blog documentation FAQ followers forum marketplace services youtube

solved Signature of a hacking attempt?

The Jamroom Network » Forum » Using Jamroom » Page » Signature of a hacking attempt?
researchcooperative
@researchcooperative
6 years ago
694 posts
Today I noticed a user visiting the following page on my site:

/.git/HEAD

In fact, no such page exists, as far as I can tell. So I checked the IP address and found that it comes from a site called "worldhostingfarm.com" based in Cork, UK.

Is this the signature of a hacking attempt, or is it something that occurs when we are updating modules from JR? (GIT has something to do with version control, and I did update some modules today).


--
PJ Matthews, Kyoto
Migrated from Ning 2.0. Now at Jamroom 6 beta and using Jamroom Hosting for The Research Cooperative (researchcooperative.org)
updated by @researchcooperative: 10/09/18 08:31:10PM
michael
@michael
6 years ago
7,692 posts
no.

Its someone looking to see if you have a GIT repository on your server.

Anyone can type in any address they like to your site to see if it exists, its not hacking, its just asking a question
yoursite.com/do-you-like-avacardos
yoursite.com/my-favorite-color-is-green

It does nothing to your server, your server just replies: 404 page not found. and thats the end of it.

--edit--
a common one you will see is something like
yoursite.com/wp-admin/

they are testing to see if your site is wordpress. if it is then they will start checking all the recorded wordpress vulnerabilities
updated by @michael: 07/07/18 05:19:03AM