This looks to be a banner grabbing attempt on your webservers. Alot of scanners/worms will do this in an attempt to find out what type of web server you are running and compare it against a list of vulnerable servers for some particular exploit. The `"/sumthin" is placed within the GET command to trigger a 404 error, which in turn reveals valuable information about your server back the requestor. If the information returned by your server is useful to the scanner/worm you may see other exploits in the near future targeted towards your box. For a more practical example, consider the sadmind worm which issues the following request for this purpose: "GET x HTTP/1.0." If you want to see what is returned by your box, simply telnet to your server on port 80 and issue the same request and hit ENTER twice. You should see something similar to: [root@calsys root]# telnet 127.0.0.1 80 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. GET /sumthin HTTP/1.0 HTTP/1.1 404 Not Found Date: Thu, 17 Oct 2002 11:21:35 GMT Server: Apache/2.0.40 (Unix) Content-Length: 286 Connection: close Content-Type: text/html; charset=iso-8859-1 . . . and probably some 404 HTML error code too Notice how it revealed the Web Server type, Version and OS it runs on. I would consider this type of activity as an information gathering attempt, because it isn't an attack or exploit. Hope this helps, -- Johnny Calhoun Information Security Analyst LURHQ Corporation On Thursday 17 October 2002 01:56 pm, cory wrote: > I have seen this on our servers, starting Oct 12 with 213.165.144.xxx > (only one ip) and then again on the 15th from 194.236.60.xxx (also one > ip) . > > Each time they hit they sent 5 to 6 attempts within one second, all > looking in the same place. > > 213.165.144.xxx - - [12/Oct/2002:05:40:01 -0500] "GET /sumthin HTTP/1.0" > 404 1086 "-" "-" > 213.165.144.xxx - - [12/Oct/2002:05:40:01 -0500] "GET /sumthin HTTP/1.0" > 404 1086 "-" "-" > 213.165.144.xxx - - [12/Oct/2002:05:40:01 -0500] "GET /sumthin HTTP/1.0" > 404 1086 "-" "-" > 213.165.144.xxx - - [12/Oct/2002:05:40:01 -0500] "GET /sumthin HTTP/1.0" > 404 1086 "-" "-" > 213.165.144.xxx - - [12/Oct/2002:05:40:01 -0500] "GET /sumthin HTTP/1.0" > 404 1086 "-" "-" > (6 times in all.) > > All logs look identical to your post. > What do we have here ? > > cheers, > cory > > jmaywood1975at_private wrote: > >Does anyone have any ideas what attack this might be? > > > >Below shows 4 seperate potential attacks by 3 different hosts, this is all > > the activity in my logs for those three hosts, nothing more anywhere > > related to those three ip address. > > > >It starts with a request for the directory /sumthin > >maybe tries a header exploit by sending a VERSION method? > >and connects ssl. > > --------------------------------------------------------------------------- >- This list is provided by the SecurityFocus ARIS analyzer service. > For more information on this free incident handling, management > and tracking system please see: http://aris.securityfocus.com ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Thu Oct 17 2002 - 17:03:48 PDT