Internetworkers: http://www.ibiblio.org/internetworkers/

[Steven Champeon <schampeo AT hesketh.com>]

on Tue, Sep 18, 2001 at 05:00:06PM -0400, Kate Johnson wrote:
> Okay, naive question here - what does 'following a 302' mean?  

Sorry.

HTTP (HyperText Transfer Protocol), the underlying protocol that the
Web uses to transfer files and data, uses response codes:

HTTP 200 OK
HTTP 302 Moved Temporarily
HTTP 404 Not Found
HTTP 500 Server Error

to signify the status of the server's response. A 302 is simply a
shorthand way of saying "redirect". The issue here is that the worm,
once it connects to the port and issues its GET requests for the
various possibly exploitable files, is unlikely to have been built
such that it would properly handle any unexpected error condition.
I'd be surprised if it actually handled anything but 200 (OK) or 
404 (Not Found), so redirecting it to microsoft.com, while amusing,
probably doesn't have any actual effect.

It'd be easy enough to test, I suppose - redirect to another server
you control and see if the redirects show up.

-- 
hesketh.com/inc. v: (919) 834-2552 f: (919) 834-2554 w: http://hesketh.com