Microsoft FTP Service Default Behavior!

On Microsoft FTP server when there is a folder named after the logged in user in the defined FTP root folder then once the user has logged in, it jumps to that folder automatically. This is what I knew from some time ago but some days ago I made a new discovery! When there is no relevant folder to the logged in user, Microsoft FTP service does not give up easily and looks to see whether it can find a folder named "default" and jumps to that directory if it is located in the FTP root folder! I am not happy with these undocumented behaviors and I couldn't find any answer on how to change these defaults.

Response Splitting and Cross Site Scripting Attacks?

I was doing some study on "HTTP Response Splitting" and "Cross Site Scripting (css/xss)" and found some great articles which is worth sharing it:

• Divide and Conquer; HTTP Response Splitting, Web Cache Poisoning Attacks and Related Topics
• What is HTTP Response Splitting?
• What is Cross Site Scripting (css/xss) ?

Syslog Message Header Format

Finally I fixed my problem with huawei syslog messages! Actually I found a work around to it on my Syslog-NG server. There is a bad_hostname("regexp") directive in syslog-ng configuration file which can be used to ignore wrong hostnames extracted from syslog header messages if specified, and the cool thing is that you can use regular expresions to specify a range of hostnames matching your criteria. Once a bad_hostname matched syslog-ng will look into the IP header instead for the source address and places this address as the hostname.

But to realize what exactly the problem was I decided to take a close look into RFC 3164. Section 4.1.2 says:

• The HEADER contains two fields called the TIMESTAMP and the HOSTNAME.
• The TIMESTAMP field is the local time and is in the format of "Mmm dd hh:mm:ss" (without the quote marks)
• A single space character MUST follow the TIMESTAMP field
• The HOSTNAME field will contain only the hostname, the IPv4 address, or the IPv6 address of the originator of the message. The preferred value is the hostname
• Example: <34>Oct 11 22:14:15 mymachine su: 'su root' failed for lonvick on /dev/pts/8

It has firmly defined how a syslog message format should be and to see how Huawei is complying with this format I have captured traffic from huawei routers and switches with tcpdump:
>Oct 28 16:15:03 2006 SHZ-C2H-Router IFNET/5/UPDOWN:S[|syslog]

OK! instead of the HOSTNAME stgraight after the TIMESTAMP I see "2006" which is the YYYY part of the current date on huawei devices!
Anyway, as soon as the bad_hostname directive is there no need to bother for this kind of problem!

Add Syslog Support to Windows Servers

Windows does not support syslog but with a free add-on this ability can be added to all servers. SyslogAgent runs as a service on Windows Servers and it can convert all logs including logs in event viewer and service log files like those IIS generates for FTP, WWW and SMTP to syslog format and sends it to a central syslog server.
SyslogAgent is under GNU license, so it is free:
Datagram Free SyslogAgent