[Dshield] Scan of my webserver
jw at domainfactory.de
Wed Mar 5 14:13:43 GMT 2003
Patrick Andry wrote:
> Yes, I have removed mod_proxy from the webserver once I saw that scan.
> The first two however have me stumped.
>>>x.x.x.x - - [23/Feb/2003:16:11:45 -0500] "\x04\x01" 200 5533
>>>x.x.x.x - - [23/Feb/2003:16:12:06 -0500] "\x05\x01" 200 5533
Compare this to http://lists.insecure.org/lists/bugtraq/2000/Nov/0223.html
Seems to be some sort of socks5 remote exploit, but I could be wrong
More information about the list