My personal Apache server occasionally gets some pretty obvious scans for vulnerabilities. The client that does the scanning does GET HTTP/1.1 methods on a variety of URLs, and uses a variety of User-Agent fields. The scanner seems to always use the following HTTP headers in every request (not necessarily in this order):
Accept: */* Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: Close
I've tried some of the open source web client libraries (Perl's libwww-perl, PHP's curl library, Python, wget, pmapwn, maybe a few others) but by default, nothing I've tried generates HTTP requests with that combination of Accept, Accept-Language and Accept-Encoding header values.
Based on Nmap operating system identification shortly after scans, and p0f passive identification, the client or scanner most probably runs on Linux.
What HTTP client or vulnerability scanner generates GET requests with those header values? Can anyone point me to the source code for it?
I'll give more info. The User-Agent field on this scanner sometimes shows up as "Morfeus Fucking Scanner", "Morfeus", "ZmEu", "Made by ZmEu @ WhiteHat Team - www.whitehat.ro", and possibly others. No, it's not the pmapwn scanner that has had "ZmEu" as its User-Agent sometimes.