Gozilla/4.0

Just looking for formmail.pl

[bobriggs]

I did a site search first:
Anyone care to add to this list [webmasterworld.com]

Not sure if that's the same one (Goz!lla in the former). But I doubt this one would obey robots.txt

Always from a different IP
UA:
Gozilla/4.0 (compatible; MSIE 5.5; windows 2000)

Always doing a GET on formmail.pl (of course leaving the recipient's email in the logs - DUH! with the title of the email formed FORMMAIL Found!)

Harmless if you don't have formmail.pl, but it will produce a 404. I've just banned it with mod-rewrite.

[frontpage]

I get those requests for formmail.pl as well. What the exactly program is formmail.pl from and is this some type of attempted hacking attempt?

[bobriggs]

Formmail is a popular configurable perl script used to send mail to any given recipient.

This is an attempt to find the vulnerable scripts on servers, once found, it can be used to send untraceable spam from that server.

[sparrow]

This is why I do all my mail in PHP

[stever]

Why would it be intrinsically any more secure to use php rather than perl?

The discussion we recently had at our webhost centred on vulnerabilities in both perl and php scripts and, in fact, the two secure-approved mail scripts turned out to be the monkeys and the London perlmongers modifications of the original perl script.

[Brett_Tabke]

It wouldn't stever. The problem is with a single script, not the language.

Yep, there are still formail exploit scripts running around out there.

[Kev]

I've been getting a lot of these recorded as referers to home pages on IIS session logging - not only do they get the error 404, but click the home page link on it?