|
|
|
C нами с 06.07.2008
Репутация: 42.2  
|
|
Объясните кто знает что это означает в логах веб сервера Apache.
файл access.log:
93.185.201.172 - - [10/Jan/2010:13:32:17 +0300] "PROPFIND /ADMIN$ HTTP/1.1" 405 232
93.185.201.172 - - [10/Jan/2010:13:32:18 +0300] "PROPFIND /ADMIN$ HTTP/1.1" 405 232
93.185.201.172 - - [10/Jan/2010:13:32:18 +0300] "PROPFIND /ADMIN$ HTTP/1.1" 405 232
93.185.201.172 - - [10/Jan/2010:13:32:19 +0300] "PROPFIND /ADMIN$ HTTP/1.1" 405 232
и так далее через пол секунды раз 100
это я тоже не пойму как что он делает
93.199.49.201 - - [09/Jan/2010:23:00:13 +0300] "OPTIONS / HTTP/1.1" 200 9277
такого файла у меня нет, но запрашивают его разные ip и часто
204.236.172.230 - - [09/Jan/2010:22:48:04 +0300] "GET /cgi-bin/textenv.pl HTTP/1.1" 404 216
опять непонятные запросы:
93.185.182.18 - - [09/Jan/2010:18:03:35 +0300] "OPTIONS / HTTP/1.1" 200 9277
93.185.182.18 - - [09/Jan/2010:18:03:35 +0300] "PROPFIND /share HTTP/1.1" 405 231
59.103.87.21 - - [10/Jan/2010:15:18:05 +0300] "OPTIONS / HTTP/1.1" 200 9277
59.103.87.21 - - [10/Jan/2010:15:18:32 +0300] "PROPFIND /C%24 HTTP/1.1" 405 228
59.103.87.21 - - [10/Jan/2010:15:16:35 +0300] "PROPFIND /B%24 HTTP/1.1" 405 228
59.103.87.21 - - [10/Jan/2010:15:11:20 +0300] "PROPFIND /Administrator HTTP/1.1" 405 239
59.103.87.21 - - [10/Jan/2010:15:08:34 +0300] "PROPFIND /NETLOGON%24 HTTP/1.1" 405 235
59.103.87.21 - - [10/Jan/2010:14:47:44 +0300] "PROPFIND /S%24 HTTP/1.1" 405 228
НО больше всего меня интересует эта строчка, постоянно через пол секунды идет - похоже на атаку
93.185.201.172 - - [10/Jan/2010:14:33:14 +0300] "PROPFIND /ADMIN$ HTTP/1.1" 405 232
файл error.log:
[Sat Jan 09 22:48:04 2010] [error] [client 204.236.172.230] script not found or unable to stat: D:/home/localhost/cgi-bin/textenv.pl
[Sun Jan 03 22:44:44 2010] [error] [client 85.17.108.225] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)
[Sun Jan 03 00:08:34 2010] [error] [client 10.100.63.182] File does not exist: D:/home/bitrix.aviel.ru/_vti_bin
[Sun Jan 03 00:08:34 2010] [error] [client 10.100.63.182] File does not exist: D:/home/bitrix.aviel.ru/MSOffice
[Sat Jan 02 19:56:15 2010] [error] [client 93.126.140.25] Options ExecCGI is off in this directory: D:/home/bitrix.aviel.ru/asr_83088.exe
[Sat Jan 02 20:00:34 2010] [error] [client 93.126.140.25] (20023)The given path was above the root path: Cannot map PROPFIND /E: HTTP/1.1 to file
[Sat Jan 02 20:00:34 2010] [error] [client 93.126.140.25] (20023)The given path was above the root path: Cannot map PROPFIND /E: HTTP/1.1 to file
[Wed Dec 30 11:36:02 2009] [error] [client 93.82.10.53] Options ExecCGI is off in this directory: D:/home/bitrix.aviel.ru/asr_06088.exe
[Wed Dec 30 11:36:02 2009] [error] [client 93.82.10.53] Options ExecCGI is off in this directory: D:/home/bitrix.aviel.ru/asr_06088.exe
[Wed Dec 30 11:38:05 2009] [error] [client 93.82.10.53] Options ExecCGI is off in this directory: D:/home/bitrix.aviel.ru/asr_52081.exe
[Wed Dec 30 11:38:05 2009] [error] [client 93.82.10.53] Options ExecCGI is off in this directory: D:/home/bitrix.aviel.ru/asr_52081.exe
[Wed Dec 30 11:40:10 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /C: HTTP/1.1 to file
[Wed Dec 30 11:40:10 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /C: HTTP/1.1 to file
[Wed Dec 30 11:50:37 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /D: HTTP/1.1 to file
[Wed Dec 30 11:50:38 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /D: HTTP/1.1 to file
