Re: nimda probes
On Thu, Sep 20, 2001 at 09:20:23AM -0700, Greg Wiley wrote:
> On Wednesday, September 19, 2001 11:55 PM, sam@gnubies.com
>
> > Nicholas Petreley had this suggestion for redirecting
> > nimda probes using Apache:
>
> > RedirectMatch ^.*\.(exe|dll).* http://support.microsoft.com
>
> Heh. I wonder if nimda actually responds to redirects.
>
> -=greg
Looking at my logs, it seems to work:
GET /cmd.dll HTTP/1.0" 302
GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 302
Same Apache redirect response as for /default.ida
and that, I know, works.
Sam
--
(Sam Varghese)
http://www.gnubies.com
Reply to: