Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:




Security Incidents mailing list archives

http activity
From: Burak DAYIOGLU <dayioglu () METU EDU TR>
Date: Wed, 21 Mar 2001 10:03:09 +0200

Hello,
Surfing through logs of one web server box, I found out these four
lines, which I couldn't figure out. The first line is not a mistake,
but seems to be a purposeful inspection. I searched through the net
but couldn't be able to find out info on a phpads exploit.

The remaining three lines are awkward. First, the dates... Last two
lines have dates with reverse order (i.e. latter line should have been
logged earlier). The time settings on the box seem to be ok as well as
no signs of any intrusions.

Furthermore, with the last three lines, it looks like someone has had
been in search for an open-proxy what then what the heck is the syntax
error in it? I guess http:/ should have been http://, am I missing
something?

Can someone help me figure out these?

cheers,
Burak DAYIOGLU

X.X.X.X - - [19/Mar/2001:23:17:39 +0200] "GET
/adserver/phpads.php3?what=140x60&n=tr HTTP/1.1" 404 226
X.X.X.X - - [20/Mar/2001:01:52:03 +0200] "GET /"http:/some-domain.com",
HTTP/1.0" 404 217
X.X.X.X - - [20/Mar/2001:03:54:36 +0200] "GET /"http:/some-domain.com",
HTTP/1.0" 404 217
X.X.X.X - - [20/Mar/2001:03:43:14 +0200] "GET /"http:/some-domain.com",
HTTP/1.0" 404 217


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]