0

I looked at my logs from amazon ec2 instance and found the following lines:

94.177.121.102 - - [29/Mar/2014:08:50:52 +0000] "XGET /web-console/ServerInfo.jsp HTTP/1.0" 501 418 "-" "-"
94.177.121.102 - - [29/Mar/2014:08:50:52 +0000] "XGET /jmx-console/HtmlAdaptor HTTP/1.0" 501 415 "-" "-"

I looked at http status codes and 501 means.

501 Not Implemented

The server either does not recognize the request method, or it lacks the ability to fulfill the request.[2] Usually this implies future availability (e.g., a new feature of a web-service API).

I checked that such files and even parenting directories do not exist in my /var/www and therefore I do not understand why it shows 501 and not 404.

I googled about these particular names (ServerInfo.jsp and HtmlAdaptor) but did not find anything that I can properly understand.

I found also similar issues in my error.log file (due to stupidity I truncated the logs...).

Do not know if this is helpful, but nothing was installed on the server except of git and some updates.

Does this sound like an intrusion or am I overreacting? What can these 501 means (wiki explanation are not really helpful to me)?

2

very simple: the request-method is not GET, but XGET which is not known, thus you server reports error 501

do you run tomcat/jboss or a similar app-serever? i guess, not.

this looks like a simple scan from some random skiddo who tries to find vulnerable app-servers but fails with the simple task of generating valid requests; the XGET looks interesting (from an ids-pov)

Does this sound like an intrusion or

no, just a simple scan

am I overreacting

surely :)

  • Thank you for explanation. I was surprised by 501 part (I never saw it before). I thought that it should generate 404. But thanks to you now I understand. – Salvador Dali Mar 29 '14 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.