Article View: es.comp.hackers
Article #57477Interpretar log web
From: Fabri
Date: Sat, 02 Feb 2002 07:07
Date: Sat, 02 Feb 2002 07:07
28 lines
2103 bytes
2103 bytes
�Esto que reproduzco a continuaci�n es un intento de ataque a mi personal servidor privado web? Lo digo porque se repite algo parecido con cierta frecuencia desde distintas ips �C�mo saber si tiene �xito? �d�nde hay m�s info? Saludos 03:08:39 62.163.12.245 GET /scripts/root.exe 404 03:08:39 62.163.12.245 GET /MSADC/root.exe 404 03:08:39 62.163.12.245 GET /c/winnt/system32/cmd.exe 404 03:08:39 62.163.12.245 GET /d/winnt/system32/cmd.exe 404 03:08:40 62.163.12.245 GET /scripts/..%5c../winnt/system32/cmd.exe 500 03:08:40 62.163.12.245 GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe 500 03:08:40 62.163.12.245 GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/cmd.exe 404 03:08:40 62.163.12.245 GET /msadc/..%5c../..%5c../..%5c/..� ../..� ../..� ../winnt/system32/cmd.exe 500 03:08:40 62.163.12.245 GET /scripts/..� ../winnt/system32/cmd.exe 500 03:08:40 62.163.12.245 GET /scripts/winnt/system32/cmd.exe 404 03:08:41 62.163.12.245 GET /winnt/system32/cmd.exe 404 03:08:41 62.163.12.245 GET /winnt/system32/cmd.exe 404 03:08:41 62.163.12.245 GET /scripts/..%5c../winnt/system32/cmd.exe 500 03:08:41 62.163.12.245 GET /scripts/..%5c../winnt/system32/cmd.exe 500 03:08:42 62.163.12.245 GET /scripts/..%5c../winnt/system32/cmd.exe 500 03:08:42 62.163.12.245 GET /scripts/..%2f../winnt/system32/cmd.exe 500
Technical Details
Message-ID:
<Xns91A953B649D5CArevaciaSL@130.133.1.4>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!supernews.com!news.tele.dk!small.news.tele.dk!130.133.1.3!fu-berlin.de!uni-berlin.de!80-26-82-30.uc.nombres.ttd.ES!not-for-mailShow Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII X-Google-Thread: f4463,ead7dc212e339bb8,start X-Google-Attributes: gidf4463,public X-Google-ArrivalTime: 2002-02-01 23:07:08 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!sn-xit-02!supernews.com!news.tele.dk!small.news.tele.dk!130.133.1.3!fu-berlin.de!uni-berlin.de!80-26-82-30.uc.nombres.ttd.ES!not-for-mail From: Fabri <fabri@terra.es> Newsgroups: es.comp.hackers Subject: Interpretar log web Date: 2 Feb 2002 07:07:07 GMT Organization: fabrica Lines: 28 Message-ID: <Xns91A953B649D5CArevaciaSL@130.133.1.4> NNTP-Posting-Host: 80-26-82-30.uc.nombres.ttd.es (80.26.82.30) X-Trace: fu-berlin.de 1012633627 41469986 80.26.82.30 (16 [109075]) User-Agent: Xnews/4.06.22