Re: [security-elvandar] "access_log?hello" ?

Hi,

It could be an overflow attack to the access_log script which he/she believes exists.
With that he might get access to some logging OR access to the webserver (executing commands as
the webserver user) how he/she is going to do that, i don' know, but it's an option (:

Also notice that it's a HEAD request instead of the normal GET/POST requests..
perhaps that can give some more detail?
Going to try and find something tommorrow (it's past twelve here) but have a busy schedule
so dont promise anything

Cheers

--

Kind regards,

Remko Lodder
Elvandar.org/DSINet.org
www.mostly-harmless.nl Dutch community for helping newcomers on the hackerscene


Salvatore Poliandro wrote:

>-- OM--






---------------------------------------------------------------------------
----------------------------------------------------------------------------