[22995] in bugtraq
Re: Hidden requests to Apache
daemon@ATHENA.MIT.EDU (Lorenzo Pulici)
Thu Oct 25 11:53:24 2001
Date: Thu, 25 Oct 2001 08:58:53 +0200
From: Lorenzo Pulici <webmaster@weitzmann.it>
To: smiler <smiler@vxd.org>
Cc: bugtraq@securityfocus.com
Message-ID: <20011025085853.A17250@weitzmann.it>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <LEEPKOFKPCPHJMIIKFGJEENLCBAA.smiler@vxd.org>
On Wed, Oct 24, 2001 at 09:09:59PM +0100, smiler wrote:
> GET / HTTP/1.0 \r\r\n
> In this case APACHE will print in the log file the carriage return
> character. So when we try to tail the access_log file it will be shown in
> the screen as :
> " 414 3461.251 - - [24/Oct/2001:18:58:18 +0100] "GET / HTTP/1.0
> A normal line would be :
> 127.0.0.1 - - [24/Oct/2001:19:00:32 +0100] "GET / HTTP/1.0" 200 164
I tested it locally on my Apache 1.3.22 and I got:
bash-2.04$ telnet 192.168.2.1 80
Trying 192.168.2.1...
Connected to 192.168.2.1.
Escape character is '^]'.
GET / HTTP/1.0 \r\r\n
On access_log:
127.0.0.1 - - [25/Oct/2001:08:48:39 +0200] "GET / HTTP/1.0 \r\r\n" 400 368
--
Lorenzo Pulici - webmaster@weitzmann.it
http://www.weitzmann.it
