what kind of vulnerably scan is this?

Question

Some of the 404 error logs I see on my website are obviously caused by vulnerably scanners and in most cases, I can understand what it is scanning! (and it's mainly about sql-injection)

However I've seen a couple of logs which I don't quite understand. You can see sample of the requested urls below:

http://example.com/}];this.forHtmlScript(SyntaxHighlighter.regexLib.aspScriptTags)}typeof
http://example.com/System.Web.AspNetHostingPermission,

I understand that former is somehow trying to exploit some bug in syntax highlighter I used in site (from http://alexgorbatchev.com) and the the latter is trying to make use of ASP.NET hosting bugs.

My question is:

First of all, am I right about assuming these logs as some kind of vulnerably scanner activity?

Moreover, what issue are they trying to take advantage of?

Answer 1

http://example.com/}];this.forHtmlScript(SyntaxHighlighter.regexLib.aspScriptTags)}typeof

I can say that the first line is possible a script error, probably you send this from javascript and looks line bug, you or any other auto-translate web program, a false redirect (a bug on the redirect)

Have nothing to exploit with this line

About the System.Web.AspNetHostingPermission Nether this looks like exploit, to me looks like you try to make a redirect somewhere and you get a throw exception with this inside this throw System.Web.AspNetHostingPermission, and you redirect him to this throw message that starts with this System.Web.AspNetHostingPermission

look a throw message like that, you see starts the same as your directory.

System.Web.AspNetHostingPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

So to end up, they are 99.9% bugs and not exploit commands.

Last word

Check the ips that this coming from and see if its google, msn, or other indexer that usually find pages and combinations on links that you not have check. Even I think the first is from auto-translate page that try to high light some text.