[Wed Dec 30 11:54:46 2009] [error] [client 93.82.10.53] Options ExecCGI is off in this directory: D:/home/bitrix.aviel.ru/asr_40160.exe
[Wed Dec 30 11:54:49 2009] [error] [client 93.82.10.53] Options ExecCGI is off in this directory: D:/home/bitrix.aviel.ru/asr_40160.exe
[Wed Dec 30 11:55:49 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /C: HTTP/1.1 to file
[Wed Dec 30 11:55:52 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /C: HTTP/1.1 to file
[Wed Dec 30 11:58:30 2009] [error] [client 93.82.10.53] Options ExecCGI is off in this directory: D:/home/bitrix.aviel.ru/asr_83806.exe
[Wed Dec 30 11:58:31 2009] [error] [client 93.82.10.53] Options ExecCGI is off in this directory: D:/home/bitrix.aviel.ru/asr_83806.exe
[Wed Dec 30 12:01:33 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /C: HTTP/1.1 to file
[Wed Dec 30 12:01:35 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /C: HTTP/1.1 to file
[Wed Dec 30 12:06:40 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /C: HTTP/1.1 to file
[Wed Dec 30 12:06:43 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /C: HTTP/1.1 to file
[Wed Dec 30 12:07:43 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /C: HTTP/1.1 to file
[Wed Dec 30 12:07:44 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /C: HTTP/1.1 to file
[Wed Dec 30 12:08:55 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /C: HTTP/1.1 to file
[Wed Dec 30 12:08:55 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /C: HTTP/1.1 to file
[Wed Dec 30 12:09:56 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /D: HTTP/1.1 to file
[Wed Dec 30 12:09:57 2009] [error] [client 93.82.10.53] (20023)The given path was above the root path: Cannot map PROPFIND /D: HTTP/1.1 to file |
|
|
|
|
|
|
|
 |
|
|
|
Возраст: 45 
C нами с 28.07.2005
Репутация: 135.1
|
|
PROPFIND — Получение свойств объекта на сервере в формате XML. Так же можно получать структуру репозитория (дерево каталогов).
405 ошибка. Метотд не поддерживается
200 запрос выполнен удачно
OPTIONS / HTTP/1.0 HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0 Date: Wed, 04 Jun 2003 11:02:45 GMT
MS-Author-Via: DAV Content-Length: 0 Accept-Ranges: none DASL: <DAV:sql> DAV: 1, 2
Public: OPTIONS, TRACE, GET, HEAD, DELETE, PUT, POST, COPY, MOVE,
MKCOL, PROPFIND, PROPPATCH, LOCK, UNLOCK, SEARCH
Allow: OPTIONS, TRACE, GET, HEAD, COPY, PROPFIND, SEARCH, LOCK, UNLOCK
Cache-Control: private |
вот типичный ответ на options
в общем, это тестирование сервера на наличие дыр
204.236.172.230 - - [09/Jan/2010:22:48:04 +0300] "GET /cgi-bin/textenv.pl HTTP/1.1" 404 216
проверка, можно-ли использовать этот сервак в качестве прокси. (если я правильно помню)
|
|
|
|
|
|
|
|
|
|
|
C нами с 06.07.2008
Репутация: 42.2
|
|
|
а как отослать такой запрос OPTIONS, PROPFIND, должна быть какето программа?
|
|
|
|
|
|
|
|
|
|
|
Возраст: 53 
C нами с 01.01.2008
Репутация: 77.1
|
|
| Silicoid писал(а): |
|
PROPFIND — Получение свойств объекта на сервере в формате XML. Так же можно получать структуру репозитория (дерево каталогов).
|
Да. PROPFIND, MKCOL и проч. это расширения HTTP для WebDAV. (Subversion это тоже WebDAV, если открыт через HTTP)
| Silicoid писал(а): |
|
в общем, это тестирование сервера на наличие дыр
|
+1
| IDMAN писал(а): |
|
а как отослать такой запрос OPTIONS, PROPFIND, должна быть какето программа?
|
Винда умеет монтировать WebDAV как диски. Subversion client может такого вида запросы делать (урлы правда будут другие). curl. wdfs (WebDAV в FUSE). И много чего еще, я полагаю.
|
|
|
|
|
|
|
|
| |
|
|
|
