Error mails from hacking/snooping attempts #56

New Issue

ansv7779 · 2024-12-04T13:34:28+01:00

ansv7779 commented

2024-12-04 13:34:28 +01:00

A lot of random HTTP requests are sent to try and find known vulnerabilities for various frameworks.

For example the following requests

2024-12-04 13:13:03 "GET /wicket/resource/org.apache.wicket.Application/portal/diag/index.jsp HTTP/1.1" 401

2024-12-04 13:13:03 [WARN] ResourceReferenceRegistry: A ResourceReference wont be created for a resource with key [scope: org.apache.wicket.Application; name: portal/diag/index.jsp; locale: null; style: null; variation: null] because it cannot be located.

2024-12-04 13:13:03 "GET /wicket/resource/portal/diag/index.jsp HTTP/1.1" 401 3248 112788 "-"

2024-12-04 13:13:03 [WARN] WicketObjects: Could not resolve class [portal]
java.lang.ClassNotFoundException: portal

Since we have a rather aggressive mailing in place, each log at level warning or higher, each such attempt generates an error mail. This results in way too many mails and we may miss mails we may want to catch for real problems.

Find a way to prevent these mails from going out in production while keeping them around in development to help find any potential mistakes.

A lot of random HTTP requests are sent to try and find known vulnerabilities for various frameworks. For example the following requests ``` 2024-12-04 13:13:03 "GET /wicket/resource/org.apache.wicket.Application/portal/diag/index.jsp HTTP/1.1" 401 2024-12-04 13:13:03 [WARN] ResourceReferenceRegistry: A ResourceReference wont be created for a resource with key [scope: org.apache.wicket.Application; name: portal/diag/index.jsp; locale: null; style: null; variation: null] because it cannot be located. ``` ``` 2024-12-04 13:13:03 "GET /wicket/resource/portal/diag/index.jsp HTTP/1.1" 401 3248 112788 "-" 2024-12-04 13:13:03 [WARN] WicketObjects: Could not resolve class [portal] java.lang.ClassNotFoundException: portal ``` Since we have a rather aggressive mailing in place, each log at level warning or higher, each such attempt generates an error mail. This results in way too many mails and we may miss mails we may want to catch for real problems. Find a way to prevent these mails from going out in production while keeping them around in development to help find any potential mistakes.

ansv7779 added the

new

label 2024-12-04 13:34:42 +01:00

ansv7779 commented

2024-12-04 15:08:59 +01:00

A lot of these problems will probably go away if #27 gets merged since at that point all of Wicket (where most of the warnings come from) will require an authenticated user.

Sign in to join this conversation.