Shawn.Wilkerson at Firstdoor.com
Wed Nov 13 14:00:25 GMT 2002
Could be a WebDav exploit attempt....
From: Mark Rowlands [mailto:mark.rowlands at minmail.net]
Sent: Wednesday, November 13, 2002 4:21 AM
To: list at dshield.org
Subject: [Dshield] Microsoft-WebDAV-MiniRedir/5.1.2600
Something I haven't seen before popping up in my logs is this :-
"PROPFIND /c%24 HTTP/1.1" 405 915 "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"
It has come from a couple of sources ...one Roadrunner, one AOL so my no. 1
hypothesis is dumb user with Windows XP / Frontpage.
Google has not found me any exploits, but Qualsys system scan generates some
similar looking log entries and call me old fashioned but when I see strings
containing 2600 :-)
Dshield mailing list
Dshield at dshield.org
To change your subscription options (or unsubscribe), see:
More information about the list