Fingerprinting Port 80 Attacks

pg writes "I found an interesting article on www.cgisecurity.com that explains common fingerprints in web server, and web application attacks. It goes to describe how to detect most known, and unknown attacks. This may come in handy when trying to detect another internet worm."

Comments

Garbage requests

[spankfish]

What I personally like to do is create a good set of rules for detecting this kind of garbage requests and storing them in log files which are separate to my normal access_log and error_log... that way I don't have to wade through acres of crap while looking at my real visitors.

Yes, I know I could grep 'em out while viewing, but I think garbage should be kept in a separate place to the real visitors' log entries.