[thelist] strange log entries

Norman Beresford n.beresford at anansi.co.uk
Thu May 10 03:21:13 CDT 2001


Hi Massimo

Thats the sign of someone looking for an exploit in your web server.
Obviously they didn't realise that you were running UNIX, otherwise (unless
they were an extremly clueless script kiddie) they wouldn't have bothered.

The other day I was looking through the logs of one of our sites and in the
space of a minute a number of exploits had been tried, mainly looking for
sample files which had been left on the server

Norman


----- Original Message -----
From: <webmaster at menouno.com>
To: <thelist at lists.evolt.org>
Sent: Thursday, May 10, 2001 9:16 AM
Subject: [thelist] strange log entries


> Hi;
>
> just wondering if anybody has ever seen a request like this one in a
> logfile:
>
> /msadc/..À¯..À¯..À¯..//winnt/system32/cmd.exe?/c+dir+c:\
>
> considering that this server runs UNIX, it was of course a 404.
> But what the heck were they looking for?
>
> Also, are these other 404 request simply goofy attempts to save a
> page with IE5?
>
>  /_vti_inf.html
>  /_vti_bin/shtml.exe/_vti_rpc
>
>
> thanks, ciao
>
>
> Massimo
>
> ---------------------------------------
> For unsubscribe and other options, including
> the Tip Harvester and archive of TheList go to:
> http://lists.evolt.org Workers of the Web, evolt !
>





More information about the thelist mailing list