odd things in website log file

October 19, 2003 4:42 PM from

somewhat off topic, but there we go

at another website (a message board) i have been learning about website log files, by reading the access.log file produced.

in this i am finding very odd entries for the file they are trying to access, like:

/scripts/root.exe?/c+dir
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir

i presume someone is trying to hack the server. anyone know where i can get more info on what is going on here, and what other things to look out for?

2,044 views 3 replies

Reply #1 October 19, 2003 4:58 PM from

WinCustomize Forums Top

Chances are that would be a worm like Nimda trying to gain access to your server.

Example: http://www.sanctuminc.com/news/advisory/2001/20010901_nimda.html

Googling either of those statements will produce good results for you.

Reply #2 October 19, 2003 4:59 PM from

WinCustomize Forums Top

feline...it's not a hack.

http://webstats.anlx.net/content/logfileprocess.asp

Reply #3 October 20, 2003 1:20 PM from

WinCustomize Forums Top

kthxbye - Chances are that would be a worm like Nimda trying to gain access to your server.

cool, thanks

normally google is my first stop, but getting info on the format of access.log was such a fuss (via google) that i didnt bother.

the lines on that page are a close match (from memory) for the lines i am seeing in the log file.

yrag - feline...it's not a hack.

yrag, is that the right link? i had a look, but there was no imidiate sign of technical info on the lines in the log files.

Welcome Guest! Please take the time to register with us.

Richer content, access to many features that are disabled for guests like commenting and posting on the forums.
Access to a great community, with a massive database of many, many areas of interest.
Access to contests & subscription offers like exclusive emails.
It's simple, and FREE!