Was haben diese Logs zu bedeuten?

JPPeterson

JPPeterson

Registered User
Hallo,

ich habe heute mal wieder ein wenig in meinen logs gestöbert und dabei vielen mir folgende einträge im error.log vom Apache ins Auge

Code: 
/srv/www/vhosts/default/htdocs/myadmin
[Fri Dec 08 11:06:51 2006] [error] [client 213.202.247.239] File does not exist: /srv/www/vhosts/default/htdocs/phpMyAdmin-2.6.0
[Fri Dec 08 11:06:51 2006] [error] [client 213.202.247.239] File does not exist: /srv/www/vhosts/default/htdocs/phpMyAdmin-2.6.0-pl1
[Fri Dec 08 11:06:51 2006] [error] [client 213.202.247.239] File does not exist: /srv/www/vhosts/default/htdocs/phpMyAdmin-2.6.3-pl1
[Fri Dec 08 11:06:51 2006] [error] [client 213.202.247.239] File does not exist: /srv/www/vhosts/default/htdocs/phpMyAdmin-2.6.3
[Fri Dec 08 11:06:51 2006] [error] [client 213.202.247.239] File does not exist: /srv/www/vhosts/default/htdocs/phpMyAdmin-2.6.3-rc1
[Fri Dec 08 11:06:51 2006] [error] [client 213.202.247.239] File does not exist: /srv/www/vhosts/default/htdocs/phpMyAdmin-2.6.2-rc1
[Fri Dec 08 11:17:15 2006] [error] [client 87.118.100.232] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /w00tw00t.at.ISC.SANS.DFind:)
[Fri Dec 08 12:10:13 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/README
[Fri Dec 08 12:10:14 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/horde
[Fri Dec 08 12:10:14 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/horde2
[Fri Dec 08 12:10:15 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/horde3
[Fri Dec 08 12:10:16 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/horde-3.0.5
[Fri Dec 08 12:10:16 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/horde-3.0.6
[Fri Dec 08 12:10:17 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/horde-3.0.7
[Fri Dec 08 12:10:18 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/horde-3.0.8
[Fri Dec 08 12:10:18 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/horde-3.0.9
[Fri Dec 08 12:10:19 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/mail
[Fri Dec 08 12:10:20 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/email
[Fri Dec 08 12:10:20 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/webmail
[Fri Dec 08 12:10:21 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/newmail
[Fri Dec 08 12:10:22 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/mails
[Fri Dec 08 12:10:22 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/mailz
[Fri Dec 08 13:01:48 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/chat
[Fri Dec 08 13:01:48 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/chat
[Fri Dec 08 13:01:49 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/phpchat
[Fri Dec 08 13:01:50 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/PhpMyChat
[Fri Dec 08 13:01:50 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/chatroom
[Fri Dec 08 13:01:51 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/chats
[Fri Dec 08 13:01:52 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/forum
[Fri Dec 08 13:01:52 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/php
[Fri Dec 08 13:01:53 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/phpMyChat-0.14.2
[Fri Dec 08 13:01:54 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/phpMyChat-0.14.5
[Fri Dec 08 13:01:54 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/phpMyChat
[Fri Dec 08 13:01:55 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/phpMyChat-0.14.3
[Fri Dec 08 13:01:56 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/phpMyChat-0.14.4
[Fri Dec 08 13:01:56 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/chat1
[Fri Dec 08 13:01:57 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/forums
[Fri Dec 08 13:01:58 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/chat2
[Fri Dec 08 13:01:58 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/chat3
[Fri Dec 08 13:01:59 2006] [error] [client 211.45.123.148] File does not exist: /srv/www/vhosts/default/htdocs/community
[Fri Dec 08 14:08:58 2006] [error] [client 211.45.123.148] script

Das ist jetzt nur ein Auszug.Versucht da jemand fremdes zu testen ob gewisse Verzeichnisse auf dem Server sind? Denn ich kann mir nicht vorstellen das jemand sonst versucht die default verzeichnisse zu scannen :confused:
 
Solche Scans findest du bei jedem Server. Das ganze ist auch nicht weiter kritisch, außer der Scanner findet eines dieser Verzeichnisse und es ist noch genau dieses Script mit genau der Sicherheitslücke vorhanden die er sucht... eh schon wissen...
 
Kritisch denke ich nicht da im default verzeichniss vom vhost ja garnix liegt.Scannen diese hacker irgendwie nur die default verzeichnisse?
 
In der error.log sind ja nur die fehlgeschlagenen Versuche protokolliert. Vorsichtshalber würde ich mal in der access.log nach "/srv/www/vhosts/default/htdocs/" und den Teilstrings davon suchen.
 
In der access.log sind nicht solche einträge vorhanden.Nur einträge die direkt auf meine domains verweisen und da wurde nur auf Dateien zugegriffen die für den normalen Foren/Website betribe nötig sind.
Ist kein string mit "srv/www/vhost/default " zu finden
 
You must log in or register to reply here.
Back
Top