[Dshield] Scan of my webserver

Jan Wildeboer jw at domainfactory.de
Wed Mar 5 14:13:43 GMT 2003

Patrick Andry wrote:
> Yes, I have removed mod_proxy from the webserver once I saw that scan. 
> The first two however have me stumped.

>>>x.x.x.x - - [23/Feb/2003:16:11:45 -0500] "\x04\x01" 200 5533
>>>x.x.x.x - - [23/Feb/2003:16:12:06 -0500] "\x05\x01" 200 5533

Compare this to http://lists.insecure.org/lists/bugtraq/2000/Nov/0223.html

Seems to be some sort of socks5 remote exploit, but I could be wrong

Jan Wildeboer

More information about the list mailing list