Date:  Mon, 9 Jul 2007 16:00:16 -0500
From:  "Hugh Messenger" <hugh (at mark) alaweb.com>
Subject:  [coba-e:10345] Re: Finding a Mail Script
To:  <coba-e (at mark) bluequartz.org>
Message-Id:  <005801c7c26c$272aa070$010210ac@DELLBOY>
In-Reply-To:  <4692406B.1050803 (at mark) distortal.com>
References:  <4692406B.1050803 (at mark) distortal.com>
X-Mail-Count: 10345

> Is there any way to find out which script spawned a given message?  As
> far as I am aware there are only PHP scripts on the server, but I could
> be wrong.

Of limited use, but you could try:

[root (at mark) raq2 ~]# find /home/sites/*/web/ -name \*.php -exec grep "mail(" '{}'
\; -print

... which will at least show you all PHP scripts which use the built in PHP
mail() function.  You might also try searching for 'sendmail' as well, for
any that go through the back door and exec sendmail directly.
 
That miught at least give you something to start looking at, if it is some
insecure form mailer or guestbook.

> DD

   -- hugh