Hack Angriffe erfolgreich / erfolglos?

freakshow10000 · Apr 28, 2011

Moin,

Aufgrund eines 500 Errors von apache bin ich mal die logs durchgegangen.. mein problem wegen des 500 liegt an suexec.

aber das ist unwichtig...

ich hab dieses gefunden:

Code:

174.46.130.180 - - [26/Apr/2011:02:58:27 +0200] "GET //phpmyadmin/ HTTP/1.1" 404 271 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:28 +0200] "GET //phpMyAdmin/ HTTP/1.1" 404 271 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:28 +0200] "GET //pma/ HTTP/1.1" 404 264 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:28 +0200] "GET //dbadmin/ HTTP/1.1" 404 268 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:28 +0200] "GET //myadmin/ HTTP/1.1" 404 268 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:29 +0200] "GET //phppgadmin/ HTTP/1.1" 404 271 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:29 +0200] "GET //PMA/ HTTP/1.1" 404 264 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:29 +0200] "GET //admin/ HTTP/1.1" 404 266 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:29 +0200] "GET //MyAdmin/ HTTP/1.1" 404 268 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"

sieht .. naja.. komisch aus

hier die komplette log

Code:

109.230.251.35 - - [24/Apr/2011:09:49:08 +0200] "GET /" 400 543 "-" "-"
46.163.65.65 - - [24/Apr/2011:10:00:58 +0200] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 283 "-" "-"
::1 - - [24/Apr/2011:10:19:09 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [24/Apr/2011:10:19:11 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [24/Apr/2011:10:19:12 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [24/Apr/2011:10:19:13 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [24/Apr/2011:10:31:20 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
222.216.28.66 - - [24/Apr/2011:11:48:54 +0200] "GET //phpmyadmin/ HTTP/1.1" 404 271 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
222.216.28.66 - - [24/Apr/2011:11:48:54 +0200] "GET //phpMyAdmin/ HTTP/1.1" 404 271 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
222.216.28.66 - - [24/Apr/2011:11:48:55 +0200] "GET //MyAdmin/ HTTP/1.1" 404 268 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
222.216.28.66 - - [24/Apr/2011:11:48:56 +0200] "GET //myadmin/ HTTP/1.1" 404 268 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
222.216.28.66 - - [24/Apr/2011:11:48:57 +0200] "GET //pma/ HTTP/1.1" 404 264 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
222.216.28.66 - - [24/Apr/2011:11:48:57 +0200] "GET //mysql/ HTTP/1.1" 404 266 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
109.230.251.35 - - [24/Apr/2011:12:53:05 +0200] "GET http://203.209.228.42/?login=tomweldon232&passwd=testing HTTP/1.0" 200 9820 "-" "-"
113.205.183.9 - - [24/Apr/2011:15:06:34 +0200] "GET http://www.ip2location.com HTTP/1.0" 200 9820 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
::1 - - [24/Apr/2011:18:02:41 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [24/Apr/2011:18:02:48 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [24/Apr/2011:18:27:57 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [24/Apr/2011:19:21:34 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
89.238.185.114 - - [24/Apr/2011:21:16:42 +0200] "GET /w00tw00t.at.ISC.SANS.test0:) HTTP/1.1" 400 283 "-" "-"
::1 - - [24/Apr/2011:21:17:47 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
113.205.162.105 - - [25/Apr/2011:00:37:22 +0200] "GET http://www.ip2location.com HTTP/1.0" 200 9820 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
125.224.192.204 - - [25/Apr/2011:00:55:48 +0200] "CONNECT 203.188.201.253:25 HTTP/1.1" 405 300 "-" "-"
69.46.23.47 - - [25/Apr/2011:11:47:25 +0200] "GET http://85.17.147.193/proxychecker/check.cgi?action=getinfo HTTP/1.1" 404 283 "http://www.google.com/search?hl=ru&q=free+proxy+checker&sourceid=navclient-ff&ie=UTF-8" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
::1 - - [25/Apr/2011:12:00:36 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:12:00:37 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:12:00:38 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:12:07:27 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
178.63.136.82 - - [25/Apr/2011:12:47:50 +0200] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 283 "-" "-"
89.238.185.114 - - [25/Apr/2011:13:19:57 +0200] "GET /w00tw00t.at.ISC.SANS.test0:) HTTP/1.1" 400 283 "-" "-"
::1 - - [25/Apr/2011:14:19:12 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:14:35:27 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:15:07:49 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
213.174.163.143 - - [25/Apr/2011:15:26:56 +0200] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 404 288 "-" "-"
::1 - - [25/Apr/2011:17:42:05 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:18:08:45 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:18:44:49 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
77.245.66.216 - - [25/Apr/2011:19:42:13 +0200] "GET http://www.sina.com.cn/ HTTP/1.1" 200 9820 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)"
::1 - - [25/Apr/2011:20:01:45 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:20:01:51 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:20:09:46 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:20:21:33 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:21:45:31 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:22:00:28 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:22:00:29 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:22:00:30 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
