[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**] [Classification: Web Application Attack] [Priority: 1] 05/16-15:51:20.890744 24.127.15.16:3287 -> 192.168.1.6:80 TCP TTL:104 TOS:0x0 ID:43184 IpLen:20 DgmLen:1500 DF ***A**** Seq: 0xA21033AA Ack: 0xC142B44A Win: 0x4470 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552] |
[**] [1:1002:5] WEB-IIS cmd.exe access [**] [Classification: Web Application Attack] [Priority: 1] 05/16-15:51:20.897298 24.127.15.16:3287 -> 192.168.1.6:80 TCP TTL:104 TOS:0x0 ID:43185 IpLen:20 DgmLen:1500 DF ***A**** Seq: 0xA210395E Ack: 0xC142B44A Win: 0x4470 TcpLen: 20 |
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:21:29.863726 24.127.15.16:2871 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:39739 IpLen:20 DgmLen:112 DF ***AP*** Seq: 0x616A86E3 Ack: 0xAF008610 Win: 0x4470 TcpLen: 20 [Xref => http://www.cert.org/advisories/CA-2001-19.html] |
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:21:30.617221 24.127.15.16:2911 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:39844 IpLen:20 DgmLen:110 DF ***AP*** Seq: 0x618C3966 Ack: 0xAF3730FF Win: 0x4470 TcpLen: 20 [Xref => http://www.cert.org/advisories/CA-2001-19.html] |
[**] [1:1002:5] WEB-IIS cmd.exe access [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:21:30.940091 24.127.15.16:2928 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:39892 IpLen:20 DgmLen:120 DF ***AP*** Seq: 0x619A1DD3 Ack: 0xAEC4107F Win: 0x4470 TcpLen: 20 |
[**] [1:1002:5] WEB-IIS cmd.exe access [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:21:31.261176 24.127.15.16:2949 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:39948 IpLen:20 DgmLen:120 DF ***AP*** Seq: 0x61AA231B Ack: 0xAE9E2279 Win: 0x4470 TcpLen: 20 |
[**] [1:1945:1] WEB-IIS unicode directory traversal attempt [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:21:31.599554 24.127.15.16:2975 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:40019 IpLen:20 DgmLen:136 DF ***AP*** Seq: 0x61BF7827 Ack: 0xAF6AEF83 Win: 0x4470 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884] |
[**] [1:1288:5] WEB-FRONTPAGE /_vti_bin/ access [**] [Classification: access to a potentially vulnerable web application] [Priority: 2] 05/24-03:21:31.962394 24.127.15.16:2999 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:40098 IpLen:20 DgmLen:157 DF ***AP*** Seq: 0x61D18CC7 Ack: 0xAF4CA47F Win: 0x4470 TcpLen: 20 |
[**] [1:1286:5] WEB-IIS _mem_bin access [**] [Classification: access to a potentially vulnerable web application] [Priority: 2] 05/24-03:21:32.276037 24.127.15.16:3034 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:40175 IpLen:20 DgmLen:157 DF ***AP*** Seq: 0x61ED4034 Ack: 0xAF1B4837 Win: 0x4470 TcpLen: 20 |
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:21:45.183641 24.127.15.16:3744 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:42977 IpLen:20 DgmLen:185 DF ***AP*** Seq: 0x6415EA26 Ack: 0xAFEB177C Win: 0x4470 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884] |
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:21:54.824838 24.127.15.16:4634 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:44819 IpLen:20 DgmLen:137 DF ***AP*** Seq: 0x66D65D4F Ack: 0xB06B7515 Win: 0x4470 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884] |
[**] [1:1002:5] WEB-IIS cmd.exe access [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:21:55.146346 24.127.15.16:4658 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:44883 IpLen:20 DgmLen:137 DF ***AP*** Seq: 0x66E76B1A Ack: 0xB0447301 Win: 0x4470 TcpLen: 20 |
[**] [1:981:6] WEB-IIS unicode directory traversal attempt [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:21:55.530042 24.127.15.16:4673 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:44919 IpLen:20 DgmLen:137 DF ***AP*** Seq: 0x66F32928 Ack: 0xAFFF0CA8 Win: 0x4470 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884] |
[**] [1:983:6] WEB-IIS unicode directory traversal attempt [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:21:55.892141 24.127.15.16:4692 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:44981 IpLen:20 DgmLen:137 DF ***AP*** Seq: 0x670238F9 Ack: 0xB0BF1419 Win: 0x4470 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884] |
[**] [1:970:5] WEB-IIS multiple decode attempt [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:21:56.229339 24.127.15.16:4707 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:45035 IpLen:20 DgmLen:138 DF ***AP*** Seq: 0x670E594E Ack: 0xB01FB5B7 Win: 0x4470 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333] |
[**] [1:970:5] WEB-IIS multiple decode attempt [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:21:56.597546 24.127.15.16:4741 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:45115 IpLen:20 DgmLen:136 DF ***AP*** Seq: 0x672825F5 Ack: 0xB007769D Win: 0x4470 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333] |
[**] [1:970:5] WEB-IIS multiple decode attempt [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:21:59.579579 24.127.15.16:4741 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:45605 IpLen:20 DgmLen:136 DF ***AP*** Seq: 0x672825F5 Ack: 0xB007769D Win: 0x4470 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333] |
[**] [1:970:5] WEB-IIS multiple decode attempt [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:22:00.120048 24.127.15.16:4978 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:45722 IpLen:20 DgmLen:140 DF ***AP*** Seq: 0x67E304AD Ack: 0xB10DB3EA Win: 0x4470 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333] |
[**] [1:1002:5] WEB-IIS cmd.exe access [**] [Classification: Web Application Attack] [Priority: 1] 05/24-03:22:00.470128 24.127.15.16:1028 -> 192.168.1.6:80 TCP TTL:106 TOS:0x0 ID:45788 IpLen:20 DgmLen:136 DF ***AP*** Seq: 0x67F516FE Ack: 0xB0903ECD Win: 0x4470 TcpLen: 20 |
[**] [1:1243:8] WEB-IIS ISAPI .ida attempt [**] [Classification: Web Application Attack] [Priority: 1] 05/30-01:21:21.559250 24.127.15.16:2752 -> 192.168.1.6:80 TCP TTL:102 TOS:0x0 ID:1731 IpLen:20 DgmLen:1500 DF ***A**** Seq: 0x819C474D Ack: 0x673B6DD3 Win: 0x4470 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2000-0071][Xref => http://www.securityfocus.com/bid/1065][Xref => http://www.whitehats.com/info/IDS552] |
[**] [1:1002:5] WEB-IIS cmd.exe access [**] [Classification: Web Application Attack] [Priority: 1] 05/30-01:21:21.560282 24.127.15.16:2752 -> 192.168.1.6:80 TCP TTL:102 TOS:0x0 ID:1732 IpLen:20 DgmLen:1500 DF ***A**** Seq: 0x819C4D01 Ack: 0x673B6DD3 Win: 0x4470 TcpLen: 20 |