Odd error from one ip address only

newsgroups.comcast.net

I am having an odd problem. Every day I get application errors from my
website. The errors are only from one particular ip address (The error is
System.NullReferenceException: Object reference not set to an instance of an
object....) The logs show that the request appear to be coming from some
kind of spider or bot. They have no url referrer and are the order of the
pages requested could not be "clicked" in the order requested. They all fail
at the same point. Here is the error message and a snip of the code.

Exception of type 'System.Web.HttpUnhandledException' was thrown.
System.NullReferenceException: Object reference not set to an instance of an
object.
at mgFunctions.mgSetCookies(String stroID)
at mgDisplay.Page_Load(Object sender, EventArgs e)
at System.Web.Util.CalliHelper.EventArgFunctionCaller (IntPtr fp, Object
o, Object t, EventArgs e)
at System.Web.Util.CalliEventHandlerDelegateProxy.Cal lback(Object sender,
EventArgs e)
at System.Web.UI.Control.OnLoad(EventArgs e)
at System.Web.UI.Control.LoadRecursive()
at System.Web.UI.Page.ProcessRequestMain(Boolean
includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Code snip.

Sub Page_Load(sender As Object, e As EventArgs)
if not Ispostback then
dim stroID as string = "u"
if Request.QueryString.Item("_o") <> string.empty then
stroID = Request.QueryString.Item("_o").tostring()
end if
mgFunctions.mgSetCookies(stroID)

end if
It seems like the application doesn't know what mgFunctions.mgSetCookies is
for this particular user only. Could this user be doing something malicious?

I am getting 30 or 40 errors a day just from this one user, but no other.
Any thoughts?

Mike

Apr 5 '06 #1

clickon

I suspect it is malicious, but automated. Probably some script kiddies
running and automated exploit scanner or some malware infected server doing a
similar thing. Look at the server logs for any publicly available web server
and you get this sort of thing all the time.

"newsgroups.comcast.net" wrote:

I am having an odd problem. Every day I get application errors from my
website. The errors are only from one particular ip address (The error is
System.NullReferenceException: Object reference not set to an instance of an
object....) The logs show that the request appear to be coming from some
kind of spider or bot. They have no url referrer and are the order of the
pages requested could not be "clicked" in the order requested. They all fail
at the same point. Here is the error message and a snip of the code.

Exception of type 'System.Web.HttpUnhandledException' was thrown.
System.NullReferenceException: Object reference not set to an instance of an
object.
at mgFunctions.mgSetCookies(String stroID)
at mgDisplay.Page_Load(Object sender, EventArgs e)
at System.Web.Util.CalliHelper.EventArgFunctionCaller (IntPtr fp, Object
o, Object t, EventArgs e)
at System.Web.Util.CalliEventHandlerDelegateProxy.Cal lback(Object sender,
EventArgs e)
at System.Web.UI.Control.OnLoad(EventArgs e)
at System.Web.UI.Control.LoadRecursive()
at System.Web.UI.Page.ProcessRequestMain(Boolean
includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Code snip.

Sub Page_Load(sender As Object, e As EventArgs)
if not Ispostback then
dim stroID as string = "u"
if Request.QueryString.Item("_o") <> string.empty then
stroID = Request.QueryString.Item("_o").tostring()
end if
mgFunctions.mgSetCookies(stroID)

end if
It seems like the application doesn't know what mgFunctions.mgSetCookies is
for this particular user only. Could this user be doing something malicious?

I am getting 30 or 40 errors a day just from this one user, but no other.
Any thoughts?

Mike

Apr 5 '06 #2

George Ter-Saakov

I would advice to ignore that

Those robots do some weird things, submit form with bad parameters (or no
parameters) .....

If you are tired of the error just ban it.

George.
"newsgroups.comcast.net" <Mi****************@noZorY.geZwaYrrenY.com> wrote
in message news:0q******************************@comcast.com. ..

I am having an odd problem. Every day I get application errors from my
website. The errors are only from one particular ip address (The error is
System.NullReferenceException: Object reference not set to an instance of
an
object....) The logs show that the request appear to be coming from some
kind of spider or bot. They have no url referrer and are the order of the
pages requested could not be "clicked" in the order requested. They all
fail
at the same point. Here is the error message and a snip of the code.

Exception of type 'System.Web.HttpUnhandledException' was thrown.
System.NullReferenceException: Object reference not set to an instance of
an
object.
at mgFunctions.mgSetCookies(String stroID)
at mgDisplay.Page_Load(Object sender, EventArgs e)
at System.Web.Util.CalliHelper.EventArgFunctionCaller (IntPtr fp, Object
o, Object t, EventArgs e)
at System.Web.Util.CalliEventHandlerDelegateProxy.Cal lback(Object
sender,
EventArgs e)
at System.Web.UI.Control.OnLoad(EventArgs e)
at System.Web.UI.Control.LoadRecursive()
at System.Web.UI.Page.ProcessRequestMain(Boolean
includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)

Code snip.

Sub Page_Load(sender As Object, e As EventArgs)
if not Ispostback then
dim stroID as string = "u"
if Request.QueryString.Item("_o") <> string.empty then
stroID = Request.QueryString.Item("_o").tostring()
end if
mgFunctions.mgSetCookies(stroID)

end if
It seems like the application doesn't know what mgFunctions.mgSetCookies
is
for this particular user only. Could this user be doing something
malicious?

I am getting 30 or 40 errors a day just from this one user, but no other.
Any thoughts?

Mike

Apr 5 '06 #3

Jason Hales

Don't forget that most spiders do not accept cookies.
Have you tried connecting to your site using a browser that doesn't
support cookies?
Perhaps mgFunctions.mgSetCookies() should check the value of
Request.Browser.Cookies before trying to get/set them

Apr 6 '06 #4

newsgroups.comcast.net

"Jason Hales" <ja*********@yahoo.com> wrote in message
news:11*********************@v46g2000cwv.googlegro ups.com...

Don't forget that most spiders do not accept cookies.
Have you tried connecting to your site using a browser that doesn't
support cookies?
Perhaps mgFunctions.mgSetCookies() should check the value of
Request.Browser.Cookies before trying to get/set them

I have tried that with no problem. The function does check for the existence
of the cookie. Also, many users browse with no cookies and I don't get any
errors. I suspect the bot is doing something is shouldn't be. It is coming
from
aplacecalledAbovenet_Communications_Inc.

Mike

Apr 6 '06 #5

Jason Hales

That's stumped me. It might help to post up some code for
mgFunctions.mgSetCookies

Jason

Apr 7 '06 #6

Mahhek

I also am having the same problem and the problem am having is in this line
"Request.QueryString.Item("_o") <> string.empty "

that if the Request.QueryString.Item("_o") = null then this exception appears. That means that if the previous page is not submitting anthing in the query string then the error is generated.

Apr 21 '06 #7

Mahhek

I also am having the same problem and the problem am having is in this line
"Request.QueryString.Item("_o") <> string.empty "

that if the Request.QueryString.Item("_o") = null then this exception appears. That means that if the previous page is not submitting anthing in the query string then the error is generated.

Apr 21 '06 #8