Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: softfail (nike.apache.org: transitioning domain of
 delbd+jakarta@oma.be does not designate 195.238.6.51 as permitted sender)
Message-ID: <4818DD63.7000209@oma.be>
Date: Wed, 30 Apr 2008 22:58:11 +0200
From: David Delbecq <delbd+jakarta@oma.be>
User-Agent: Thunderbird 2.0.0.12 (X11/20080227)
MIME-Version: 1.0
To: Tomcat Users List <users@tomcat.apache.org>
Subject: Re: hackers sending long URLs to probe site?
References: 
 <DF3A409993D9D940BA8B02F0C396CF8A01501724@mailserver.form-studios.com>
 <49AC6EBD-DD2F-484B-8DC9-883AFC79A793@diglloyd.com>
 <4810BF97.2010703@christopherschultz.net>
 <8FE1970B-9447-4DEE-8EF2-F1FF3AA6168F@diglloyd.com>
In-Reply-To: <8FE1970B-9447-4DEE-8EF2-F1FF3AA6168F@diglloyd.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit

DIGLLOYD INC a �crit :
> Christopher,
>
> Thank you.  This is helpful.  Sorry about the "hijacked thread", I 
> didn't think of that.
>
> Yes, I've double-checked that my site isn't generating the bad links. 
> It's all static HTML and I've searched for any duplications, "../../" 
> type things, etc. I don't currently generate any URLs, and the sheer 
> length of the duplication rules out any basic mistakes in static html.
>
> I have directory indexes turned off, confirmed by seeing 404 codes on 
> certain directories in which I don't have index files (intentionally).
>
> Lloyd 
A bit late to respond, but it might also be a worm infected computer 
trying to probe your server to check if it can be used as an attack 
vector. However, am more used to worms checking for urls containing 
cmd.exe, which probes for security holes in IIS.

---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org