Re: Weird 'script' in Username column in audit log file

Someone is rattling the proverbial door knob on your proxy server to check
to see if they can perform javascript injection via your login page.

On Sun, Dec 1, 2019 at 8:40 PM Patricia Farnan <[email protected]>
wrote:

> Hello,
>
>
>
> Has anyone ever seen this sort of thing before?
>
>
>
> 2019-11-28 13:57:24  Login.Failure   178.165.72.177
> </script>"><script>prompt(1)</script>
>
> 2019-11-28 13:57:39  Login.Failure   23.129.64.190
> <script>alert(1)</script>
>
> 2019-11-28 13:57:48  Login.Failure   109.70.100.28
> "><script>alert(1)</script>
>
> 2019-11-28 13:58:07  Login.Failure   185.220.101.70
> '><script>alert(1)</script>
>
>
>
> When I was pasting my log contents into the audit check spreadsheet we use
> this morning, this particular file’s contents wouldn’t paste full – it
> would stop at these entries and didn’t include the last row of data either,
> as if the script stuff had prevented the rest from pasting in.
>
>
>
> Does anyone know what this means? I’ve never seen it before in our logs.
>
>
> Thanks,
>
>
>
> *Patricia Farnan* * |* Application Administrator, Discovery Services
>
> University Library * |* St Teresa’s Library
>
>
>
> *The University of Notre Dame Australia*
> 19 Mouat Street (PO Box 1225)
> Fremantle WA 6959
> Telephone: +61 8 *9433 0707 **| *Email: [email protected]
>
> *nd.edu.au <http://nd.edu.au> |* CRICOS Provider:  01032F
>
>
>
> *Library* <http://library.nd.edu.au/>* | **AskUs*
> <http://askus.library.nd.edu.au/>
>
>
>
> I respect and acknowledge the Nyungar Elders and the Wadjuk Nyungar people
> as the Traditional Owners and Custodians of this country on which I work.
>
>
>
>
> *Disclaimer*
>
> IMPORTANT: This e-mail and any attachments may be confidential. If you are
> not the intended recipient you should not disclose, copy, disseminate or
> otherwise use the information contained in it. If you have received this
> e-mail in error, please notify us immediately by return e-mail and delete
> or destroy the document. Confidential and legal privilege are not waived or
> lost by reason of mistaken delivery to you. The University of Notre Dame
> Australia is not responsible for any changes made to a document other than
> those made by the University. Before opening or using attachments please
> check them for viruses and defects. Our liability is limited to
> re-supplying any affected attachments.
>
> ------------------------------
>
> To unsubscribe from the EZPROXY-L list, click the following link:
> http://listserv.oclclists.org/scripts/wa.exe?SUBED1=EZPROXY-L&A=1
>


-- 

Andrew Anderson
President & CEO
[email protected]
t: +1 (727) 536-0214 x100
f: +1 (727) 530-3126
w: www.lirn.net
Library & Information Resources Network
25400 US Hwy 19 North, Ste. #220
Clearwater, FL 33763
LinkedIn
<http://www.linkedin.com/company/library-and-information-resources-network-inc->
 | Facebook <http://www.facebook.com/LIRNnotes> | Twitter
<http://www.twitter.com/LIRNNotes> | YouTube
<http://www.youtube.com/user/LIRNnotes>


********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences,
you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
Or email [email protected] including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters),
please email us at [email protected].