Security Incidents: CGI Scans on web server

From: Bjorn Djupvik <Bjorn.Djupvik_at_GLOBALONE.NET>
Date: Tue, 5 Dec 2000 09:56:46 +0100

Is people still doing this? These are ancient exploits but I still got scanned for them.. ahh well....

xxx.xxx.123.23 - - [03/Dec/2000:23:29:12 +0200] "GET /cgi-bin/phf HTTP/1.0" 404 1323 - Referrer=- -
xxx.xxx.123.23 - - [03/Dec/2000:23:29:13 +0200] "GET /cgi-bin/Count.cgi HTTP/1.0" 404 1329 - Referrer=- -
xxx.xxx.123.23 - - [03/Dec/2000:23:29:14 +0200] "GET /cgi-bin/test-cgi HTTP/1.0" 404 1328 - Referrer=- -
xxx.xxx.123.23 - - [03/Dec/2000:23:29:15 +0200] "GET /cgi-bin/php.cgi HTTP/1.0" 404 1327 - Referrer=- -
xxx.xxx.123.23 - - [03/Dec/2000:23:29:16 +0200] "GET /cgi-bin/handler HTTP/1.0" 404 1327 - Referrer=- -
xxx.xxx.123.23 - - [03/Dec/2000:23:29:17 +0200] "GET /cgi-bin/webgais HTTP/1.0" 404 1327 - Referrer=- -
xxx.xxx.123.23 - - [03/Dec/2000:23:29:18 +0200] "GET /cgi-bin/websendmail HTTP/1.0" 404 1331 - Referrer=- -
xxx.xxx.123.23 - - [03/Dec/2000:23:29:19 +0200] "GET /cgi-bin/webdist.cgi HTTP/1.0" 404 1331 - Referrer=- -
xxx.xxx.123.23 - - [03/Dec/2000:23:29:20 +0200] "GET /cgi-bin/faxsurvey HTTP/1.0" 404 1329 - Referrer=- -
xxx.xxx.123.23 - - [03/Dec/2000:23:29:21 +0200] "GET /cgi-bin/htmlscript HTTP/1.0" 404 1330 - Referrer=- -
xxx.xxx.123.23 - - [03/Dec/2000:23:29:22 +0200] "GET /cgi-bin/pfdisplay.cgi HTTP/1.0" 404 1333 - Referrer=- -
xxx.xxx.123.23 - - [03/Dec/2000:23:29:23 +0200] "GET /cgi-bin/perl.exe HTTP/1.0" 404 1328 - Referrer=- -
xxx.xxx.123.23 - - [03/Dec/2000:23:29:24 +0200] "GET /cgi-bin/wwwboard.pl HTTP/1.0" 404 1331 - Referrer=- -
xxx.xxx.123.23 - - [03/Dec/2000:23:29:25 +0200] "GET /cgi-bin/ews/ews/architext_query.pl HTTP/1.0" 404 1346 - Referrer
=- -
xxx.xxx.123.23 - - [03/Dec/2000:23:29:26 +0200] "GET /cgi-bin/jj HTTP/1.0" 404 1322 - Referrer=- -

cheers,

Bjorn
Received on Dec 06 2000