[Xitami] is Xitami hack-proof?

Mike Shumko xitami@lists.xitami.org
Mon, 22 Oct 2001 15:40:32 -0700


I've been running Xitami on my NT Workstation for years. Works great, love
it.

I notice in my access logs that I have tons of requests every day for items
such as 

"GET
/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c../winnt/sy
stem32/cmd.exe?/c+dir HTTP/1.0"

"GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"

My guess is that these are attempts to hack into a MS IIS web server. Are
any of these attempts ever successful against a Xitami web server?

I ask this because I had a process running on my NT Workstation this morning
called Proxy Desktop, which I don't recognize. So I'm wondering if my
workstation was compromised thru the web server.

Mike Shumko
Senior Manager
Robelle Solutions Technology Inc.
1.888.robelle
www.robelle.com