[Dshield] Microsoft-WebDAV-MiniRedir/5.1.2600

Shawn.Wilkerson@Firstdoor.com Shawn.Wilkerson at Firstdoor.com
Wed Nov 13 14:00:25 GMT 2002

Could be a WebDav exploit attempt.... 


-----Original Message-----
From: Mark Rowlands [mailto:mark.rowlands at minmail.net]
Sent: Wednesday, November 13, 2002 4:21 AM
To: list at dshield.org
Subject: [Dshield] Microsoft-WebDAV-MiniRedir/5.1.2600

Something I haven't seen before  popping up in my logs is this :-

"PROPFIND /c%24 HTTP/1.1" 405 915 "-" "Microsoft-WebDAV-MiniRedir/5.1.2600"

It has come from a couple of sources ...one Roadrunner, one AOL so my no. 1 
hypothesis is dumb user with Windows XP / Frontpage. 

Google has not found me any exploits, but Qualsys system scan generates some

similar looking log entries and call me old fashioned but when I see strings

containing 2600   :-)

Dshield mailing list
Dshield at dshield.org
To change your subscription options (or unsubscribe), see:

More information about the list mailing list