Google it: http://www.google.com/search?hl=en&ie=UTF-8&oe=UTF-8&q=SEARCH-%2F%5Cx90%5Cx0 2%C2%B1
This is presumably an attempt to exploit the MS03-007 NTDLL vulnerability via WebDAV. http://archives.neohapsis.com/archives/sf/pentest/2003-03/0109.html http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.gaobot.jb.h tml http://www.microsoft.com/technet/security/bulletin/MS03-007.mspx Other people have seen the following requests in their web server logs: SEARCH /AAAAAAAAA... or SEARCH /�������... -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of i.t Consulting Sent: Wednesday, March 31, 2004 1:39 PM To: [EMAIL PROTECTED] Subject: [despammed] [Full-Disclosure] SEARCH web attack during March the apache log shows some SEARCH attacks like "SEARCH /\x90\x02�\x02� ... x90\x90" 414 343 "-" "-" see full examples http://thum.ath.cx/Apache/code.414 can someone enlighten me what the wanted result may be? tia _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
