[Silicon Defense logo]

SnortSnarf alert page

Source: 24.166.45.37

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

32 such alerts found using input module SnortFileInput, with sources:
Earliest: 21:32:29.259416 on 04/25/2003
Latest: 18:00:37.655606 on 05/13/2003

6 different signatures are present for 24.166.45.37 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

24.166.45.37 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/25-21:32:29.259416 24.166.45.37:4192 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:34390 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0x547E6532 Ack: 0xFE08D073 Win: 0xFAF0 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/25-21:32:29.968374 24.166.45.37:4207 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:34479 IpLen:20 DgmLen:110 DF
***AP*** Seq: 0x548B341E Ack: 0xFE24D68D Win: 0xFAF0 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/25-21:32:30.100885 24.166.45.37:4213 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:34499 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x5490FF39 Ack: 0xFEB5BC6F Win: 0xFAF0 TcpLen: 20
[**] [1:1945:1] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/25-21:32:33.410431 24.166.45.37:4322 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:34955 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x54EDD015 Ack: 0xFF2FAB2E Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1288:5] WEB-FRONTPAGE /_vti_bin/ access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/25-21:32:36.790483 24.166.45.37:4437 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:35475 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0x554D0207 Ack: 0xFF567A7A Win: 0xFAF0 TcpLen: 20
[**] [1:1286:5] WEB-IIS _mem_bin access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
04/25-21:32:37.056029 24.166.45.37:4450 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:35518 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0x55587183 Ack: 0xFE97690A Win: 0xFAF0 TcpLen: 20
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/25-21:32:37.269161 24.166.45.37:4457 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:35553 IpLen:20 DgmLen:185 DF
***AP*** Seq: 0x555E3CBF Ack: 0xFF56B5FE Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/25-21:32:37.534041 24.166.45.37:4466 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:35597 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x556651DA Ack: 0xFEEAD929 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/25-21:32:46.920067 24.166.45.37:4823 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:36940 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x567A2B15 Ack: 0xFFE2F1EF Win: 0xFAF0 TcpLen: 20
[**] [1:981:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/25-21:32:56.285611 24.166.45.37:1272 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:38354 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x579D0938 Ack: 0xC763F Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:983:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/25-21:33:05.456680 24.166.45.37:1557 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:39473 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x5890FBDB Ack: 0x102472F Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/25-21:33:08.750029 24.166.45.37:1678 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:39978 IpLen:20 DgmLen:138 DF
***AP*** Seq: 0x58F2E471 Ack: 0xCE2F68 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/25-21:33:11.640309 24.166.45.37:1678 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:40382 IpLen:20 DgmLen:138 DF
***AP*** Seq: 0x58F2E471 Ack: 0xCE2F68 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/25-21:33:11.972219 24.166.45.37:1795 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:40431 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x5957E373 Ack: 0x125BF65 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
04/25-21:33:12.082739 24.166.45.37:1800 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:40449 IpLen:20 DgmLen:140 DF
***AP*** Seq: 0x595C3FF7 Ack: 0x10962D8 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
04/25-21:33:12.197662 24.166.45.37:1804 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:40465 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x595FBDF1 Ack: 0x194AF77 Win: 0xFAF0 TcpLen: 20
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/13-17:59:55.336283 24.166.45.37:1782 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:52672 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0x11D84304 Ack: 0x5582CDA5 Win: 0xFAF0 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/13-17:59:58.907389 24.166.45.37:1835 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:53039 IpLen:20 DgmLen:110 DF
***AP*** Seq: 0x120BB1E3 Ack: 0x555E2BD2 Win: 0xFAF0 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/13-17:59:59.030276 24.166.45.37:1839 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:53056 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x12100B18 Ack: 0x562625DD Win: 0xFAF0 TcpLen: 20
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/13-18:00:02.325938 24.166.45.37:1881 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:53382 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x1239E414 Ack: 0x557597BD Win: 0xFAF0 TcpLen: 20
[**] [1:1945:1] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/13-18:00:02.530306 24.166.45.37:1891 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:53412 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x1242E768 Ack: 0x5628C150 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1288:5] WEB-FRONTPAGE /_vti_bin/ access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
05/13-18:00:02.712228 24.166.45.37:1897 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:53436 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0x1247F510 Ack: 0x55FFA3A0 Win: 0xFAF0 TcpLen: 20
[**] [1:1286:5] WEB-IIS _mem_bin access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
05/13-18:00:11.927410 24.166.45.37:2021 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:54286 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0x12CA15DF Ack: 0x56374C37 Win: 0xFAF0 TcpLen: 20
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/13-18:00:12.022314 24.166.45.37:2024 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:54296 IpLen:20 DgmLen:185 DF
***AP*** Seq: 0x12CD2286 Ack: 0x567A4D7C Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/13-18:00:21.168664 24.166.45.37:2159 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:55176 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x1352A04B Ack: 0x56AF7B6D Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/13-18:00:21.294441 24.166.45.37:2162 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:55190 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x135593A5 Ack: 0x569B8757 Win: 0xFAF0 TcpLen: 20
[**] [1:981:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/13-18:00:21.442213 24.166.45.37:2163 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:55207 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x13573B56 Ack: 0x57727554 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:983:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/13-18:00:30.638534 24.166.45.37:2290 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:56053 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x13DAE846 Ack: 0x573145F8 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/13-18:00:33.973168 24.166.45.37:2340 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:56400 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x140C9C88 Ack: 0x57C47881 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/13-18:00:37.051269 24.166.45.37:2340 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:56686 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x140C9C88 Ack: 0x57C47881 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/13-18:00:37.387864 24.166.45.37:2389 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:56728 IpLen:20 DgmLen:140 DF
***AP*** Seq: 0x143F38EF Ack: 0x5787FFF3 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/13-18:00:37.655606 24.166.45.37:2398 -> 192.168.1.6:80
TCP TTL:119 TOS:0x0 ID:56768 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x1446DC76 Ack: 0x57C6744E Win: 0xFAF0 TcpLen: 20
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:03:53 2003