I noticed that some search engines (or just a few people?) are looking for formmail.cgi or formmail.pl in cgi-bin driectory. This happens so often, from different addresses, looking for mixed capital and not capital letters of FormMail.cgi or pl.
It seems they want to find a formmail cgi, and get access to a form mailer, so they can send spam emails from website.
Fortunately I have not to afraid about others spamming from my site, but this is interesting hacking or spamming action...
We should be aware of these actions.

Did anybody else find similar occurences in his webserver error log?

Best regards,
Webmaster33

---

Paid Support from Webmaster33. Expert in Perl programming & Gossamer Threads applications. (click here for prices)
Webmaster33's products (upd.2004.09.26) | Private message | Contact me | Was my post helpful? Donate my help...

Yes, it's quite common actually. Our servers regularly get scanned looking for an exploitable formmail to send out spam to.

Cheers,

Alex
--
Gossamer Threads Inc.

Maybe we could install a fake formmail.cgi which actually does not send out anything, but saves the info about the sender, and the email want would be sent out...
We could catch them this way...

Opinion?

Best regards,
Webmaster33

---

Paid Support from Webmaster33. Expert in Perl programming & Gossamer Threads applications. (click here for prices)
Webmaster33's products (upd.2004.09.26) | Private message | Contact me | Was my post helpful? Donate my help...

Why? It just means you'll have to handle getting spammed with thousands of hits. As soon as the robots find a vulnerable formmail.cgi, your server will get hammered with cgi requests sending out thousands and thousands of mail.

You could easily log the IP's of the people scanning for these by searching your log files.

Cheers,

Alex
--
Gossamer Threads Inc.

They are also looking for autoresponders... mreply.rc is somehow being misused by spammers, not exactly sure how though.

The script formmail.cgi should be modified, so only the first X emails should be allowed to be sent out correctly. And also logged into file. So we can track them.

Best regards,
Webmaster33

---

Paid Support from Webmaster33. Expert in Perl programming & Gossamer Threads applications. (click here for prices)
Webmaster33's products (upd.2004.09.26) | Private message | Contact me | Was my post helpful? Donate my help...

I just tried this quickly and it seemed to work. It should list the ip's from your access log from anyone requesting formmail.cgi


You can use "sed" if you want to use a better matching alogorythm (can't spell doh).