[Silicon Defense logo]

SnortSnarf alert page

Source: 24.90.92.167

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

17 such alerts found using input module SnortFileInput, with sources:
Earliest: 12:46:24.710320 on 04/18/2003
Latest: 12:47:11.032799 on 04/18/2003

6 different signatures are present for 24.90.92.167 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

24.90.92.167 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:46:24.710320 24.90.92.167:2662 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:26981 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0xFDD12AF9 Ack: 0x78BCE363 Win: 0xFAF0 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:46:27.554673 24.90.92.167:2662 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:27359 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0xFDD12AF9 Ack: 0x78BCE363 Win: 0xFAF0 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:46:39.539045 24.90.92.167:3137 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:29213 IpLen:20 DgmLen:110 DF
***AP*** Seq: 0xFF604087 Ack: 0x79241020 Win: 0xFAF0 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:46:40.900891 24.90.92.167:3166 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:29401 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0xFF7901A7 Ack: 0x798F9EB2 Win: 0xFAF0 TcpLen: 20
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:46:41.699426 24.90.92.167:3215 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:29544 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0xFFA18674 Ack: 0x79402189 Win: 0xFAF0 TcpLen: 20
[**] [1:1945:1] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:46:42.722772 24.90.92.167:3245 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:29676 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0xFFBB34A3 Ack: 0x79ACD683 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1288:5] WEB-FRONTPAGE /_vti_bin/ access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/18-12:46:43.927089 24.90.92.167:3267 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:29844 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0xFFCF5AF9 Ack: 0x7941F05F Win: 0xFAF0 TcpLen: 20
[**] [1:1286:5] WEB-IIS _mem_bin access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/18-12:46:44.929229 24.90.92.167:3298 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:30000 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0xFFEB591C Ack: 0x79A654EA Win: 0xFAF0 TcpLen: 20
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:46:45.844146 24.90.92.167:3340 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:30129 IpLen:20 DgmLen:185 DF
***AP*** Seq: 0xCD1AB Ack: 0x79C0CC77 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:46:50.501434 24.90.92.167:3459 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:30743 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x7056FB Ack: 0x79A09C4D Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:46:51.173816 24.90.92.167:3505 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:30856 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x953D40 Ack: 0x79D2C1D2 Win: 0xFAF0 TcpLen: 20
[**] [1:981:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:46:52.209702 24.90.92.167:3525 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:30986 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xA63932 Ack: 0x7A0FC3B1 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:983:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:46:53.413176 24.90.92.167:3554 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:31147 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xBE5A55 Ack: 0x7991175C Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:46:58.104873 24.90.92.167:3688 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:31762 IpLen:20 DgmLen:138 DF
***AP*** Seq: 0x1363AAE Ack: 0x7A6120D1 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:46:59.233080 24.90.92.167:3722 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:31931 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x153C827 Ack: 0x7A4C624D Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:47:00.054099 24.90.92.167:3751 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:32092 IpLen:20 DgmLen:140 DF
***AP*** Seq: 0x16FC21C Ack: 0x7A74D200 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/18-12:47:11.032799 24.90.92.167:4117 -> 192.168.1.6:80
TCP TTL:113 TOS:0x0 ID:33816 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x29D594C Ack: 0x7B5F8CA2 Win: 0xFAF0 TcpLen: 20
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:03:54 2003