Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Categories

Crazy access.log entry

eggie5eggie5 Member Posts: 36
All the sudden today I got some crazy entry into my access.log file

"209.191.211.141 - - [24/Nov/2002:16:05:44 -0800] "GET /scripts/..%255c%255c../winnt/system32/cmd.exe?/c+dir" 404 1031"

I looked up the ip and it is a isp in Minnesota (I think that is what MN stands for) but that is all I can get.

What does this entry mean? What were they trying to do? I havent really pubicly told anyone about my site, let alone the scripts folder...

This is really creepy... can somebody help?

Comments

  • JonathanJonathan Member Posts: 2,914
    : All the sudden today I got some crazy entry into my access.log file
    :
    : "209.191.211.141 - - [24/Nov/2002:16:05:44 -0800] "GET /scripts/..%255c%255c../winnt/system32/cmd.exe?/c+dir" 404 1031"
    :
    : I looked up the ip and it is a isp in Minnesota (I think that is what MN stands for) but that is all I can get.
    :
    : What does this entry mean? What were they trying to do? I havent really pubicly told anyone about my site, let alone the scripts folder...
    :
    : This is really creepy... can somebody help?
    :

    Looks like a security exploit attempt to me, but I'm not an expert on Windows exploits (then, you don't need to be... ). Either way, seems like it failed. People could just guess your IP address or there may be IP address range scanners and it could be a work; I've seen very similar enteries on log files before but they were on a Linux box. :-D

    Jonathan


    -------------------------------------------
    Count your downloads:
    http://www.downloadcounter.com/
    And host your site:
    http://www.incrahost.com/
    Don't say I never give you anything... ;-)

Sign In or Register to comment.