httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Randy Terbush <ra...@zyzzyva.com>
Subject Security probe
Date Tue, 16 Jul 1996 15:03:30 GMT

I'm forwarding this to Apache since I think it will be of
general interest. This was originally posted by me to the
robot-alert list that Rob Hartill, Brian Gough and I have
recently started.


------- Forwarded Message

Return-Path: robot-alert-request@zyzzyva.com
Received: (from lists@localhost) by sierra.zyzzyva.com (8.7.5/8.6.11) id OAA20125; Tue, 16
Jul 1996 14:56:28 GMT
Resent-Date: Tue, 16 Jul 1996 14:56:28 GMT
Message-Id: <199607161456.JAA20098@sierra.zyzzyva.com>
To: robot-alert@zyzzyva.com
Subject: Security: CGI probe from sentry.wood.com
X-uri: http://www.zyzzyva.com/
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Tue, 16 Jul 1996 09:56:24 -0500
From: Randy Terbush <randy@zyzzyva.com>
Resent-Message-ID: <"YeLOkC.A.N6E.b266x"@sierra>
Resent-From: robot-alert@zyzzyva.com
Reply-To: robot-alert@zyzzyva.com
X-Mailing-List: <robot-alert@zyzzyva.com> archive/latest/18
X-Loop: robot-alert@zyzzyva.com
Precedence: list
Resent-Sender: robot-alert-request@zyzzyva.com



While this is not necessarily a robot issue, I think it will be
of interest to this list.  I had the following probes on a number
of our servers. Malicious intent? You be the judge.


First the accesses:

vh_behlen.com/access_log-behlen.com:sentry.wood.com - - [14/Jul/1996:22:43:17 -0500] "GET
/cgi-bin/phf?Qalias=foo%0aid" 404 419
vh_cdmasters.com/access_log-cdmasters.com:sentry.wood.com - - [15/Jul/1996:00:26:34 -0500]
"GET /cgi-bin/phf?Qalias=foo%0aid" 404 419
vh_cybercrafters.com/access_log-cybercrafters.com:sentry.wood.com - - [15/Jul/1996:10:25:47
-0500] "GET /cgi-bin/phf?Qalias=foo%0aid" 404 419
vh_figureart.com/access_log-figureart.com:sentry.wood.com - - [15/Jul/1996:03:18:35 -0500]
"GET /cgi-bin/phf?Qalias=foo%0aid" 404 419
vh_funku.com/access_log-funku.com:sentry.wood.com - - [15/Jul/1996:07:42:14 -0500] "GET /cgi-bin/phf?Qalias=foo%0aid"
404 419
vh_fway.com/access_log-fway.com:sentry.wood.com - - [15/Jul/1996:10:45:34 -0500] "GET /cgi-bin/phf?Qalias=foo%0aid"
404 419
vh_innovativ.com/access_log-innovativ.com:sentry.wood.com - - [15/Jul/1996:04:58:18 -0500]
"GET /cgi-bin/phf?Qalias=foo%0aid" 404 419
vh_insvideo.com/access_log-insvideo.com:sentry.wood.com - - [15/Jul/1996:09:22:49 -0500] "GET
/cgi-bin/phf?Qalias=foo%0aid" 404 419
vh_northdallas.com/access_log-northdallas.com:sentry.wood.com - - [15/Jul/1996:07:27:53 -0500]
"GET /cgi-bin/phf?Qalias=foo%0aid" 404 419
vh_remax-central.com/access_log-remax-central.com:sentry.wood.com - - [15/Jul/1996:02:34:43
-0500] "GET /cgi-bin/phf?Qalias=foo%0aid" 404 419
vh_resch.com/access_log-resch.com:sentry.wood.com - - [15/Jul/1996:06:39:16 -0500] "GET /cgi-bin/phf?Qalias=foo%0aid"
404 419
vh_sportdoc.com/access_log-sportdoc.com:sentry.wood.com - - [15/Jul/1996:04:07:04 -0500] "GET
/cgi-bin/phf?Qalias=foo%0aid" 404 419
vh_bee.org/access_log-bee.org:sentry.wood.com - - [15/Jul/1996:03:45:50 -0500] "GET /cgi-bin/phf?Qalias=foo%0aid"
404 419
vh_doesgodexist.org/access_log-doesgodexist.org:sentry.wood.com - - [15/Jul/1996:05:01:23
-0500] "GET /cgi-bin/phf?Qalias=foo%0aid" 404 419
vh_groundwater.org/access_log-groundwater.org:sentry.wood.com - - [15/Jul/1996:05:54:09 -0500]
"GET /cgi-bin/phf?Qalias=foo%0aid" 404 419
vh_ncite.org/access_log-ncite.org:sentry.wood.com - - [15/Jul/1996:05:04:38 -0500] "GET /cgi-bin/phf?Qalias=foo%0aid"
404 419
vh_nebmed.org/access_log-nebmed.org:sentry.wood.com - - [15/Jul/1996:05:32:50 -0500] "GET
/cgi-bin/phf?Qalias=foo%0aid" 404 419


And the errors:

[Mon Jul 15 05:54:09 1996] access to /docroot/global/groundwater.org/cgi-bin failed for sentry.wood.com,
reason: File does not exist
[Mon Jul 15 02:02:55 1996] access to /docroot/global/infotravel.com/cgi-bin/phf failed for
204.253.173.9, reason: File does not exist
[Mon Jul 15 04:58:18 1996] access to /docroot/global/innovativ.com/cgi-bin failed for sentry.wood.com,
reason: File does not exist
[Mon Jul 15 05:04:38 1996] access to /docroot/global/ncite.org/cgi-bin failed for sentry.wood.com,
reason: File does not exist
[Mon Jul 15 02:34:43 1996] access to /docroot/global/remax-central.com/cgi-bin failed for
sentry.wood.com, reason: File does not exist
[Mon Jul 15 04:07:04 1996] access to /docroot/global/sportdoc.com/cgi-bin failed for sentry.wood.com,
reason: File does not exist
[Mon Jul 15 10:45:34 1996] access to /docroot/global/fway.com/cgi-bin failed for sentry.wood.com,
reason: File does not exist
[Mon Jul 15 07:42:14 1996] access to /docroot/global/funku.com/cgi-bin failed for sentry.wood.com,
reason: File does not exist
[Mon Jul 15 10:25:47 1996] access to /docroot/global/cybercrafters.com/cgi-bin failed for
sentry.wood.com, reason: File does not exist
[Mon Jul 15 06:39:16 1996] access to /docroot/global/resch.com/cgi-bin failed for sentry.wood.com,
reason: File does not exist
[Mon Jul 15 09:22:49 1996] access to /docroot/global/insvideo.com/cgi-bin failed for sentry.wood.com,
reason: File does not exist
[Mon Jul 15 07:27:53 1996] access to /docroot/global/northdallas.com/cgi-bin failed for sentry.wood.com,
reason: File does not exist






------- End of Forwarded Message




Mime
View raw message