NewsPublished 2 Oct 2025

More .well-known Scans, (Thu, Oct 2nd)

Source SANS ISC Handlers Diary

Description

I have been writing about the ".well-known" directory a few times before. Recently, about attackers hiding webshells &&#x23;x26;&#x23;x5b;1&&#x23;x26;&#x23;x5d;, and before that, about the purpose of the directory and why you should set up a "/.well-known/security.txt" file. But I noticed something else when I looked at today&&#x23;x26;&#x23;39;s logs on this web server. Sometimes you do not need a honeypot. Some attackers are noisy enough to be easily visible on a busy web server. This time, the attacker hit various URLs inside the ".well-known" directory. Here is a sample from the > 100 URLs hit:

Impact

For European organizations, the primary impact of these scans is the potential exposure of sensitive configuration and integration details that could facilitate more sophisticated attacks such as credential theft, privilege escalation, or supply chain compromises. If attackers gain insight into OAuth or OpenID Connect configurations, they might attempt to exploit weaknesses in authentication flows. Similarly, knowledge of app associations or AI plugin configurations could reveal trust relationships or API endpoints that might be abused. While the scans themselves do not directly compromise systems, they increase the risk profile by providing attackers with valuable reconnaissance data. Organizations in sectors with high reliance on web services, cloud infrastructure, and modern authentication protocols (e.g., finance, healthcare, government) are particularly at risk. The visibility of these scans also indicates that attackers are actively probing European web infrastructure, necessitating vigilant monitoring and response capabilities. Failure to control the information in these files or to detect scanning activity could lead to targeted attacks exploiting discovered weaknesses.

Defensive guidance

1. Conduct a thorough audit of all files within the ".well-known" directory to ensure they contain only necessary and non-sensitive information. 2. Collaborate with developers and system administrators before modifying or removing any ".well-known" files to avoid disrupting legitimate service functionality. 3. Implement strict access controls and input validation on endpoints serving these files to prevent unauthorized modifications or injections. 4. Monitor web server logs specifically for unusual or repeated access attempts to ".well-known" URLs to detect reconnaissance activities early. 5. Deploy a /.well-known/security.txt file to provide clear security contact information and vulnerability disclosure policies, potentially deterring opportunistic attackers. 6. Harden OAuth and OpenID Connect configurations by enforcing strong cryptographic keys, validating redirect URIs, and regularly reviewing authorization server settings. 7. For AI plugin and Terraform-related files, ensure that API endpoints and plugin definitions do not expose internal or sensitive infrastructure details. 8. Use web application firewalls (WAFs) to detect and block suspicious scanning patterns targeting ".well-known" directories. 9. Educate development and security teams about the purpose and risks associated with ".well-known" files to maintain ongoing vigilance. 10. Regularly update and patch web server software and related components to mitigate exploitation of any underlying vulnerabilities.

Summary

The threat involves attackers scanning the ".well-known" directory on web servers, a standardized location for hosting metadata files that describe various service configurations and capabilities. The scans target over 100 URLs, including files such as ai-plugin.json (used to advertise AI plugins like ChatGPT), apple-app-site-association (linking websites to mobile apps), oauth-authorization-server and openid-configuration (providing OAuth and OpenID Connect metadata for authentication and authorization), and terraform.json (used by Hashicorp Terraform for API endpoint discovery). These files are essential for the proper functioning of modern web applications and services, facilitating interoperability and security mechanisms. However, attackers leverage these files for reconnaissance to gather information about the infrastructure, authentication mechanisms, and integrations, which could be used in subsequent targeted attacks. The scans are described as noisy and easily visible in web server logs, suggesting attackers are conducting broad, opportunistic sweeps rather than targeted stealthy intrusions. No direct exploitation or webshell deployment has been observed in connection with these scans. The recommendation is to maintain these files as required but ensure their contents do not expose sensitive information or misconfigurations. Additionally, deploying a /.well-known/security.txt file is advised to communicate security policies and contact information for vulnerability reporting. This threat highlights the importance of monitoring and controlling metadata exposure in web services to reduce the attack surface.

References

isc.sans.edu/diary/rss/32340 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 7 Oct 2025, 01:35 UTC

References

Community reviews

Related threats