odd things in website log file
Sunday, October 19, 2003 by feline | Discussion: WinCustomize Talk
somewhat off topic, but there we go 
at another website (a message board) i have been learning about website log files, by reading the access.log file produced.
in this i am finding very odd entries for the file they are trying to access, like:
/scripts/root.exe?/c+dir
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir
i presume someone is trying to hack the server. anyone know where i can get more info on what is going on here, and what other things to look out for?
at another website (a message board) i have been learning about website log files, by reading the access.log file produced.
in this i am finding very odd entries for the file they are trying to access, like:
/scripts/root.exe?/c+dir
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir
i presume someone is trying to hack the server. anyone know where i can get more info on what is going on here, and what other things to look out for?
yrag
Reply #2 Sunday, October 19, 2003 4:59 PM
Reply #2 Sunday, October 19, 2003 4:59 PM
feline...it's not a hack.
http://webstats.anlx.net/content/logfileprocess.asp
http://webstats.anlx.net/content/logfileprocess.asp
feline
Reply #3 Monday, October 20, 2003 1:20 PM
cool, thanks
normally google is my first stop, but getting info on the format of access.log was such a fuss (via google) that i didnt bother.
the lines on that page are a close match (from memory) for the lines i am seeing in the log file.
yrag, is that the right link? i had a look, but there was no imidiate sign of technical info on the lines in the log files.
Reply #3 Monday, October 20, 2003 1:20 PM
| kthxbye - Chances are that would be a worm like Nimda trying to gain access to your server. |
cool, thanks
normally google is my first stop, but getting info on the format of access.log was such a fuss (via google) that i didnt bother.
the lines on that page are a close match (from memory) for the lines i am seeing in the log file.
| yrag - feline...it's not a hack. |
yrag, is that the right link? i had a look, but there was no imidiate sign of technical info on the lines in the log files.
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
Reply #1 Sunday, October 19, 2003 4:58 PM
Example: http://www.sanctuminc.com/news/advisory/2001/20010901_nimda.html
Googling either of those statements will produce good results for you.