View Single Post
  #1  
Old 14th October 2011, 13:59
vmos vmos is offline
Member
 
Join Date: Nov 2008
Posts: 57
Thanks: 1
Thanked 0 Times in 0 Posts
Default Apache // mystery files named "1" showing secure details

Hello, we've got a whole bunch of servers running debian sarge, etch, lenny and ubuntu lucid

Just today we've noticed some files in some sites on many servers called 1, just "1"

a few of these are viewable via websites and the show things that should probably not be shown. Some show crontabs, some show htaccess files and things.

I've tried googling but "1" doesn't exactly narrow down the search results. I'm inclined to think it's some feature of apache that we haven't disabled

Has anyone seen this or know where they might be coming from?


/edit Mystery solved

If you edit a file in VI and then do wq! to save but don't hold shift properly, this enters wq1 which saves the contents of the file you're editing in another file called 1

FFS

Last edited by vmos; 14th October 2011 at 14:22.
Reply With Quote
Sponsored Links