213.174.163.143 - - [25/Apr/2011:23:10:02 +0200] "GET /phpmyadmin/main.php HTTP/1.1" 404 279 "-" "-"
213.174.163.143 - - [25/Apr/2011:23:10:02 +0200] "GET /phpMyAdmin/main.php HTTP/1.1" 404 279 "-" "-"
213.174.163.143 - - [25/Apr/2011:23:10:02 +0200] "GET /db/main.php HTTP/1.1" 404 271 "-" "-"
213.174.163.143 - - [25/Apr/2011:23:10:02 +0200] "GET /web/main.php HTTP/1.1" 404 272 "-" "-"
213.174.163.143 - - [25/Apr/2011:23:10:02 +0200] "GET /PMA/main.php HTTP/1.1" 404 272 "-" "-"
213.174.163.143 - - [25/Apr/2011:23:10:02 +0200] "GET /dbadmin/main.php HTTP/1.1" 404 276 "-" "-"
::1 - - [25/Apr/2011:23:52:21 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [25/Apr/2011:23:53:36 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:00:32:41 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:00:58:19 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
125.224.192.204 - - [26/Apr/2011:02:44:07 +0200] "CONNECT 203.188.201.253:25 HTTP/1.1" 405 300 "-" "-"
174.46.130.180 - - [26/Apr/2011:02:58:27 +0200] "GET //phpmyadmin/ HTTP/1.1" 404 271 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:28 +0200] "GET //phpMyAdmin/ HTTP/1.1" 404 271 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:28 +0200] "GET //pma/ HTTP/1.1" 404 264 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:28 +0200] "GET //dbadmin/ HTTP/1.1" 404 268 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:28 +0200] "GET //myadmin/ HTTP/1.1" 404 268 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:29 +0200] "GET //phppgadmin/ HTTP/1.1" 404 271 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:29 +0200] "GET //PMA/ HTTP/1.1" 404 264 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:29 +0200] "GET //admin/ HTTP/1.1" 404 266 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
174.46.130.180 - - [26/Apr/2011:02:58:29 +0200] "GET //MyAdmin/ HTTP/1.1" 404 268 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
::1 - - [26/Apr/2011:02:58:30 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:02:58:31 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:02:58:32 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
212.7.196.194 - - [26/Apr/2011:03:11:10 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "-"
200.6.115.76 - - [26/Apr/2011:05:33:13 +0200] "GET /webdav/test HTTP/1.1" 404 271 "-" "-"
89.238.185.114 - - [26/Apr/2011:06:32:37 +0200] "GET /w00tw00t.at.ISC.SANS.test0:) HTTP/1.1" 400 283 "-" "-"
88.191.37.152 - - [26/Apr/2011:08:27:21 +0200] "GET /modules/extensions_batch/libs/download_csv.php HTTP/1.1" 404 307 "-" "curl/7.18.2 (i486-pc-linux-gnu) libcurl/7.18.2 OpenSSL/0.9.8g zlib/1.2.3.3 libidn/1.8 libssh2/0.18"
::1 - - [26/Apr/2011:08:30:46 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
64.79.85.50 - - [26/Apr/2011:13:17:24 +0200] "GET /admin/phpmyadmin/scripts/setup.php HTTP/1.1" 404 294 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:25 +0200] "GET /admin/pma/scripts/setup.php HTTP/1.1" 404 287 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:25 +0200] "GET /admin/scripts/setup.php HTTP/1.1" 404 283 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:25 +0200] "GET /db/scripts/setup.php HTTP/1.1" 404 280 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:26 +0200] "GET /dbadmin/scripts/setup.php HTTP/1.1" 404 285 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:26 +0200] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 285 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:26 +0200] "GET /mysql/scripts/setup.php HTTP/1.1" 404 283 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:27 +0200] "GET /mysqladmin/scripts/setup.php HTTP/1.1" 404 288 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:27 +0200] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 288 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:27 +0200] "GET /phpadmin/scripts/setup.php HTTP/1.1" 404 286 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:28 +0200] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 288 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:28 +0200] "GET /pma/scripts/setup.php HTTP/1.1" 404 281 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:28 +0200] "GET /scripts/setup.php HTTP/1.1" 404 277 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:28 +0200] "GET /sqlweb/scripts/setup.php HTTP/1.1" 404 284 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:29 +0200] "GET /web/phpMyAdmin/scripts/setup.php HTTP/1.1" 404 292 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:29 +0200] "GET /web/phpmyadmin/scripts/setup.php HTTP/1.1" 404 292 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:29 +0200] "GET /web/scripts/setup.php HTTP/1.1" 404 281 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:29 +0200] "GET /webadmin/scripts/setup.php HTTP/1.1" 404 286 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:30 +0200] "GET /webdb/scripts/setup.php HTTP/1.1" 404 283 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
64.79.85.50 - - [26/Apr/2011:13:17:30 +0200] "GET /websql/scripts/setup.php HTTP/1.1" 404 284 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
::1 - - [26/Apr/2011:13:17:30 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:13:17:31 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:13:17:32 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:13:17:33 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
