[Silicon Defense logo]

SnortSnarf alert page

Source: 24.98.61.177

SnortSnarf v021111.1

Signature section (91123)Top 20 source IPsTop 20 dest IPs

18 such alerts found using input module SnortFileInput, with sources:
Earliest: 13:44:46.218782 on 05/27/2003
Latest: 13:45:40.745121 on 05/27/2003

6 different signatures are present for 24.98.61.177 as a source

There are 1 distinct destination IPs in the alerts of the type on this page.

24.98.61.177 Whois lookup at: ARIN RIPE APNIC Geektools
DNS lookup at: Amenesi TRIUMF Princeton
More lookup links: Dshield Sam Spade

[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:44:46.218782 24.98.61.177:3326 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:65093 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0xBEAF555A Ack: 0x9F35F1AE Win: 0xFAF0 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:44:49.166705 24.98.61.177:3326 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:65320 IpLen:20 DgmLen:112 DF
***AP*** Seq: 0xBEAF555A Ack: 0x9F35F1AE Win: 0xFAF0 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1256:7] WEB-IIS CodeRed v2 root.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:44:50.377408 24.98.61.177:3383 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:65418 IpLen:20 DgmLen:110 DF
***AP*** Seq: 0xBEECC591 Ack: 0x9F84A85B Win: 0xFAF0 TcpLen: 20
[Xref => http://www.cert.org/advisories/CA-2001-19.html]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:44:54.378349 24.98.61.177:3457 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:207 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0xBF35E404 Ack: 0xA016A8A7 Win: 0xFAF0 TcpLen: 20
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:44:54.829876 24.98.61.177:3468 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:260 IpLen:20 DgmLen:120 DF
***AP*** Seq: 0xBF3FBE95 Ack: 0xA01B90C3 Win: 0xFAF0 TcpLen: 20
[**] [1:1945:1] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:44:55.356659 24.98.61.177:3480 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:296 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0xBF4A9635 Ack: 0xA023C32F Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1288:5] WEB-FRONTPAGE /_vti_bin/ access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
05/27-13:44:55.750041 24.98.61.177:3486 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:341 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0xBF50E7A6 Ack: 0xA072FBCD Win: 0xFAF0 TcpLen: 20
[**] [1:1286:5] WEB-IIS _mem_bin access [**]
[Classification: access to a potentially vulnerable web application] [Priority: 2]
05/27-13:44:56.130319 24.98.61.177:3497 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:388 IpLen:20 DgmLen:157 DF
***AP*** Seq: 0xBF599490 Ack: 0xA05E9DCD Win: 0xFAF0 TcpLen: 20
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:44:56.656255 24.98.61.177:3506 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:435 IpLen:20 DgmLen:185 DF
***AP*** Seq: 0xBF62129E Ack: 0xA005876E Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:982:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:45:06.661085 24.98.61.177:3642 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:1071 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xBFEF3A2E Ack: 0xA0C9AE15 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:45:07.220585 24.98.61.177:3650 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:1123 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xBFF6E3AB Ack: 0xA156EC6F Win: 0xFAF0 TcpLen: 20
[**] [1:981:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:45:07.979331 24.98.61.177:3659 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:1185 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xBFFFFEB2 Ack: 0xA0FAE8F0 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:983:6] WEB-IIS unicode directory traversal attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:45:12.044754 24.98.61.177:3674 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:1487 IpLen:20 DgmLen:137 DF
***AP*** Seq: 0xC00E055E Ack: 0xA168492A Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0884]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:45:22.084878 24.98.61.177:3903 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:2294 IpLen:20 DgmLen:138 DF
***AP*** Seq: 0xC0EF5580 Ack: 0xA1BF3024 Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:45:22.917036 24.98.61.177:3909 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:2354 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0xC0F55F14 Ack: 0xA1F3F65B Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:45:25.849459 24.98.61.177:3909 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:2568 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0xC0F55F14 Ack: 0xA1F3F65B Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:970:5] WEB-IIS multiple decode attempt [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:45:27.176903 24.98.61.177:3975 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:2667 IpLen:20 DgmLen:140 DF
***AP*** Seq: 0xC136709A Ack: 0xA1E553EC Win: 0xFAF0 TcpLen: 20
[Xref => http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0333]
[**] [1:1002:5] WEB-IIS cmd.exe access [**]
[Classification: Web Application Attack] [Priority: 1]
05/27-13:45:40.745121 24.98.61.177:4135 -> 192.168.1.6:80
TCP TTL:111 TOS:0x0 ID:3562 IpLen:20 DgmLen:136 DF
***AP*** Seq: 0xC1D3135A Ack: 0xA310FD9C Win: 0xFAF0 TcpLen: 20
SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:09:28 2003