Propfind

Konqueror/3.1; Linux?

[jim_w]

Is there any reason why this should NOT be a red flag?

saxino.llnl.gov - - [24/Jul/2003:18:42:56 -0400] "PROPFIND / HTTP/1.1" 405 320 "-" "Mozilla/5.0 (compatible; Konqueror/3.1; Linux)"

saxino.llnl.gov - - [24/Jul/2003:18:43:31 -0400] "PROPFIND /about.html/ HTTP/1.1" 404 6707 "-" "Mozilla/5.0 (compatible; Konqueror/3.1; Linux)"

taking into account who it was and the fact that MS says...

Security
Regardless of the authentication technique being used in WebDAV method requests, the data is transmitted over the wire in plain text in an XML stream. It is possible for third parties to discover this data using network monitoring or packet sniffing tools. For WebDAV client applications that exchange critical or sensitive information with the Exchange server, it is recommended that Secure Sockets Layer (SSL) is used to encrypt the data. If SSL is used in a WebDAV method request then "https://", not "http://", must be used in the begining of the resource Uniform Resource Identifier (URI).

[Brett_Tabke]

Interesting. I moved this over here to the spider id forum - seemed more appropriate and hopefully a few more eyes will see it.

[wilderness]

I had two attempts at this intrsuion last week.
That sad part is that I knew where the IP's were from and somebody who was using this tool accidentally.

I pulled the following down from a google. Failing to mark the URL in process :(

Web Folders & WebDAV
What are Web Folders? What is WebDAV? How should I use them?
"Web Folders" is what Microsoft calls its WebDAV support, which is built into modern Windows operating systems. WebDAV is an open Internet standard that allows clients on your PC or Mac to access files and folders on a server in much the same way as on the desktop, while actually residing on a remote server accessed via the Web - in this case the server is My Docs Online
end of quote.

I contacted the ISP who was kind enough to reply for the first attempt. I explained that it was not my desire to deny a range which provides a generous amount of traffic.
The ISP did not reply to my second mail, which stated they had not took the steps toward an amicable resolution.
The attempts has at least temporarily ceased.

I also recall reading that this WebDAV can be implemented almost by accident from an unknowing user. That it wasn't a perfect system.

Don

[jim_w]

Maybe I'm wrong, but I thought that PROPFIND was specific to MS browsers and/or servers. (It's been a while since I looked it up) Which is why I thought it was funny that a Linux browser was trying it. But then again, I don't know squat about Konqueror or any of the above for mentioned so that may explain it ;-)

Is PROPFIND a standard thing like GET or POST?

[wilderness]

from what I gathered the use of PROPFIND was a valid attempt at loading data to a website.

In my google, I really didn't spend a lot of time in this.
Nowing the folks who were using the IP ranges, I figured would result (an it has) in closure of the attempts.