:18 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpmyadmin1
[Sun Jun 0X XX:XX:18 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpmyadmin2
[Sun Jun 0X XX:XX:18 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/pma
[Sun Jun 0X XX:XX:19 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/web
[Sun Jun 0X XX:XX:19 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/xampp
[Sun Jun 0X XX:XX:19 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/web
[Sun Jun 0X XX:XX:19 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/php-my-admin
[Sun Jun 0X XX:XX:19 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/websql
[Sun Jun 0X XX:XX:19 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpmyadmin
[Sun Jun 0X XX:XX:19 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin
[Sun Jun 0X XX:XX:19 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2
[Sun Jun 0X XX:XX:19 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/php-my-admin
[Sun Jun 0X XX:XX:19 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.2.3
[Sun Jun 0X XX:XX:20 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.2.6
[Sun Jun 0X XX:XX:20 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.5.1
[Sun Jun 0X XX:XX:20 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.5.4
[Sun Jun 0X XX:XX:20 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.5.5-rc1
[Sun Jun 0X XX:XX:20 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.5.5-rc2
[Sun Jun 0X XX:XX:20 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.5.5
[Sun Jun 0X XX:XX:20 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.5.5-pl1
[Sun Jun 0X XX:XX:20 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.5.6-rc1
[Sun Jun 0X XX:XX:20 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.5.6-rc2
[Sun Jun 0X XX:XX:21 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.5.7
[Sun Jun 0X XX:XX:20 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.5.6
[Sun Jun 0X XX:XX:21 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.5.7
[Sun Jun 0X XX:XX:21 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.5.7-pl1
[Sun Jun 0X XX:XX:21 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.0-alpha
[Sun Jun 0X XX:XX:21 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.0-alpha2
[Sun Jun 0X XX:XX:21 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.0-beta1
[Sun Jun 0X XX:XX:21 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.0-beta2
[Sun Jun 0X XX:XX:21 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.0-rc1
[Sun Jun 0X XX:XX:21 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.0-rc2
[Sun Jun 0X XX:XX:21 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.0-rc3
[Sun Jun 0X XX:XX:21 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.0
[Sun Jun 0X XX:XX:22 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.0-pl1
[Sun Jun 0X XX:XX:22 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.0-pl2
[Sun Jun 0X XX:XX:22 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.0-pl3
[Sun Jun 0X XX:XX:22 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.1-rc1
[Sun Jun 0X XX:XX:22 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.1-rc2
[Sun Jun 0X XX:XX:22 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.1
[Sun Jun 0X XX:XX:22 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.1-pl1
[Sun Jun 0X XX:XX:22 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.1-pl2
[Sun Jun 0X XX:XX:22 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.1-pl3
[Sun Jun 0X XX:XX:22 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.2-rc1
[Sun Jun 0X XX:XX:23 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.2-beta1
[Sun Jun 0X XX:XX:23 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.2-rc1
[Sun Jun 0X XX:XX:23 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.2
[Sun Jun 0X XX:XX:23 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.2-pl1
[Sun Jun 0X XX:XX:23 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.3
[Sun Jun 0X XX:XX:23 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.3-rc1
[Sun Jun 0X XX:XX:23 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.3
[Sun Jun 0X XX:XX:23 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.3-pl1
[Sun Jun 0X XX:XX:23 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.4-rc1
[Sun Jun 0X XX:XX:23 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.4-pl1
[Sun Jun 0X XX:XX:24 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.4-pl2
[Sun Jun 0X XX:XX:24 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.4-pl3
[Sun Jun 0X XX:XX:24 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.4-pl4
[Sun Jun 0X XX:XX:24 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.6.4
[Sun Jun 0X XX:XX:24 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.7.0-beta1
[Sun Jun 0X XX:XX:24 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.7.0-rc1
[Sun Jun 0X XX:XX:24 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.7.0-pl1
[Sun Jun 0X XX:XX:24 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.7.0-pl2
[Sun Jun 0X XX:XX:24 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.7.0
[Sun Jun 0X XX:XX:25 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.8.0-beta1
[Sun Jun 0X XX:XX:25 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.8.0-rc1
[Sun Jun 0X XX:XX:25 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.8.0-rc2
[Sun Jun 0X XX:XX:25 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.8.0
[Sun Jun 0X XX:XX:25 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.8.0.1
[Sun Jun 0X XX:XX:25 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.8.0.2
[Sun Jun 0X XX:XX:25 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.8.0.3
[Sun Jun 0X XX:XX:25 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.8.0.4
[Sun Jun 0X XX:XX:25 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.8.1-rc1
[Sun Jun 0X XX:XX:25 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.8.1
[Sun Jun 0X XX:XX:26 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpMyAdmin-2.8.2
[Sun Jun 0X XX:XX:26 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/sqlmanager
[Sun Jun 0X XX:XX:26 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/mysqlmanager
[Sun Jun 0X XX:XX:26 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/PMA2005
[Sun Jun 0X XX:XX:26 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/pma2005
[Sun Jun 0X XX:XX:26 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpmanager
[Sun Jun 0X XX:XX:26 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/php-myadmin
[Sun Jun 0X XX:XX:26 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/phpmy-admin
[Sun Jun 0X XX:XX:27 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/webadmin
[Sun Jun 0X XX:XX:27 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/sqlweb
[Sun Jun 0X XX:XX:27 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/websql
[Sun Jun 0X XX:XX:27 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/webdb
[Sun Jun 0X XX:XX:27 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/mysqladmin
[Sun Jun 0X XX:XX:27 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/mysql-admin
[Sun Jun 0X XX:XX:27 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/databaseadmin
[Sun Jun 0X XX:XX:27 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/admm
[Sun Jun 0X XX:XX:27 2011] [error] [client 69.64.47.119] File does not exist: /path/to/www/admn

こんな名前だったら誰も分からないぜ、となんとなく分かりやすい名前にしても無駄ですね。

phpMyAdminを使う場合、通信はSSLやトンネリングで暗号化し、認証をかけ、apacheのconfや.htaccess等でアクセス元の制限をかける、使い終わったら公開パスから切り離す、など、皆さんもご注意されてください。

関連の記事検索:セキュリティ, PHP
スポンサード リンク

By.KJ : 2011年06月08日 09:06 livedoor Readerで購読 Twitterに投稿

間違いの指摘をしていただける方はメール、あるいはTwitter/FBでお願いします(クリック)