[Xitami] Code Red requests

[John Poltorak]

On Tue, Aug 07, 2001 at 08:42:29AM -0500, Craig Morrison wrote:
> 
> Yes, Xitami shows the full HTTP GET request that allows the attacker to gain
> access to an unpatched IIS (4,5) system.
> 
> No, it is not. The request just sets up the vulnerable system to allow access
> by the attacker.

I heard differently from someone who had been tracing packets...

They said the worm is sent along as part of the GET request, and there is 
no requirement for a subsequent connection.

I'm going to do a trace myself to see if I can confirm this.

BTW is there any that XITAMI can be configured to perform a specific 
action depending on a request such "Get /default.ida..." ?

Or how could create a page which would satisfy this GET request?
 
> (176 requests in 8 hours today.)
> 
> John Poltorak wrote:
> > 
> > Does Xitami show the complete Code Red request in the ACCESS.LOG made by
> > infected systems?
> > 
> > And if so, is that the full extent of the worm?
> 
> -- 
> 
> Craig Morrison
>   MTS Professional @ http://www.2cah.com/
>   A Win32 Email server that works for _you_.
> EzMTS - A _free_ Win32 EMail Server
>   http://www.ezmts.org/
>   Anonymous FTP at ftp://ftp.ezmts.org
> 

-- 
John