:Attack: cgi_dir

При повторной попытке:

webstat@localhost@08/26/2004 11:37:34: LOG: apache_regex_xml:

26/Aug/2004:11:37:34 +0300 : Subsequent Bad Request "GET /cgi-bin/ HTTP/1.1" :From

192.168.0.1 :Attack: cgi_dir

Обратите внимание, что система различает первую и последующие попытки одной и той же атаки.

Использование сенсора logSTAT аналогично предыдущему:

#logstat -i /var/log/messages -i /var/log/secure

либо:

#logstat -a /var/log/messages -a /var/log/secure

[Sun Aug  29 10:01:56 2004] : Facility : kernel:  First Occurance : eth0: setting promiscuous mode.

logstat@localhost@29/08/2004 12:01:57: LOG: syslog_watch:

[Sun Aug  29 11:01:16 2004]: Facility : sshd[7717]:  First Occurance : failed password for root

from 192.168.0.20 port 22 ssh2

[Sun Aug  29 11:01:16 2004]: Facility : server[23101]:  Subsequent Occurance : dispatch_input:

bad request line

'aa~m?~n?~o?~p?%.236u%304$n%.217u%305$n%.6u%306$n%.192u%307$n~p~p~p~p~p~p~

p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p~p