Re: HTTP attack looking for /sumthin ?

[Johnny Calhoun <jcalhoun () lurhq com>]

This looks to be a banner grabbing attempt on your webservers.  Alot of 
scanners/worms will do this in an attempt to find out what type of web server 
you are running and compare it against a list of vulnerable servers for some 
particular exploit.  The `"/sumthin" is placed within the GET command to 
trigger a 404 error, which in turn reveals valuable information about your 
server back the requestor.  If the information returned by your server is 
useful to the scanner/worm you may see other exploits in the near future 
targeted towards your box.  For a more practical example, consider the 
sadmind worm which issues the following request for this purpose:
"GET x HTTP/1.0."  If you want to see what is returned by your box, simply 
telnet to your server on port 80 and issue the same request and hit ENTER 
twice.  You should see something similar to:

[root@calsys root]# telnet 127.0.0.1 80
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
GET /sumthin HTTP/1.0

HTTP/1.1 404 Not Found
Date: Thu, 17 Oct 2002 11:21:35 GMT
Server: Apache/2.0.40 (Unix)
Content-Length: 286
Connection: close
Content-Type: text/html; charset=iso-8859-1

. . .  and probably some 404 HTML error code too

Notice how it revealed the Web Server type, Version and OS it runs on.

I would consider this type of activity as an information gathering attempt, 
because it isn't an attack or exploit.

Hope this helps, 

-- 
Johnny Calhoun
Information Security Analyst
LURHQ Corporation



On Thursday 17 October 2002 01:56 pm, cory wrote:
> I have seen this on our servers, starting Oct 12 with 213.165.144.xxx
> (only one ip) and then again on the 15th from 194.236.60.xxx (also one
> ip) .
>
> Each time they hit they sent 5 to 6 attempts within one second, all
> looking in the same place.
>
> 213.165.144.xxx - - [12/Oct/2002:05:40:01 -0500] "GET /sumthin HTTP/1.0"
> 404 1086 "-" "-"
> 213.165.144.xxx - - [12/Oct/2002:05:40:01 -0500] "GET /sumthin HTTP/1.0"
> 404 1086 "-" "-"
> 213.165.144.xxx - - [12/Oct/2002:05:40:01 -0500] "GET /sumthin HTTP/1.0"
> 404 1086 "-" "-"
> 213.165.144.xxx - - [12/Oct/2002:05:40:01 -0500] "GET /sumthin HTTP/1.0"
> 404 1086 "-" "-"
> 213.165.144.xxx - - [12/Oct/2002:05:40:01 -0500] "GET /sumthin HTTP/1.0"
> 404 1086 "-" "-"
> (6 times in all.)
>
> All logs look identical to your post.
> What do we have here ?
>
> cheers,
> cory
>
> jmaywood1975 () hushmail com wrote:
> > Does anyone have any ideas what attack this might be?
> >
> > Below shows 4 seperate potential attacks by 3 different hosts, this is all
> > the activity in my logs for those three hosts, nothing more anywhere
> > related to those three ip address.
> >
> > It starts with a request for the directory /sumthin
> > maybe tries a header exploit by sending a VERSION method?
> > and connects ssl.
>
> ---------------------------------------------------------------------------
> - This list is provided by the SecurityFocus ARIS analyzer service.
> For more information on this free incident handling, management
> and tracking system please see: http://aris.securityfocus.com




----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com