109.230.251.8 - - [26/Apr/2011:15:47:53 +0200] "GET http://proxyjudge1.proxyfire.net/fastenv HTTP/1.1" 404 280 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
::1 - - [26/Apr/2011:16:37:04 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:16:37:33 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:16:39:42 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:16:39:43 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:16:39:44 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:17:32:45 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
109.230.251.8 - - [26/Apr/2011:18:07:20 +0200] "GET http://proxyjudge1.proxyfire.net/fastenv HTTP/1.1" 404 280 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
208.64.240.5 - - [26/Apr/2011:19:25:42 +0200] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 283 "-" "-"
::1 - - [26/Apr/2011:19:43:57 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:19:43:58 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:19:43:59 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:19:44:19 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:19:44:22 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
109.230.251.8 - - [26/Apr/2011:21:27:15 +0200] "GET http://proxyjudge1.proxyfire.net/fastenv HTTP/1.1" 404 280 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
182.50.154.15 - - [26/Apr/2011:21:28:35 +0200] "GET /webdav/test HTTP/1.1" 404 271 "-" "-"
::1 - - [26/Apr/2011:22:01:36 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:22:11:42 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:22:11:43 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:22:11:44 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:22:11:45 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [26/Apr/2011:22:11:46 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
89.238.185.114 - - [27/Apr/2011:00:50:50 +0200] "GET /w00tw00t.at.ISC.SANS.test0:) HTTP/1.1" 400 283 "-" "-"
::1 - - [27/Apr/2011:01:23:17 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
113.205.163.150 - - [27/Apr/2011:01:44:22 +0200] "GET http://www.ip2location.com HTTP/1.0" 200 9820 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
213.174.163.143 - - [27/Apr/2011:02:09:12 +0200] "GET /phpmyadmin/main.php HTTP/1.1" 404 279 "-" "-"
213.174.163.143 - - [27/Apr/2011:02:09:12 +0200] "GET /phpMyAdmin/main.php HTTP/1.1" 404 279 "-" "-"
213.174.163.143 - - [27/Apr/2011:02:09:12 +0200] "GET /db/main.php HTTP/1.1" 404 271 "-" "-"
213.174.163.143 - - [27/Apr/2011:02:09:12 +0200] "GET /web/main.php HTTP/1.1" 404 272 "-" "-"
213.174.163.143 - - [27/Apr/2011:02:09:12 +0200] "GET /PMA/main.php HTTP/1.1" 404 272 "-" "-"
213.174.163.143 - - [27/Apr/2011:02:09:12 +0200] "GET /dbadmin/main.php HTTP/1.1" 404 276 "-" "-"
::1 - - [27/Apr/2011:03:50:30 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [27/Apr/2011:03:50:32 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [27/Apr/2011:03:50:58 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [27/Apr/2011:03:56:20 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [27/Apr/2011:03:56:21 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [27/Apr/2011:03:56:22 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
125.224.192.204 - - [27/Apr/2011:04:50:00 +0200] "CONNECT 203.188.201.253:25 HTTP/1.1" 405 300 "-" "-"
109.94.228.210 - - [27/Apr/2011:08:31:56 +0200] "GET //phpmyadmin/ HTTP/1.1" 404 271 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
109.94.228.210 - - [27/Apr/2011:08:31:56 +0200] "GET //phpMyAdmin/ HTTP/1.1" 404 271 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
109.94.228.210 - - [27/Apr/2011:08:31:56 +0200] "GET //pma/ HTTP/1.1" 404 264 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
109.94.228.210 - - [27/Apr/2011:08:31:56 +0200] "GET //dbadmin/ HTTP/1.1" 404 268 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
109.94.228.210 - - [27/Apr/2011:08:31:56 +0200] "GET //myadmin/ HTTP/1.1" 404 268 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
109.94.228.210 - - [27/Apr/2011:08:31:57 +0200] "GET //phppgadmin/ HTTP/1.1" 404 271 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
109.94.228.210 - - [27/Apr/2011:08:31:58 +0200] "GET //PMA/ HTTP/1.1" 404 264 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
109.94.228.210 - - [27/Apr/2011:08:31:58 +0200] "GET //admin/ HTTP/1.1" 404 266 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
109.94.228.210 - - [27/Apr/2011:08:31:58 +0200] "GET //MyAdmin/ HTTP/1.1" 404 268 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"
::1 - - [27/Apr/2011:08:31:59 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [27/Apr/2011:08:32:00 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [27/Apr/2011:08:32:01 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
200.6.115.76 - - [27/Apr/2011:09:31:23 +0200] "GET /webdav/test HTTP/1.1" 404 271 "-" "-"
::1 - - [27/Apr/2011:11:46:48 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [27/Apr/2011:15:32:33 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [27/Apr/2011:17:12:34 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [27/Apr/2011:17:12:35 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [27/Apr/2011:17:12:36 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
::1 - - [27/Apr/2011:21:39:14 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"
89.238.185.114 - - [27/Apr/2011:23:52:59 +0200] "GET /w00tw00t.at.ISC.SANS.test0:) HTTP/1.1" 400 283 "-" "-"
::1 - - [28/Apr/2011:00:00:38 +0200] "OPTIONS * HTTP/1.0" 200 - "-" "Apache (internal dummy connection)"

