Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I noticed lines like these in my apache log

[Fri Oct 15 21:09:43 2010] [error] [client 216.205.76.228] client sent 
HTTP/1.1 request without hostname (see RFC2616 section 14.23): 
/w00tw00t.at.ISC.SANS.DFind:)

Coming from the following IP addresses:

184.73.216.225
208.109.154.93
216.205.76.228
74.86.23.51

What does the error message mean and what are these people trying to do?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

Just someone scanning you with DFind looking for vulnerabilities in common php software. You probaby have alot more 404's in your error log.

Put this in dfind.ban

cat /path/to/error.log | grep "/w00tw00t.at.ISC.SANS.DFind" | egrep -o '([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})' | awk '{print "iptables -I INPUT -s " $1 " -j DROP"}' | sort | uniq > dfind.ban

Make it executable and run it and you will ban everyone who scanned you with dfind.

You can also ban them directly by using:

iptables -I INPUT -d 127.0.0.1 -p tcp --dport 80 -m string --to 70 --algo bm --string 'GET /w00tw00t.at.ISC.SANS.DFind' -j DROP

Replace 127.0.0.1 with your webserver ip.

Source: http://blog.urlvoid.com/w00tw00t-at-isc-sans-dfind-web-scanner/

share|improve this answer
add comment

Being scanned for vulnerabilities is a part of webserver life. You can try to block them, but ultimately you're likely to be scanned by more infected PCs than you'll be able to keep ahead of.

It's better to be proactive:

  • Always keep your services patched!
  • Disable features in software you don't need.
  • Scan your server for vulnerabilities so you know about them before someone out there takes advantage of them.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.