[Silicon Defense logo]

SnortSnarf alert page

Source: 24.166.119.88

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

19 such alerts found using input module SnortFileInput, with sources:
Earliest: 17:10:27.110047 on 04/22/2003
Latest: 17:11:37.184371 on 04/22/2003

6 different signatures are present for 24.166.119.88 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

24.166.119.88 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:10:27.110047 24.166.119.88:4711 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:59357 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0x95CC79E9 Ack: 0x610E2DCB Win: 0x4470 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:10:30.008864 24.166.119.88:4711 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:59757 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0x95CC79E9 Ack: 0x610E2DCB Win: 0x4470 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:10:31.640088 24.166.119.88:4881 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:59975 IpLen:20 DgmLen:110 DF
***AP*** Seq: 0x9631B885 Ack: 0x614D2473 Win: 0x4470 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:10:34.416211 24.166.119.88:4881 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:60385 IpLen:20 DgmLen:110 DF
***AP*** Seq: 0x9631B885 Ack: 0x614D2473 Win: 0x4470 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:10:40.236902 24.166.119.88:1105 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:61165 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x96AAE47E Ack: 0x61A7F760 Win: 0x4470 TcpLen: 20
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:10:42.483298 24.166.119.88:1250 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:61500 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x972A0DAB Ack: 0x61D42A39 Win: 0x4470 TcpLen: 20
[**] [1:1945:1] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:10:47.900496 24.166.119.88:1391 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:62250 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x97A3541B Ack: 0x624942AF Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1288:5] WEB-FRONTPAGE /_vti_bin/ access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/22-17:10:53.061106 24.166.119.88:1530 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:63013 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0x981F2A35 Ack: 0x633C1F98 Win: 0x4470 TcpLen: 20
[**] [1:1286:5] WEB-IIS _mem_bin access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/22-17:11:01.494021 24.166.119.88:1658 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:64144 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0x98900F25 Ack: 0x63B59957 Win: 0x4470 TcpLen: 20
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:11:03.727724 24.166.119.88:1798 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:64467 IpLen:20 DgmLen:185 DF
***AP*** Seq: 0x9909F8AC Ack: 0x63E18D67 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:11:05.984677 24.166.119.88:1860 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:64769 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x993E23A1 Ack: 0x640D527C Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:11:08.149118 24.166.119.88:1917 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:65078 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x996FBE5A Ack: 0x640FAF7C Win: 0x4470 TcpLen: 20
[**] [1:981:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:11:13.857077 24.166.119.88:2053 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:289 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x99E78BB8 Ack: 0x6418E411 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:981:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:11:16.659155 24.166.119.88:2053 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:639 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x99E78BB8 Ack: 0x6418E411 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:983:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:11:25.620384 24.166.119.88:2329 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:1698 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x9ADFD8EE Ack: 0x651BBA68 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:11:28.286069 24.166.119.88:2397 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:2002 IpLen:20 DgmLen:138 DF
***AP*** Seq: 0x9B1AC410 Ack: 0x64891FFA Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:11:31.413942 24.166.119.88:2466 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:2355 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x9B597242 Ack: 0x64FCF676 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:11:34.545525 24.166.119.88:2539 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:2733 IpLen:20 DgmLen:140 DF
***AP*** Seq: 0x9B9A4372 Ack: 0x656422A4 Win: 0x4470 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/22-17:11:37.184371 24.166.119.88:2618 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:3052 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x9BDB7D6A Ack: 0x65F7E03B Win: 0x4470 TcpLen: 20
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:09:28 2003