sieht ziemlich wir war aus für mich, auf jedenfall weiß ich das da was läuft

die get http://... deute ich so das mein server als proxy missbraucht wird bzw werden will.

Da ich nun überhaupt keine ahnung von apache habe...
Ist das oben stehende jetzt gut oder schlecht?

Mfg

Der_Sensemann · Apr 28, 2011

Code:

109.94.228.210 - - [27/Apr/2011:08:31:56 +0200] "GET //myadmin/ HTTP/1.1" 404 268 "-" "Made by ZmEu @ WhiteHat Team - www.whitehat.ro"

Das sagt exakt aus, dass die Ip 109.94.228.210 das Verzeichnis //myadmin/ angefordert hat, von deinem Apache2. Dieser hat mit 404 geantwortet.
Wenn du einen Apache betreibst, solltest du dich auch mal über seine Logfiles schlau machen

.

its · Apr 28, 2011

auf den ersten Blick und basierend auf dem kurzen Logfile Auszug, kann ich sagen, dass die Brute-Force Attacken auf dein PHPMyAdmin erfolglos waren.

Man müsste sich die weiteren Logfiles einmal ansehen.

Poste bitte auch mal folgende Ausgaben:

aktuell laufende Prozesse:

Code:

ps -faux

&

Offene Verbindungen:

Code:

lsof -i

(sollte es nicht installiert sein, würde es auch ein netstat -tulpen tun. Ansonsten einfach nachinstallieren via Paketmanager unter Debian apt-get install lsof)

freakshow10000 · Apr 28, 2011

Code:

