Good thing my host knows what they are doing, I had a hack attempt last night on my website

[Train]

it was a pretty lame attack, but an attack none the less, and I cant help but want to look into it. I just happened to be looking over the logs before i went to bed and saw this, makes me wonder how often it actually happens, last summer I caught a guy trying an old Front Pager Server Extension loop hole, but luckily, my web host, Innerhost.com, does a very good job of keeping thier servers secure.(this one is NT 4)

This is what showed up in my server log:

http://***.**.**.***/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\

I *Starred* out my server IP. The guy was trying to list the contents of the C: drive, muhahaha, what a joke.

heres his info, anyone know what ISP this is from?
Remote IP: 62.224.56.35
Reverse DNS: p3EE03823.dip.t-dialin.net
Browser Tag: Telnet

the domain is still under development, you would get an under construction page if you went to it, so there arent many places this guy could have gotten my domain name, this Forum is one of them.

 

[Adul]

damn script kiddies. :|

 

[Emulex]

you sure they are good? look at my sig line, and point that at your hosting provider. It will unleash a world of hurt on their server, about 50% of the servers the nessus full scan runs, find open holes, about 30% of the servers it scans, dies.

 

[Adul]

Nice link emulex.

 

[Soybomb]

<< about 30% of the servers it scans, dies. >>


I can just see people clamoring to use it now.

 

[shiznut123]

Neotrace shows hime to be somewhere across the east coast. The last place it showed was New York.
He is using Deutsche Telekom Online Service so I assume he's Dutch.

 

[ajskydiver]

Wouldn't Deutsche be German? Just a guess.