[Xitami] Most Requested Files

[Dean Coffey]

On Feb 01 17:13, Steven L. Haas grabbed a big piece of chalk and scribbled 
something about--> [Xitami] Most Requested Files thusly:

>Now that I have my web server up and running, I'm focusing on making it as
>error free as possible.  Since 6am today I've gotten 1078 hits and 95 http
>errors.  I've used WebLog expert to analyze the access.log file, and it is
>showing all of the errors to be 404 not found errors, but none of my links
>are bad, so I don't understand what this could be caused by.  The only thing
>I can track down is that the most commonly requested files are cmd.exe and
>httpodbc.dll, and I don't know why these particular files are being
>accessed.  I am wondering if Xitami is using these files for it's own use,
>and that's why they're being requested, if some javascript I'm using needs
>them, or if it's an issue of people actually trying to access them.  I can't
>imagine the point of downloading that dll file or the command prompt, but
>when I try to access those files with the paths listed in the WebLog report,
>I get an error about the file not being found on the server.  Any ideas?

Steven, if I'm not mistaken, the httpodbc.dll lookup is something similar to 
Nimda or Code Red trying to spread by looking for vulnerable Microsoft IIS 
servers.  As for the cmd.exe access, it is something similar as well, as it 
appears to be tryin to execute some code on your server that you don't intend 
to allow.  If you go to http://www.google.com and search for "httpodbc.dll 
log entry" or similar, and also "cmd.exe log entry" as a separate search, you 
should find all sorts of info.  All these worms that are loose on the net can 
make your log file a mess sometimes...I know that in the last 6 months, out 
of thousands of 404 errors being logged, I have had less than 20 real 404s 
occur.  The rest were various worms, malware, or script kiddies checking to 
see if my server might be an easy mark.  I'm happy to say that according to 
my manual monitoring, and the results reported by Snort running in IDS mode 
24/7, so far they haven't found Xitami to be easy to crack.  :)

HTH
Dean Coffey