 ps -faux
Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.7/FAQ
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0  10352   728 ?        Ss   Apr27   0:01 init [3]
root     30479  0.0  0.0  12620   680 ?        S<s  Apr27   0:00 /sbin/udevd -d
root     30607  0.0  0.0  28608   608 ?        Ssl  Apr27   0:00 brcm_iscsiuio
root     31939  0.0  0.0  62632  1216 ?        Ss   Apr27   0:00 /usr/sbin/sshd
root     25637  0.0  0.1  96584  3844 ?        Ss   Apr27   0:00  \_ sshd: root@
root     25737  0.0  0.0  12068  1664 pts/0    Ss   Apr27   0:00  |   \_ -bash
root      1744  0.0  0.0  10724   944 pts/0    R+   01:00   0:00  |       \_ ps
root      8033  0.0  0.1  96584  3840 ?        Ss   00:04   0:00  \_ sshd: root@
root      9467  0.0  0.0  53880  2096 ?        Ss   00:04   0:00      \_ /usr/li
root     32372  0.0  0.0  20872  1160 ?        Ss   Apr27   0:00 crond
xfs      32390  0.0  0.0  20084  1072 ?        Ss   Apr27   0:00 xfs -droppriv -
root     32399  0.0  0.1  81620  2716 ?        Ss   Apr27   0:00 smbd -D
root     32403  0.0  0.0  81620  1392 ?        S    Apr27   0:00  \_ smbd -D
root     32404  0.0  0.0  53776  1200 ?        Ss   Apr27   0:00 nmbd -D
root     32412  0.0  0.0  46740   812 ?        Ss   Apr27   0:00 /usr/sbin/sasla
root     32413  0.0  0.0  46740   540 ?        S    Apr27   0:00  \_ /usr/sbin/s
root     32421  0.0  0.9  63888 20200 ?        Ss   Apr27   0:00 /usr/bin/perl /
root     29703  0.0  0.0   6428  1112 ?        Ss   00:17   0:00 syslogd -m 0
root     32082  0.0  0.0  21648   944 ?        Ss   00:19   0:00 xinetd -stayali
root     32450  0.0  0.0  11932  1412 ?        S    00:19   0:00 /bin/sh /usr/bi
mysql    32506  0.0  0.8 227852 17328 ?        Sl   00:19   0:00  \_ /usr/libexe
named     3469  0.0  0.2 226448  4864 ?        Ssl  00:19   0:00 /usr/sbin/named
root      6066  0.0  0.1  54164  2308 ?        Ss   00:20   0:00 /usr/libexec/po
postfix   6068  0.0  0.1  54228  2244 ?        S    00:20   0:00  \_ pickup -l -
postfix   6069  0.0  0.1  54408  2304 ?        S    00:20   0:00  \_ qmgr -l -t
root      6104  0.0  0.0  13172   604 ?        S    00:20   0:00 /usr/lib/courie
root      6106  0.0  0.0   3660   372 ?        S    00:20   0:00 /usr/sbin/couri
root      6127  0.0  0.0  13172   604 ?        S    00:20   0:00 /usr/lib/courie
root      6129  0.0  0.0   3660   372 ?        S    00:20   0:00 /usr/sbin/couri
root      6136  0.0  0.0  13172   604 ?        S    00:20   0:00 /usr/lib/courie
root      6138  0.0  0.0   3660   372 ?        S    00:20   0:00 /usr/sbin/couri
root      7171  0.0  0.0  13172   604 ?        S    00:20   0:00 /usr/lib/courie
root      7174  0.0  0.0   3660   376 ?        S    00:20   0:00 /usr/sbin/couri
root      7310  0.0  0.7 321660 16692 ?        Ss   00:20   0:00 /usr/sbin/httpd
apache    7312  0.0  0.2 248760  5116 ?        S    00:20   0:00  \_ /usr/sbin/h
apache    7313  0.0  0.7 324604 15652 ?        S    00:20   0:00  \_ /usr/sbin/h
apache   21729  0.0  0.4 321796  9916 ?        S    00:40   0:00  \_ /usr/sbin/h
apache   21730  0.0  0.4 321796 10088 ?        S    00:40   0:00  \_ /usr/sbin/h
apache   21731  0.0  0.7 324436 14816 ?        S    00:40   0:00  \_ /usr/sbin/h
apache   21735  0.0  0.6 324440 14648 ?        S    00:40   0:00  \_ /usr/sbin/h
502       7739  0.0  0.0  58976  1252 ?        S    00:20   0:00 /usr/sbin/sw-cp

lsof habe ich mir grade eben selber angeschaut.. scheint alles ok zu sein... keine verbindungen die ich nicht kenne ;

Mfg und danke für die Hilfe

MTLServices · Apr 28, 2011

Eine kleine Anmerkung:
Ich glaube kaum, dass es sinnvoll ist, IP Adressen aus Logfiles (versehen mit Datum und Uhrzeit) in einem Forum öffentlich zu posten.
Diese sollten entsprechend anonymisiert werden.

PapaBaer · Apr 28, 2011

Dein Apache läuft als offener Proxy. Das solltest du dringend ändern, bevor jemand mit nem anwaltlichen Brief klopfen kommt.

Privateer · Oct 22, 2011

An welcher Zeile des Logs sieht man das der Server als offener Proxy ist?

PHP:

