[Dshield] Interesting Web Log Entries

George A. Theall theall at tifaware.com
Thu Mar 23 22:13:48 GMT 2006


On Thu, Mar 23, 2006 at 01:29:33PM -0800, DigitalNation wrote:

> These are mostly outdated PHP cross scripting attempts. 

I wasn't asking what these are but rather what tool / worm is generating
them. 

> The awstats.pl is
> very commonly seen. 

Yes, but unless your logs are different than mine, the attempts involve
arbitrary command execution rather than cross-site scripting attacks.

> If your versions of any of these apps (if you are
> running any) 

Each of the lines I included showed 404 return codes.


George
-- 
theall at tifaware.com
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 191 bytes
Desc: not available
Url : http://www.dshield.org/pipermail/list/attachments/20060323/b11bb9d5/attachment.bin


More information about the list mailing list