1

I noticed lines like these in my apache log

[Fri Oct 15 21:09:43 2010] [error] [client 216.205.76.228] client sent 
HTTP/1.1 request without hostname (see RFC2616 section 14.23): 
/w00tw00t.at.ISC.SANS.DFind:)

Coming from the following IP addresses:

184.73.216.225
208.109.154.93
216.205.76.228
74.86.23.51

What does the error message mean and what are these people trying to do?

2 Answers 2

3

Just someone scanning you with DFind looking for vulnerabilities in common php software. You probaby have alot more 404's in your error log.

Put this in dfind.ban

cat /path/to/error.log | grep "/w00tw00t.at.ISC.SANS.DFind" | egrep -o '([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})' | awk '{print "iptables -I INPUT -s " $1 " -j DROP"}' | sort | uniq > dfind.ban

Make it executable and run it and you will ban everyone who scanned you with dfind.

You can also ban them directly by using:

iptables -I INPUT -d 127.0.0.1 -p tcp --dport 80 -m string --to 70 --algo bm --string 'GET /w00tw00t.at.ISC.SANS.DFind' -j DROP

Replace 127.0.0.1 with your webserver ip.

Source: http://blog.urlvoid.com/w00tw00t-at-isc-sans-dfind-web-scanner/

4

Being scanned for vulnerabilities is a part of webserver life. You can try to block them, but ultimately you're likely to be scanned by more infected PCs than you'll be able to keep ahead of.

It's better to be proactive:

  • Always keep your services patched!
  • Disable features in software you don't need.
  • Scan your server for vulnerabilities so you know about them before someone out there takes advantage of them.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .