Home page logo

basics logo Security Basics mailing list archives

Re: Strange Web Server Log Entries
From: Sean Malloy <spinelli85 () gmail com>
Date: Thu, 6 Dec 2007 21:38:20 -0600

On Thu, Dec 06, 2007 at 08:23:29PM -0500, Jason Muskat de VE3TSJ - GCFA, GCUX, CEI, CEH wrote:

Logs are always interesting to review. It does look like the 1st HTTP  
GET request returned the page requested, and it did; however, your  
frame of context is incorrect. You should review your server's virtual  
hosting configuration. I'm sure you will have a default "*" (all)  
virtual host. The request for http://www.microsoft.com/ will serve  
your site's root page (/index.html).

The other requests seem to be an attacker checking to see if your  
server is an open-proxy. The 400 series return (error) codes are a  
good sign that your server is not.


Jason Muskat de VE3TSJ | GCFA, GCUX, CEI, CEH
e. Jason () TechDude Ca
m. 416 .414 .9934


As for as I can tell all lines in httpd.conf that refer to virtual hosting are commented with a '#' symbol.
I haven't ever done anything with virtual hosts before. Thanks for the
Sean Malloy
Home Page: www.catgrepsort.com

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]