Re: WebDAV Probes

From: Roger Abell (mvp_at_asu.edu)
Date: 02/26/04 

Date: Thu, 26 Feb 2004 09:20:46 -0700

Interesting Bernard,
Just the reverse of what I have been seeing. On the older IIS the
URLscan logs have been steadily increasing, from scattered IPs,
over the past month or so, more noticable in recent weeks.

Roger

"Bernard" <qbernard@hotmail.com.discuss> wrote in message
news:OL4SkqB$DHA.2800@tk2msftngp13.phx.gbl...
> My traffic for such request is going down as compare when the exploits is
in
> it early stage. now, not much, about the same for codered. and urlscan is
> blocking all these.
>
> --
> Regards,
> Bernard Cheah
> http://support.microsoft.com/
> Please respond to newsgroups only ...
>
>
> "Roger Abell" <mvpNOSpam@asu.edu> wrote in message
> news:eF3zW26#DHA.2432@TK2MSFTNGP11.phx.gbl...
> > Have many others noticed a slow, but accelerating,
> > increase in the amount of WebDAV supporting verbs
> > getting thrown at their IIS servers ?
> > Over the past 4 to 6 months I have watched this, starting
> > with an almost non-existent amount, but now in the past
> > month it seems to have really accelerated.
> >
> > While I have this disabled at the IIS level, and also
> > crippled at the registry level, if the growth continues
> > the amount may get to be non-negligable in a while.
> >
> > Any ideas on what probe tool may have been updated
> > to examine for these exploit vectors ?
> >
> > TIA,
> > --
> > Roger Abell
> > Microsoft MVP (Windows Server System: Security)
> > MCSE (W2k3,W2k,Nt4) MCDBA
> >
> >
>
>

Relevant Pages