[Xitami] hack attack or just ignorance?

[Euman]

Im no expert either but it looks like a scan and all that took place was
404 "NOT FOUND" was returned. I may be wrong, I know you can
purchase the pro-edition and its supposed to be more secure but I
would also like to see a FAQ that list the things one should look for
so that you could write a script that constantly scans your log file for
malicious intent. If I had more of this info, I would write the program to 
do this and post it for everyone to use.

Any comments?

Euman
euman@bellsouth.net

----- Original Message ----- 
From: "Michael Bronder" <bronder@attbi.com>
To: "Xitami@Lists. Xitami. Org" <xitami@lists.xitami.org>
Sent: Thursday, April 11, 2002 9:11 PM
Subject: [Xitami] hack attack or just ignorance?


> I'm not a hard core user, and I just went to browse through my logs
> directory and found ALOT of lines like the ones below.  Now, the likely hood
> of anyone accessing my sight (archaetext.com) is very slight as I haven't
> told anyone about it.
> 
> These aren't malicious attempts are they?  Perl.exe mysteriously disappeared
> from my machine recently.
> 
> Am I missing a basic security setting or something?
> 
> Thanks,
> 
> mb
> 
> 24.128.19.74 - - [10/Apr/2002:23:54:53 -0500] "GET
> /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
> 24.128.19.74 - - [10/Apr/2002:23:54:57 -0500] "GET
> /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
> 24.128.19.74 - - [10/Apr/2002:23:54:58 -0500] "GET
> /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
> 24.128.19.74 - - [10/Apr/2002:23:55:02 -0500] "GET
> /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
> 24.128.19.74 - - [10/Apr/2002:23:55:03 -0500] "GET
> /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
> 
> 
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami