New buffer overflow tactic?
Spotted in my logs..
12.221.111.178 - - [27/Jul/2003:13:15:41 -0700] "HEAD /logs/access_log?hellohellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello HTTP/1.0" 404 0 "-" "-" 12.221.111.178 - - [27/Jul/2003:13:15:41 -0700] "HEAD /logs/active/access_log?hellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello HTTP/1.0" 404 0 "-" "-" 12.221.111.178 - - [27/Jul/2003:13:15:41 -0700] "HEAD /access_log?hellohellohellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello hellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohellohello HTTP/1.0" 404 0 "-" "-"
Comments
I get the exact same thing, with the exact same IP address.
Posted by: Luke | July 27, 2003 04:32 PM
Wow, what the hell is that?.....I'll have to peek in my logs....
Posted by: Kevin | July 27, 2003 07:46 PM
I think they're just friendly.
Posted by: Mark Paschal | July 29, 2003 12:28 AM
I noticed the same thing a few days ago... can't recall if it's the same IP.
Friendly...heheheh.
Posted by: Kyle | July 29, 2003 03:44 PM
Saw this on CNN tonight: http://www.cnn.com/2003/TECH/internet/07/31/internet.atttack/index.html and wonder if this wasn't an attempt at the same type of attack...
Posted by: Randy | July 31, 2003 09:16 PM