Is this a hack attempt?

[paulray]

In our IIS logs, we show date, time ip address and HEAD. What does HEAD mean? After HEAD there appears to be an attempt to run CMD.EXE or ROOT.EXE from different folders, including system32, scripts, _mem_bin, _vti_bin etc... In all cases the result code was 401 access denied.
Thanks
Paul

 

[ChrisHirst]

A HTTP HEAD command just tells the server to respond with the page headers only, and yes it is a scripting attack on one of the many buffer overflow holes in IIS.




Chris.

Indifference will be the downfall of mankind, but who cares?

 

[paulray]

Thanks