[Silicon Defense logo]

SnortSnarf alert page

Source: 24.147.143.32

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

18 such alerts found using input module SnortFileInput, with sources:
Earliest: 14:33:01.521639 on 05/06/2003
Latest: 09:13:51.496695 on 05/07/2003

7 different signatures are present for 24.147.143.32 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

24.147.143.32 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/06-14:33:01.521639 24.147.143.32:2072 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:64513 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x20335E79 Ack: 0x89B68057 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/06-14:33:01.530892 24.147.143.32:2072 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:64514 IpLen:20 DgmLen:1500 DF
***A**** Seq: 0x2033642D Ack: 0x89B68057 Win: 0x4470 TcpLen: 20
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/07-09:13:30.173443 24.147.143.32:4278 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:5638 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0xF88C1EBE Ack: 0x12449177 Win: 0x4470 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/07-09:13:33.811437 24.147.143.32:4294 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:5952 IpLen:20 DgmLen:110 DF
***AP*** Seq: 0xF89A32D2 Ack: 0x1255F093 Win: 0x4470 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/07-09:13:33.998086 24.147.143.32:4402 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:5982 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0xF8F47D23 Ack: 0x1285F3F5 Win: 0x4470 TcpLen: 20
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/07-09:13:37.305855 24.147.143.32:4526 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:6396 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0xF95CD282 Ack: 0x1321F2E8 Win: 0x4470 TcpLen: 20
[**] [1:1945:1] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/07-09:13:37.486232 24.147.143.32:4531 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:6403 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0xF9616127 Ack: 0x1342A96B Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1288:5] WEB-FRONTPAGE /_vti_bin/ access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
05/07-09:13:37.702856 24.147.143.32:4543 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:6425 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0xF96BA31B Ack: 0x12A81735 Win: 0x4470 TcpLen: 20
[**] [1:1286:5] WEB-IIS _mem_bin access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
05/07-09:13:40.873201 24.147.143.32:4624 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:6620 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0xF9AF85E5 Ack: 0x13494189 Win: 0x4470 TcpLen: 20
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/07-09:13:41.071955 24.147.143.32:4630 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:6635 IpLen:20 DgmLen:185 DF
***AP*** Seq: 0xF9B534E5 Ack: 0x1386A616 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/07-09:13:41.242932 24.147.143.32:4634 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:6653 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xF9B8EEF6 Ack: 0x12FC36E0 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/07-09:13:44.437350 24.147.143.32:4741 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:6979 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xFA12A242 Ack: 0x136DB9DA Win: 0x4470 TcpLen: 20
[**] [1:981:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/07-09:13:44.624749 24.147.143.32:4746 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:6995 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xFA16A85C Ack: 0x138C0932 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:983:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/07-09:13:47.809442 24.147.143.32:4881 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:7409 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xFA850828 Ack: 0x139C623F Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/07-09:13:47.996192 24.147.143.32:4893 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:7424 IpLen:20 DgmLen:138 DF
***AP*** Seq: 0xFA8E49E2 Ack: 0x13D1B426 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/07-09:13:48.152694 24.147.143.32:4895 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:7435 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0xFA904684 Ack: 0x13EE73D2 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/07-09:13:48.325912 24.147.143.32:4903 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:7466 IpLen:20 DgmLen:140 DF
***AP*** Seq: 0xFA965153 Ack: 0x134705D8 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/07-09:13:51.496695 24.147.143.32:4994 -> 192.168.1.6:80
TCP TTL:107 TOS:0x0 ID:7741 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0xFAE206D9 Ack: 0x136415B3 Win: 0x4470 TcpLen: 20
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:03:52 2003