Re: Which webserver exploit is this?

[Fredrik Ostergren <fredrik.ostergren () FREEBOX COM>]

I got the same thing the other day.

his.ip.net - - [16/Jul/2000:20:21:10 -0500] "http://%a:%
p/,HEAD /" 501 -


But mine had a different error code (501) Anyone have a 
suggestion?

-Matthew

On Sat, 22 Jul 2000, Jaap wrote:

<FONT COLOR="#222255">> Hi,</FONT>
<FONT COLOR="#222255">></FONT>
<FONT COLOR="#222255">> I'm running a some Linux/apache 
webservers, and all of them have this</FONT>
<FONT COLOR="#222255">> somewhere in the logs. Now I don't 
mind ppl. trying things,</FONT>
<FONT COLOR="#222255">> but I would like to know what their 
trying.</FONT>
<FONT COLOR="#222255">></FONT>
<FONT COLOR="#222255">> Any ideas?</FONT>
<FONT COLOR="#222255">></FONT>
<FONT COLOR="#222255">> his.ip.net - - 
[21/May/2000:20:02:14 +0200] "http://%a:%p/,HEAD /" 403 -
</FONT>
<FONT COLOR="#222255">></FONT>
<FONT COLOR="#222255">> Grtz,</FONT>
<FONT COLOR="#222255">></FONT>
<FONT COLOR="#222255">> Jaap</FONT>
<FONT COLOR="#222255">></FONT>

Hi!
I'm not really "into" Windows/NT security but are you sure 
someone is trying to exploit the webserver?. Maybe there's 
a weird browser in the game or a portscan/OS detection 
tool?.

Cheers!

/ Fredrik.