Just kinda curious if this is an attempt to overlow a app, or apache.

Saw this while looking through access_log for apache



I know this was Dec of 05, but i'm curious if that is a attempted overlow, so I know what to look for next time if I have to.

It continues much longer in the log, I'd say for a good 100+ more lines.

http://lists.sans.org/pipermail/list/2003-...ber/012720.html

Buffer overflow?

thats kinda what I was thinking, it never took anything down though.

It's a buffer overflow. If you look at the full SANS message, you can see the NOP slide. Although I doubt it would do anything. There doesn't seem to be a payload, and the values aren't URL encoded. The worst it would do is crash something.

Nothin like smashing the stack.

I've never really checked my access logs its amazing how many attempts I see at exploiting CGI, RPC, PHP scripts etc.

Its a Linux box, and its funny seeing stuff like




Last time I checked, thers no win.ini on a RHEL box

Thought this one was kinda funny.



I'm glad I payed to have my box hardened, and all the webservers / software hardened.

Good old mod_security, catches tons of these things on my server.

I know this is a very very late reply... but mod_security is an excellent tool! for those of you that need a good rule set I reccomend these:

http://www.gotroot.com/tiki-index.php?page..._security+rules

that doesnt cover everything, but will help you get started.

hope that helps some of you

Yea, it is a great application firewall.
They just released 2.0 and I'm actually in the process of upgrading from 1.9.

How do I check my access logs?

Also is there a script to install mod_security like ELS or APF? Those were simple because they had the root commands already written out for uber noobs like myself.

*edited - figured out the access logs. Logged into SSH

cd /usr/local/apache/logs
cat access_logs

that did the trick. Still need help with mod_security.

Take a look at this (guide on installing/config mod sec):
http://www.gotroot.com/tiki-index.php?page...of+mod_security

Mod security creates audit_log files in that folder (where you apache logs to, for me its /var/log/httpd/).

Also if you have it set up through cPanel it has a nice page that shows you a part of the log.

Why oh why did I think of "stashing the smack" when I read that?

Yay for dyslexia.