 ps -faux
Warning: bad ps syntax, perhaps a bogus '-'? See 
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.2  0.0   8360   804 ?        Ss   17:32   0:06 init [2]      
root      1346  0.0  0.0  53608   964 ?        Ss   17:33   0:00 /usr/sbin/sasla
root      1347  0.0  0.0  53608   672 ?        S    17:33   0:00  \_ /usr/sbin/s
root      1354  0.0  0.0   5980   696 ?        Ss   17:33   0:00 /sbin/syslogd
bind      1366  0.0  0.7 380968 32396 ?        Ssl  17:33   0:00 /usr/sbin/named
root      1402  0.0  0.2 255348 12508 ?        Ss   17:33   0:00 /usr/sbin/apach
www-data  1404  0.0  0.0 190416  3680 ?        S    17:33   0:00  \_ /usr/sbin/a
www-data  1462  0.0  0.2 256704 10860 ?        S    17:33   0:00  \_ /usr/sbin/a
www-data  3413  0.0  0.2 256268  9368 ?        S    17:33   0:00  \_ /usr/sbin/a
www-data  3414  0.0  0.2 256268  9364 ?        S    17:33   0:00  \_ /usr/sbin/a
www-data  3415  0.0  0.2 256268  9368 ?        S    17:33   0:00  \_ /usr/sbin/a
www-data  3419  0.0  0.2 256308  8716 ?        S    17:33   0:00  \_ /usr/sbin/a
clamav    1649  0.0  3.0 182492 126472 ?       Ssl  17:33   0:00 /usr/sbin/clamd
clamav    1746  0.0  0.0  38572  1848 ?        Ss   17:33   0:00 /usr/bin/freshc
root      1766  0.0  0.0  20908   960 ?        Ss   17:33   0:00 /usr/sbin/cron
root      1776  0.1  0.1 339436  7356 ?        Sl   17:33   0:03 /usr/bin/python
root      1922  0.0  1.0  75808 46048 ?        Ss   17:33   0:00 /usr/share/webm
list      1928  0.0  0.1  53636  8112 ?        Ss   17:33   0:00 /usr/bin/python
list      3105  0.0  0.2  45044 10112 ?        S    17:33   0:00  \_ /usr/bin/py
list      3106  0.0  0.2  45116 10192 ?        S    17:33   0:00  \_ /usr/bin/py
list      3107  0.0  0.2  45076 10116 ?        S    17:33   0:00  \_ /usr/bin/py
list      3108  0.0  0.2  45052 10128 ?        S    17:33   0:00  \_ /usr/bin/py
list      3109  0.0  0.2  45100 10176 ?        S    17:33   0:00  \_ /usr/bin/py
list      3110  0.0  0.2  45428 10280 ?        S    17:33   0:00  \_ /usr/bin/py
list      3111  0.0  0.2  45052 10124 ?        S    17:33   0:00  \_ /usr/bin/py
list      3112  0.0  0.2  45048 10116 ?        S    17:33   0:00  \_ /usr/bin/py
root      1953  0.0  0.0   9144  1380 ?        S    17:33   0:00 /bin/sh /usr/bi
mysql     3092  0.0  0.5 188972 24268 ?        Sl   17:33   0:00  \_ /usr/sbin/m
root      3093  0.0  0.0   3856   628 ?        S    17:33   0:00  \_ logger -t m
postgres  3175  0.0  0.1 100788  6708 ?        S    17:33   0:00 /usr/lib/postgr
postgres  3202  0.0  0.0 100788  1740 ?        Ss   17:33   0:00  \_ postgres: w
postgres  3203  0.0  0.0 100788  1516 ?        Ss   17:33   0:00  \_ postgres: w
postgres  3204  0.0  0.0 100928  1784 ?        Ss   17:33   0:00  \_ postgres: a
postgres  3205  0.0  0.0  72332  1480 ?        Ss   17:33   0:00  \_ postgres: s
root      3220  0.0  0.0  39052   860 ?        Ss   17:33   0:00 /usr/sbin/dovec
root      3221  0.0  0.0  74904  3240 ?        S    17:33   0:00  \_ dovecot-aut
root      3223  0.0  0.0  74904  3152 ?        S    17:33   0:00  \_ dovecot-aut
dovecot   3338  0.0  0.0  36908  2568 ?        S    17:33   0:00  \_ pop3-login
dovecot   3339  0.0  0.0  36908  2568 ?        S    17:33   0:00  \_ pop3-login
dovecot   3340  0.0  0.0  36908  2572 ?        S    17:33   0:00  \_ pop3-login
dovecot   3341  0.0  0.0  36920  2572 ?        S    17:33   0:00  \_ imap-login
dovecot   3342  0.0  0.0  36920  2572 ?        S    17:33   0:00  \_ imap-login
dovecot   3343  0.0  0.0  36920  2568 ?        S    17:33   0:00  \_ imap-login
proftpd   3229  0.0  0.0  92580  1944 ?        Ss   17:33   0:00 proftpd: (accep
root      3255  0.0  0.0  70868  2596 ?        Ss   17:33   0:00 sendmail: MTA: 
root      3364  0.0  1.1 115028 49816 ?        Ss   17:33   0:01 /usr/sbin/spamd
root      3389  0.0  1.1 115028 48172 ?        S    17:33   0:00  \_ spamd child
root      3391  0.0  1.1 115028 48172 ?        S    17:33   0:00  \_ spamd child
root      3397  0.0  0.0  49176  1136 ?        Ss   17:33   0:00 /usr/sbin/sshd
root      5361  0.0  0.0  78972  3520 ?        Ss   18:08   0:00  \_ sshd: root@
root      5363  0.0  0.0  21572  2008 ttyp0    Ss   18:08   0:00      \_ -bash
root      5375  0.0  0.0  18636  1108 ttyp0    R+   18:09   0:00          \_ ps
root      3400  0.0  0.3  72444 16144 ?        Ss   17:33   0:00 /usr/bin/perl /
root      3404  0.0  1.3 122856 56288 ?        Ss   17:33   0:00 /usr/bin/perl /

