Printable View
Hi all,
i found in logs of one www page i made that someone is trying to access files like /cgi-bin/Formmail.pl, /cgi-bin/formmail.cgi,/cgi-sys/formmail.cgi etc. Is this something like bots looking for robots.txt or is someone just trying to find a hole in security? If so - I'm curious what should these files do? I do know nothing about cgi so could someone explain?
Thank you in advance
Sounds like someone is looking for CGI vulnerabilities. It could be a manual scan or an automated scan using something like nikto.
Formmail.pl is a well-known, but very poorly written CGI script for sending e-mail from a web form. It's so bad that many ISP's and web hosts explicitly forbid it's use. Spammers scan for sites with formmail.pl present, and exploit it in order to do their thing and send spam through it to hide the real source. Because of this, I would report them to their ISP abuse address...
Thanx for info guys!
If you are looking for more specific vulnerabilities, goto http://search.securityfocus.com/swsearch and type in "formmail" as the search text.
Wow... 195... is that all?Quote:
Results for formmail 1 to 15 of 195 results.
I realize that it was just showing up in your logs, and you may not be using it... but for the curious (like me)....
most "auditing tools" also scan for it, and so do some mass mailers..
funny thing is, if you write a little cgi that poses as formmail, you can catch what they are trying to send thrue your server..
In my case I caught some lame spammers trying to send (mass) mails for penis enlargements :)