[Silicon Defense logo]

SnortSnarf alert page

Source: 24.91.73.152

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

16 such alerts found using input module SnortFileInput, with sources:
Earliest: 16:07:49.065250 on 06/06/2003
Latest: 16:08:10.115509 on 06/06/2003

6 different signatures are present for 24.91.73.152 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

24.91.73.152 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
06/06-16:07:49.065250 24.91.73.152:1345 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:45554 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0x74E67AE7 Ack: 0x39A10CCC Win: 0xB5C9 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
06/06-16:08:01.211646 24.91.73.152:1589 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46373 IpLen:20 DgmLen:110 DF
***AP*** Seq: 0x75CC7204 Ack: 0x3B2F74BA Win: 0xB5C9 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
06/06-16:08:01.375263 24.91.73.152:1591 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46386 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x75CE7113 Ack: 0x3AC5F57F Win: 0xB5C9 TcpLen: 20
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
06/06-16:08:01.551312 24.91.73.152:1594 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46405 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0x75D15567 Ack: 0x3B7C927F Win: 0xB5C9 TcpLen: 20
[**] [1:1945:1] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/06-16:08:01.732943 24.91.73.152:1598 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46424 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x75D438C9 Ack: 0x3B5FAD7A Win: 0xB5C9 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1288:5] WEB-FRONTPAGE /_vti_bin/ access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
06/06-16:08:01.916577 24.91.73.152:1601 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46442 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0x75D70EE4 Ack: 0x3B7CD727 Win: 0xB5C9 TcpLen: 20
[**] [1:1286:5] WEB-IIS _mem_bin access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
06/06-16:08:05.298992 24.91.73.152:1657 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46605 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0x760D4B37 Ack: 0x3BDADA95 Win: 0xB5C9 TcpLen: 20
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/06-16:08:05.443673 24.91.73.152:1660 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46620 IpLen:20 DgmLen:185 DF
***AP*** Seq: 0x7610BA09 Ack: 0x3C0E9690 Win: 0xB5C9 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/06-16:08:05.637330 24.91.73.152:1663 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46640 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x76134C19 Ack: 0x3C141422 Win: 0xB5C9 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
06/06-16:08:05.813236 24.91.73.152:1671 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46654 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x761A55C3 Ack: 0x3C34A966 Win: 0xB5C9 TcpLen: 20
[**] [1:981:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/06-16:08:05.978594 24.91.73.152:1674 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46669 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x761DC32A Ack: 0x3BCC9541 Win: 0xB5C9 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:983:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/06-16:08:06.190634 24.91.73.152:1677 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46686 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0x7620CDD7 Ack: 0x3BEC5C5C Win: 0xB5C9 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/06-16:08:09.622753 24.91.73.152:1721 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46798 IpLen:20 DgmLen:138 DF
***AP*** Seq: 0x764EAAAF Ack: 0x3BED0EB9 Win: 0xB5C9 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/06-16:08:09.775098 24.91.73.152:1723 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46803 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x76510B18 Ack: 0x3CB2CFB8 Win: 0xB5C9 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
06/06-16:08:09.954385 24.91.73.152:1726 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46816 IpLen:20 DgmLen:140 DF
***AP*** Seq: 0x7653C894 Ack: 0x3C0379BD Win: 0xB5C9 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
06/06-16:08:10.115509 24.91.73.152:1729 -> 192.168.1.6:80
TCP TTL:108 TOS:0x0 ID:46825 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0x7656EFBB Ack: 0x3BFEFC83 Win: 0xB5C9 TcpLen: 20
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:09:28 2003