[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:46:24.710320 24.90.92.167:2662 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:26981 IpLen:20 DgmLen:112 DF ***AP*** Seq: 0xFDD12AF9 Ack: 0x78BCE363 Win: 0xFAF0 TcpLen: 20 [Xref => http://www.cert.org/advisories/CA-2001-19.html] |
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:46:27.554673 24.90.92.167:2662 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:27359 IpLen:20 DgmLen:112 DF ***AP*** Seq: 0xFDD12AF9 Ack: 0x78BCE363 Win: 0xFAF0 TcpLen: 20 [Xref => http://www.cert.org/advisories/CA-2001-19.html] |
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:46:39.539045 24.90.92.167:3137 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:29213 IpLen:20 DgmLen:110 DF ***AP*** Seq: 0xFF604087 Ack: 0x79241020 Win: 0xFAF0 TcpLen: 20 [Xref => http://www.cert.org/advisories/CA-2001-19.html] |
[**] [1:1002:5] WEB-IIS cmd.exe access [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:46:40.900891 24.90.92.167:3166 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:29401 IpLen:20 DgmLen:120 DF ***AP*** Seq: 0xFF7901A7 Ack: 0x798F9EB2 Win: 0xFAF0 TcpLen: 20 |
[**] [1:1002:5] WEB-IIS cmd.exe access [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:46:41.699426 24.90.92.167:3215 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:29544 IpLen:20 DgmLen:120 DF ***AP*** Seq: 0xFFA18674 Ack: 0x79402189 Win: 0xFAF0 TcpLen: 20 |
[**] [1:1945:1] WEB-IIS unicode directory traversal attempt [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:46:42.722772 24.90.92.167:3245 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:29676 IpLen:20 DgmLen:136 DF ***AP*** Seq: 0xFFBB34A3 Ack: 0x79ACD683 Win: 0xFAF0 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884] |
[**] [1:1288:5] WEB-FRONTPAGE /_vti_bin/ access [**] [Classification: access to a potentially vulnerable web application] [Priority: 2] 04/18-12:46:43.927089 24.90.92.167:3267 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:29844 IpLen:20 DgmLen:157 DF ***AP*** Seq: 0xFFCF5AF9 Ack: 0x7941F05F Win: 0xFAF0 TcpLen: 20 |
[**] [1:1286:5] WEB-IIS _mem_bin access [**] [Classification: access to a potentially vulnerable web application] [Priority: 2] 04/18-12:46:44.929229 24.90.92.167:3298 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:30000 IpLen:20 DgmLen:157 DF ***AP*** Seq: 0xFFEB591C Ack: 0x79A654EA Win: 0xFAF0 TcpLen: 20 |
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:46:45.844146 24.90.92.167:3340 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:30129 IpLen:20 DgmLen:185 DF ***AP*** Seq: 0xCD1AB Ack: 0x79C0CC77 Win: 0xFAF0 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884] |
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:46:50.501434 24.90.92.167:3459 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:30743 IpLen:20 DgmLen:137 DF ***AP*** Seq: 0x7056FB Ack: 0x79A09C4D Win: 0xFAF0 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884] |
[**] [1:1002:5] WEB-IIS cmd.exe access [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:46:51.173816 24.90.92.167:3505 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:30856 IpLen:20 DgmLen:137 DF ***AP*** Seq: 0x953D40 Ack: 0x79D2C1D2 Win: 0xFAF0 TcpLen: 20 |
[**] [1:981:6] WEB-IIS unicode directory traversal attempt [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:46:52.209702 24.90.92.167:3525 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:30986 IpLen:20 DgmLen:137 DF ***AP*** Seq: 0xA63932 Ack: 0x7A0FC3B1 Win: 0xFAF0 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884] |
[**] [1:983:6] WEB-IIS unicode directory traversal attempt [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:46:53.413176 24.90.92.167:3554 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:31147 IpLen:20 DgmLen:137 DF ***AP*** Seq: 0xBE5A55 Ack: 0x7991175C Win: 0xFAF0 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884] |
[**] [1:970:5] WEB-IIS multiple decode attempt [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:46:58.104873 24.90.92.167:3688 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:31762 IpLen:20 DgmLen:138 DF ***AP*** Seq: 0x1363AAE Ack: 0x7A6120D1 Win: 0xFAF0 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333] |
[**] [1:970:5] WEB-IIS multiple decode attempt [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:46:59.233080 24.90.92.167:3722 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:31931 IpLen:20 DgmLen:136 DF ***AP*** Seq: 0x153C827 Ack: 0x7A4C624D Win: 0xFAF0 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333] |
[**] [1:970:5] WEB-IIS multiple decode attempt [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:47:00.054099 24.90.92.167:3751 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:32092 IpLen:20 DgmLen:140 DF ***AP*** Seq: 0x16FC21C Ack: 0x7A74D200 Win: 0xFAF0 TcpLen: 20 [Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333] |
[**] [1:1002:5] WEB-IIS cmd.exe access [**] [Classification: Web Application Attack] [Priority: 1] 04/18-12:47:11.032799 24.90.92.167:4117 -> 192.168.1.6:80 TCP TTL:113 TOS:0x0 ID:33816 IpLen:20 DgmLen:136 DF ***AP*** Seq: 0x29D594C Ack: 0x7B5F8CA2 Win: 0xFAF0 TcpLen: 20 |