Possible Intrusion Scan

[jheaton]

I host our company web site on a W2k server running IIS. Upon review of the log files, I discovered lines similar to the following occuring several times a night.

61.248.35.135, -, 10/24/2003, 7:54:37, W3SVC1, SVRWEB01, 192.168.2.5, 15, 111, 50, 501, 0, get, /winnt/system32/cmd.exe, /c%20dir,

My theory is that this is someone (probably a script that scans a range of IP addresses, and mine just happen to be in that range) scanning my server for known vuneribilities. It looks as though they are trying to list and/or change directories. Is this a correct assumption?

 

[ChrisHirst]

yep just one of many directory traversal script attacks that happen, sometimes several a day. So long at the status code is a 500 error it shouldn't be a major cause for concern.


Chris.

Indifference will be the downfall of mankind, but who cares?

 

[Willis99]

Incidentally, if you don't already know, that IP is from Korea.

http://www.dnsstuff.com/tools/whois.ch?ip=61.248.35.135&server=whois.krnic.net&cache=off

You do have the Microsoft URLSCAN lockdown tool installed and configured, right? And you have run the MS Baseline Security Analyzer to check your configuration, right?