PHP:

lsof -i
COMMAND    PID     USER   FD   TYPE     DEVICE SIZE/OFF NODE NAME
named     1366     bind   20u  IPv6 4042669402      0t0  TCP *:domain (LISTEN)
named     1366     bind   21u  IPv4 4042669422      0t0  TCP localhost:domain (LISTEN)
named     1366     bind   22u  IPv4 4042669424      0t0  TCP shop123.de:domain (LISTEN)
named     1366     bind   23u  IPv4 4042669446      0t0  TCP localhost:953 (LISTEN)
named     1366     bind   24u  IPv6 4042669447      0t0  TCP localhost:953 (LISTEN)
named     1366     bind  512u  IPv6 4042669399      0t0  UDP *:domain 
named     1366     bind  513u  IPv4 4042669408      0t0  UDP localhost:domain 
named     1366     bind  514u  IPv4 4042669423      0t0  UDP shop123.de:domain 
apache2   1402     root    3u  IPv4 4042669539      0t0  TCP *:www (LISTEN)
apache2   1402     root    4u  IPv4 4042669541      0t0  TCP *:https (LISTEN)
apache2   1404 www-data    3u  IPv4 4042669539      0t0  TCP *:www (LISTEN)
apache2   1404 www-data    4u  IPv4 4042669541      0t0  TCP *:https (LISTEN)
apache2   1462 www-data    3u  IPv4 4042669539      0t0  TCP *:www (LISTEN)
apache2   1462 www-data    4u  IPv4 4042669541      0t0  TCP *:https (LISTEN)
lookup-do 1922     root    3u  IPv4 4042678741      0t0  TCP localhost:11000 (LISTEN)
mysqld    3092    mysql   10u  IPv4 4042679525      0t0  TCP localhost:mysql (LISTEN)
postgres  3175 postgres    3u  IPv6 4042682890      0t0  TCP localhost:postgresql (LISTEN)
postgres  3175 postgres    6u  IPv4 4042682891      0t0  TCP localhost:postgresql (LISTEN)
postgres  3175 postgres    8u  IPv6 4042682908      0t0  UDP localhost:52751->localhost:52751 
postgres  3202 postgres    8u  IPv6 4042682908      0t0  UDP localhost:52751->localhost:52751 
postgres  3203 postgres    8u  IPv6 4042682908      0t0  UDP localhost:52751->localhost:52751 
postgres  3204 postgres    8u  IPv6 4042682908      0t0  UDP localhost:52751->localhost:52751 
postgres  3205 postgres    8u  IPv6 4042682908      0t0  UDP localhost:52751->localhost:52751 
dovecot   3220     root    6u  IPv4 4042686786      0t0  TCP *:imap2 (LISTEN)
dovecot   3220     root    7u  IPv4 4042686787      0t0  TCP *:imaps (LISTEN)
dovecot   3220     root    8u  IPv4 4042686788      0t0  TCP *:pop3 (LISTEN)
dovecot   3220     root    9u  IPv4 4042686789      0t0  TCP *:pop3s (LISTEN)
proftpd   3229  proftpd    1u  IPv6 4042686924      0t0  TCP *:ftp (LISTEN)
sendmail- 3255     root    4u  IPv4 4042687044      0t0  TCP localhost:smtp (LISTEN)
sendmail- 3255     root    5u  IPv4 4042687045      0t0  TCP localhost:submission (LISTEN)
pop3-logi 3338  dovecot    4u  IPv4 4042686788      0t0  TCP *:pop3 (LISTEN)
pop3-logi 3338  dovecot    5u  IPv4 4042686789      0t0  TCP *:pop3s (LISTEN)
pop3-logi 3339  dovecot    4u  IPv4 4042686788      0t0  TCP *:pop3 (LISTEN)
pop3-logi 3339  dovecot    5u  IPv4 4042686789      0t0  TCP *:pop3s (LISTEN)
pop3-logi 3340  dovecot    4u  IPv4 4042686788      0t0  TCP *:pop3 (LISTEN)
pop3-logi 3340  dovecot    5u  IPv4 4042686789      0t0  TCP *:pop3s (LISTEN)
imap-logi 3341  dovecot    4u  IPv4 4042686786      0t0  TCP *:imap2 (LISTEN)
imap-logi 3341  dovecot    5u  IPv4 4042686787      0t0  TCP *:imaps (LISTEN)
imap-logi 3342  dovecot    4u  IPv4 4042686786      0t0  TCP *:imap2 (LISTEN)
imap-logi 3342  dovecot    5u  IPv4 4042686787      0t0  TCP *:imaps (LISTEN)
imap-logi 3343  dovecot    4u  IPv4 4042686786      0t0  TCP *:imap2 (LISTEN)
imap-logi 3343  dovecot    5u  IPv4 4042686787      0t0  TCP *:imaps (LISTEN)
spamd     3364     root    5u  IPv4 4042692308      0t0  TCP localhost:spamd (LISTEN)
spamd     3389     root    5u  IPv4 4042692308      0t0  TCP localhost:spamd (LISTEN)
spamd     3391     root    5u  IPv4 4042692308      0t0  TCP localhost:spamd (LISTEN)
sshd      3397     root    3u  IPv4 4042695051      0t0  TCP *:2200 (LISTEN)
sshd      3397     root    4u  IPv6 4042695053      0t0  TCP *:2200 (LISTEN)
miniserv. 3400     root    5u  IPv4 4042699406      0t0  TCP *:20000 (LISTEN)
miniserv. 3400     root    6u  IPv4 4042699407      0t0  UDP *:20000 
miniserv. 3404     root    6u  IPv4 4042703904      0t0  TCP *:webmin (LISTEN)
miniserv. 3404     root    7u  IPv4 4042703905      0t0  UDP *:10000 
apache2   3413 www-data    3u  IPv4 4042669539      0t0  TCP *:www (LISTEN)
apache2   3413 www-data    4u  IPv4 4042669541      0t0  TCP *:https (LISTEN)
apache2   3414 www-data    3u  IPv4 4042669539      0t0  TCP *:www (LISTEN)
apache2   3414 www-data    4u  IPv4 4042669541      0t0  TCP *:https (LISTEN)
apache2   3415 www-data    3u  IPv4 4042669539      0t0  TCP *:www (LISTEN)
apache2   3415 www-data    4u  IPv4 4042669541      0t0  TCP *:https (LISTEN)
apache2   3419 www-data    3u  IPv4 4042669539      0t0  TCP *:www (LISTEN)
apache2   3419 www-data    4u  IPv4 4042669541      0t0  TCP *:https (LISTEN)
sshd      5361     root    3u  IPv4 4046948746      0t0  TCP

