quote:

---

> Last night I experienced a server attack on IIS 5.0 - with all patches in
> place (thankfully).
> The logs are available on http://www.skill-it.com/Dave/www.asp and are

---

quote:

---

> interesting
> - as well as showing attempts to infect with the the CODE RED II worm they
> show
> what I think is a manual attempt to exploit the situation that the worm
> would have caused.
> (see the entries for IP address 217.40.142.3 commencing 23/01/2004

---

quote:

---

> (CET))
>
> What I don't understand is why dosome of the commands get a 200 response
> such as
> 200 HEAD /c/winnt/system32/cmd.exe /c+dir+c:\winnt\system32\cmd2.exe
>
> Can someone also explain what the HEAD command does.
>
> Thanks in advance,
> David Marin
>
>

---

quote:

---

> Google:
>
> http://www.google.com/search?hl=en&...q=http+head+get
> http://www.webmasterworld.com/forum11/2231.htm
>
> I assume you're not using URLScan. You really should be. It's free from
> www.microsoft.com/technet/security There are also a number of free
> hardening checklists for Windows and IIS there that you should consider
> using.
>
>
> "David Martin" <David.Martin@skill-it.com> wrote in message
> news:eO878am4DHA.1504@TK2MSFTNGP12.phx.gbl...
in[QUOTE][color=darkred]
> quite
they[QUOTE][color=darkred]
> 12:28:39
/c+dir+c:\winnt\system32\cmd2.exe[QUOTE][color=darkred]
>
>

---

quote:

---

> Last night I experienced a server attack on IIS 5.0 - with all patches in
> place (thankfully).
> The logs are available on http://www.skill-it.com/Dave/www.asp and are quite
> interesting
> - as well as showing attempts to infect with the the CODE RED II worm they
> show
> what I think is a manual attempt to exploit the situation that the worm
> would have caused.
> (see the entries for IP address 217.40.142.3 commencing 23/01/2004 12:28:39
> (CET))
>
> What I don't understand is why dosome of the commands get a 200 response
> such as
> 200 HEAD /c/winnt/system32/cmd.exe /c+dir+c:\winnt\system32\cmd2.exe
>
> Can someone also explain what the HEAD command does.
>

---

quote:

---

> circa Sat, 24 Jan 2004 11:42:15 +0100, in
> microsoft.public.inetserver.iis.security, David Martin
> (David.Martin@skill-it.com) said,
in[QUOTE][color=darkred]
quite[QUOTE][color=darkred]
they[QUOTE][color=darkred]
12:28:39[QUOTE][color=darkred]
/c+dir+c:\winnt\system32\cmd2.exe[QUOTE][color=darkred]
> The HEAD command is like a GET, except that instead of asking for the
> actual resource, it asks just for the headers associated with the
> resource. Essentially, it's a check to see if the object exists
> without downloading it.
>
> Laura

---