Forum Moderators: DixonJones
about a month ago I got my first webpage on the net. Since there has been some problems with the stats analyzing program Ive had to look directly at the log file to see the trafic to my page. Today I noticed some odd enties:
195.101.23.4 - - [27/Jan/2003:05:20:03 +0000] "HEAD /cgi-bin/formmail.pl HTTP/1.1" 404 645 "http://wwWebmasterWorldebsite.com/" "-"
196.30.134.10 - - [27/Jan/2003:05:20:11 +0000] "GET /cgi-bin/formmail.pl HTTP/1.0" 404 645 "http://wwWebmasterWorldebsite.com/" "-"
203.235.116.160 - - [27/Jan/2003:05:20:11 +0000] "GET /cgi-bin/formmail.pl HTTP/1.0" 404 645 "http://wwWebmasterWorldebsite.com/" "-"
213.56.102.115 - - [27/Jan/2003:05:20:23 +0000] "GET /cgi-bin/formmail.pl HTTP/1.1" 404 657 "http://wwWebmasterWorldebsite.com/" "-"
What does this mean? Is someone trying to send spam through my website? (and in that case, did they succeed?) What is cgi-bin? And also, most entries start with GET, why does this one (and a couple of others) start with HEAD?
I would be very happy if I got answers to theese questions
Helena
Did it work?
No your logs show a 404 (file not found) so i doubt you even have it installed.
Why HEAD and not GET?
Most likely they are attempting to look for scripts without tripping too many alarms (since they think, wrongly, that people only check for GET & HEAD exploit attempts).
- Tony
Pendanticist.
Do you have any tip on where to find information on how to interpret the log file and what the different codes (like 404) mean?
Helena
[w3.org...]
Generally the first digit tells you the generic status;
2XX - Server gave some content to the user without issue
200 Success (client requested entire resource)
206 Success (client requested a range)
3XX - Resource has been moved, tell user new location
301 Moved permanently (go there now and next time)
302 Moved temporary (go there now, but come here next time)
4XX - There was a problem and it was the user's fault
400 Client didn't use the correct syntax
401 Client needs to authorise themselves
403 Not allowed to give client that resource
404 Cannot find the resource
406 Client doesn't userstand the resource
5XX - There was a problem and it was the server's fault
500 Server error
-Tony
Apparently this guy failed because you don't have a FormMail script on
your site.
You think they'd have better things to do!
Suzy
Somebody was trying to find a hole on your web site so they can break in.
Close but not quite...
If they really had found what they were looking for they wouldn't have used it to break into the site - they would have used it to send out junkmail via Helena's website.
Normally you'd be right in saying that script scanning is an attempt to crack the site but they went for formmail rather than trying more juicy scripts first which suggests they were after that and that alone - if you browse your logs from time to time you notice spammers doing this stuff a lot, often searching for pl and cgi with a mix of uppercase and lowercase filenames.
- Tony
Today for example, these entries were in the logfile:
212.54.0.24 - - [18/Feb/2003:11:29:47 +0000] "GET /cgi-bin/formmail.pl HTTP/1.0" 404 645 "http://wwWebmasterWorldebsite.net/" "-"
212.54.0.24 - - [18/Feb/2003:11:29:47 +0000] "GET /cgi-bin/formmail.cgi HTTP/1.0" 404 645 "http://wwWebmasterWorldebsite.net/" "-"
A search on Ripe Whois Database tells me the IP is owned by Elisa Internet Ltd in Finland (FI-KOLUMBUS-NET). A search on VisualRoute, a service that somehow tracks the IP yeilds zombiemud.megabaud.fi (in kolumbus.net). Im not 100% sure, but I think this could be the actual user...
What if I were to write to abuse@kolumbus.fi and report this looser? Is this a bad idea? Would I get more trouble than twisted malicious pleasure if I did that?
Helena
What if I were to write to abuse@kolumbus.fi and report this looser? Is this a bad idea? Would I get more trouble than twisted malicious pleasure if I did that?
Report each and every one of them. They are bottom feeders who sole purpose is to find vulnerabilities thru which to send UCE/SPAM.
Let no one disuade you.
Another thread:
CGI-BIN Formmail Queries <- I'm fighting with a major University
Are there "any" legitimate reasons for them? [webmasterworld.com]
I can't find this one - "UCE/SPAMers using Open Proxy..." where I mentioned closing two open proxies in a week.
The idea behind reporting these bottom feeders is keeping them busy jumping from ISP to ISP on a continual basis.
Do not disillusion yourself that these queries are not serious because they are...very serious. Especially if they find that vulnerability.
Makes no difference to me whether they were successful or not. The very fact that they tried was enough for me.
You can make a difference! Report them.
Pendanticist.