sieht bei mir ziemlich ähnlich aus....

dante · Oct 22, 2011

Moin,

mehr als normales Grundrauschen ist das nicht, welches dein Apache auch brav mit HTTP 404 beantwortet.

Ist halt in den Logs lästig und im schlimmsten Fall weiß ein "Angreifer", dass bei dir phpmyadmin o.Ä. installiert und nach außen verfügbar ist (die Sinnigkeit dessen ist wieder nen andres Thema).

Gruß
dante

freakshow10000 · Oct 23, 2011

danke für die Hilfe aber .. Steinzeitthread.
Vote 4 Close.

blupp1 · Oct 23, 2011

freakshow10000 said:
danke für die Hilfe aber .. Steinzeitthread.

Und? Er hat eine Frage zu einem Thread (noch aus diesem Jahr)?
Warum stört dich das?

PapaBaer · Oct 23, 2011

Zu später Stunde bei einem alten Thread, also ohne Gewähr:

freakshow10000 said:

Code:

109.230.251.35 - - [24/Apr/2011:12:53:05 +0200] "GET http://203.209.228.42/?login=tomweldon232&passwd=testing HTTP/1.0" 200 9820 "-" "-"
113.205.183.9 - - [24/Apr/2011:15:06:34 +0200] "GET http://www.ip2location.com HTTP/1.0" 200 9820 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
[...]
113.205.162.105 - - [25/Apr/2011:00:37:22 +0200] "GET http://www.ip2location.com HTTP/1.0" 200 9820 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"

Hack Angriffe erfolgreich / erfolglos?

freakshow10000

Guest

Der_Sensemann

Registered User

its

New Member

freakshow10000

Guest

MTLServices

New Member

PapaBaer

Registered User

Privateer

New Member

dante

Member

freakshow10000

Guest

blupp1

Guest

PapaBaer

Registered User