I was recently asked 'What causes a line like this in our access.log?'
18.104.22.168 - - [22/Feb/2010:16:03:35 -0800] "GET http://www.google.com/ HTTP/1.1" 200 295 "-" "Mozilla/5.0 (compatible; MSIE 5.01; Win2000)"
My immediate answer is that's someone exploring something a little devious.
- how? Speculation... a short perl or python script could easily connect and ask for a URL with an invalid host. but don't post one. If you know a good one liner, I'd be curious. Consider this golf for today :)
- Vulnerabilities? What is someone looking for when they do this, what have they learned, and should we patch it?
- Do I need a tin-foil hat to keep them from reading my mind?
- And for me the real question: Shouldn't that be a 404 response, not a 200!?
This is on a standard LAMP server (Ubuntu).