Security Incidents mailing list archives
Re: Unusual URLs sent to IIS 5.0 server
From: Filipe Almeida <filipe () IST UTL PT>
Date: Thu, 23 Nov 2000 21:57:56 +0000
Hi Carv, Perhaps your host was or is being used as a warez distribution site. Check the following directory on your ftp or http server: "/Data/prev. updates/2000/. t/. damn/I am so/h u n g r y/" And check one of those directories for world writability. On Tue, Nov 21, 2000 at 10:06:18PM -0000, H Carvey wrote:
For several days, I have been seeing the following URLs (and similar ones) in my web server logs: /Data/prev.+updates/2000/.+++t/.++++++ +++++++++++++++++++++++++++++ ++++++++++damn/I+++++am+++++++ ++++++++++++++++so/h+++++u++++ ++n++++++g+++++++r+++y/-=ISOZ=- /No_One_Lives_Forever-RAZOR1911/ and /Data/prev.[1]updates/2000/.[3]t/.[45]damn/I [5]am[23]so/h[5]u[6]n[6]g[7]r[3]y/ The response code is 403. Can anyone tell me what this is? Thanks, ./Carv
-- Filipe Almeida aka LiquidK
Current thread:
- Unusual URLs sent to IIS 5.0 server H Carvey (Nov 24)
- Re: Unusual URLs sent to IIS 5.0 server Filipe Almeida (Nov 28)
- Re: Unusual URLs sent to IIS 5.0 server Josh Brandt (Nov 29)
- <Possible follow-ups>
- Re: Unusual URLs sent to IIS 5.0 server Cook, Oliver (Nov 28)
- Re: Unusual URLs sent to IIS 5.0 server joe (Nov 28)