從 Web Log 學習系統漏洞 58

幾個 xmlrpc.php 關鍵字出現在 log 中

148.72.232.156 - - [14/Feb/2020:21:02:04 +0800] "GET /xmlrpc.php HTTP/1.1" 404 210 "-" "PycURL/7.19.7"
50.62.176.85 - - [14/Feb/2020:23:00:08 +0800] "GET /xmlrpc.php HTTP/1.1" 404 210 "-" "PycURL/7.19.7"
148.72.232.156 - - [14/Feb/2020:23:08:03 +0800] "GET /xmlrpc.php HTTP/1.1" 404 210 "-" "PycURL/7.19.7"
107.180.121.48 - - [15/Feb/2020:10:08:12 +0800] "GET /xmlrpc.php HTTP/1.1" 404 210 "-" "PycURL/7.19.7"

估狗之後得知這是針對 WordPress 漏洞的 DDOS 攻擊, 這個 XML-RPC 是為了讓遠端能使用手機登入操作, 不過我沒有在用 WordPress 所以沒差