[Silicon Defense logo]

SnortSnarf alert page

Source: 24.157.153.204

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

21 such alerts found using input module SnortFileInput, with sources:
Earliest: 08:54:37.786286 on 05/22/2003
Latest: 09:23:28.191300 on 05/23/2003

6 different signatures are present for 24.157.153.204 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

24.157.153.204 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:54:37.786286 24.157.153.204:1394 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:29770 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0x1AC2F855 Ack: 0x19346A60 Win: 0x4470 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:54:41.857219 24.157.153.204:1628 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:30332 IpLen:20 DgmLen:110 DF
***AP*** Seq: 0x1B74A424 Ack: 0x1A21A94D Win: 0x4470 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:54:48.765916 24.157.153.204:1906 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:31321 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x1C465982 Ack: 0x19726DD3 Win: 0x4470 TcpLen: 20
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:54:58.182816 24.157.153.204:2666 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:32947 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x1E851163 Ack: 0x1AB1823F Win: 0x4470 TcpLen: 20
[**] [1:1945:1] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:54:58.362691 24.157.153.204:2673 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:32979 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x1E8B1554 Ack: 0x1AF8C891 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1288:5] WEB-FRONTPAGE /_vti_bin/ access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
05/22-08:54:58.552832 24.157.153.204:2683 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:33007 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0x1E938CD6 Ack: 0x1B152546 Win: 0x4470 TcpLen: 20
[**] [1:1286:5] WEB-IIS _mem_bin access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
05/22-08:54:58.745249 24.157.153.204:2688 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:33029 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0x1E97FB74 Ack: 0x1AD2C83F Win: 0x4470 TcpLen: 20
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:55:08.331219 24.157.153.204:3182 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:34466 IpLen:20 DgmLen:185 DF
***AP*** Seq: 0x2017FF69 Ack: 0x1ADD15DD Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:55:08.510685 24.157.153.204:3210 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:34506 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x20222057 Ack: 0x1B7D98CD Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:55:08.703414 24.157.153.204:3216 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:34533 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x202726BF Ack: 0x1B2A899E Win: 0x4470 TcpLen: 20
[**] [1:981:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:55:08.898789 24.157.153.204:3222 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:34565 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x202C245F Ack: 0x1B473464 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:983:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:55:09.242755 24.157.153.204:3231 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:34634 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x2032F250 Ack: 0x1B706B94 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:55:09.463832 24.157.153.204:3293 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:34685 IpLen:20 DgmLen:138 DF
***AP*** Seq: 0x206524F6 Ack: 0x1BA504A2 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:55:12.669074 24.157.153.204:3301 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:35153 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x206BC2ED Ack: 0x1BCAA562 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:55:18.583688 24.157.153.204:3301 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:35986 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x206BC2ED Ack: 0x1BCAA562 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:55:21.809408 24.157.153.204:3927 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:36310 IpLen:20 DgmLen:140 DF
***AP*** Seq: 0x2252BEB7 Ack: 0x1C4A5CBB Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/22-08:55:31.250159 24.157.153.204:4313 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:37556 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x238E619C Ack: 0x1C33D39A Win: 0x4470 TcpLen: 20
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/23-09:23:04.818257 24.157.153.204:2320 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:48455 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0x9B42D347 Ack: 0xC4493A01 Win: 0x4470 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/23-09:23:20.807227 24.157.153.204:2686 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:49849 IpLen:20 DgmLen:110 DF
***AP*** Seq: 0x9C8FDD72 Ack: 0xC607F8C3 Win: 0x4470 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/23-09:23:24.003581 24.157.153.204:2787 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:50146 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x9CE720E9 Ack: 0xC56FDF80 Win: 0x4470 TcpLen: 20
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/23-09:23:28.191300 24.157.153.204:2870 -> 192.168.1.6:80
TCP TTL:109 TOS:0x0 ID:50490 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x9D35CEE3 Ack: 0xC5E16D72 Win: 0x4470 TcpLen: 20
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:03:54 2003