title: Hacking attempt, what were they trying to do and how can I check if they succeeded?
body: <p>I recently asked this question:
  <a href="https://stackoverflow.com/questions/5153421/attempted-exploit">Attempted exploit?</a></p>
  
  <p>But as I checked the logs some more I found out that they've been doing some more stuff and I felt that it would need a new question to cover them all. </p>
  
  <p>First of all, my log has a couple of thousant logs from today. There must've been a couple of thousand requests per minut.</p>
  
  <p><strong>Question 1:</strong>
  The logged IP was our hosts IP. How could they've spoofed this or did the hacking attempt come from inside their network via an infected computer?</p>
  
  <p><strong>Question 2:</strong>
  I have a logged error:</p>
  
  <blockquote>
    <p>The state information is invalid for
    this page and might be corrupted.</p>
  </blockquote>
  
  <p>The logged path for this one was:</p>
  
  <pre><code>OurURL/?ctl00$ctl00$ctrlheadermenu$ctrlsearchbox$btnsearch=sã¶k&amp;ctl00$ctl00$cp
  </code></pre>
  
  <p>Also, I found this in the stack trace:</p>
  
  <blockquote>
    <p>The input is not a valid Base-64 string as it contains a non-base 64
    character, more than two padding
    characters, or a non-white space
    character among the padding
    characters.</p>
  </blockquote>
  
  <p>What were they trying to do with this?</p>
  
  <p><strong>Question 3:</strong>
  I also found a request to this page. Where they trying to list our content?</p>
  
  <pre><code>OurURL/nessus=&lt;!--#exec cmd="dir"--&gt;
  </code></pre>
  
  <p><strong>Question 4:</strong>
  There was also a request to thirl, which I found to be an attempted SQL-injection. Is there a way to check what they did? And what would it do if it was successful?</p>
  
  <pre><code>OurURL/webresource.axd?'%2bconvert(varchar%2c0x7b5d)%2b'=1
  </code></pre>
  
  <p>There's probably a couple of thousand logged searched and attempted urls that didn't exist but I can't list them all here.</p>