SnortSnarf signature page

WEB-IIS unicode directory traversal attempt

SnortSnarf v021111.1

Signature section (91123)

Top 20 source IPs

Top 20 dest IPs

1500 alerts with this signature using input module SnortFileInput, with sources:

/home/rivettmj/snort_alertlog/alert

Earliest such alert at 19:49:23.127855 on 04/17/2003
Latest such alert at 04:47:05.780138 on 06/17/2003

WEB-IIS unicode directory traversal attempt	191 sources	1 destinations
Priority: 1	Classification: Web Application Attack
[sid:1945] [CVE:CVE-2000-0884]

Sources triggering this attack signature

Source	# Alerts (sig)	# Alerts (total)	# Dsts (sig)	# Dsts (total)
24.209.105.156	87	306	1	1
24.209.174.0	76	250	1	1
24.209.39.246	76	326	1	1
24.209.219.162	65	213	1	1
24.209.11.98	30	99	1	1
24.209.191.91	25	136	1	1
24.209.219.95	25	81	1	1
24.63.13.134	23	76	1	1
24.209.18.197	20	65	1	1
24.245.2.233	20	66	1	1
24.44.2.165	15	51	1	1
24.35.68.68	15	49	1	1
24.126.82.22	15	49	1	1
24.130.219.16	15	50	1	1
24.98.140.134	15	46	1	1
24.209.42.242	15	77	1	1
24.209.40.219	15	49	1	1
24.93.48.91	12	41	1	1
24.189.230.118	12	40	1	1
24.209.113.11	12	52	1	1
24.112.193.145	11	30	1	1
24.150.202.37	11	32	1	1
24.112.153.44	10	33	1	1
24.125.85.187	10	32	1	1
24.242.248.248	10	31	1	1
24.186.148.24	10	33	1	1
24.157.173.39	10	33	1	1
24.99.37.186	10	34	1	1
24.99.137.153	10	33	1	1
24.98.50.142	10	32	1	1
24.46.127.157	10	32	1	1
24.98.69.172	10	33	1	1
24.209.118.134	10	34	1	1
24.166.45.37	10	32	1	1
24.57.13.78	10	33	1	1
24.74.84.124	10	34	1	1
24.219.28.221	10	34	1	1
24.29.173.81	10	33	1	1
24.98.99.141	9	31	1	1
24.98.22.117	8	25	1	1
24.242.253.122	7	23	1	1
24.52.59.25	7	18	1	1
24.129.102.205	6	27	1	1
24.166.119.88	6	19	1	1
24.34.222.52	6	19	1	1
24.71.47.173	6	14	1	1
24.218.160.238	6	22	1	1
24.114.7.121	6	25	1	1
24.160.16.46	5	17	1	1
24.205.137.12	5	16	1	1
24.147.143.32	5	18	1	1
24.60.106.185	5	16	1	1
24.123.41.130	5	17	1	1
24.150.35.194	5	16	1	1
24.243.238.248	5	16	1	1
24.202.34.72	5	16	1	1
24.150.116.10	5	16	1	1
24.208.193.218	5	20	1	1
24.243.144.13	5	20	1	1
24.209.36.194	5	129	1	1
24.158.6.15	5	16	1	1
24.30.227.136	5	17	1	1
24.126.254.13	5	17	1	1
24.204.108.61	5	17	1	1
24.70.71.236	5	16	1	1
24.160.23.53	5	15	1	1
24.91.73.152	5	16	1	1
24.66.107.87	5	16	1	1
24.74.152.249	5	16	1	1
24.99.49.210	5	16	1	1
24.114.70.182	5	16	1	1
24.59.74.47	5	17	1	1
24.92.8.8	5	16	1	1
24.198.96.120	5	16	1	1
24.140.76.14	5	13	1	1
24.30.115.93	5	18	1	1
24.98.81.16	5	16	1	1
24.157.153.204	5	21	1	1
24.98.23.210	5	13	1	1
24.191.37.113	5	17	1	1
24.87.77.106	5	16	1	1
24.98.186.231	5	16	1	1
24.214.104.38	5	16	1	1
24.218.253.67	5	17	1	1
24.199.188.226	5	18	1	1
24.57.76.37	5	14	1	1
24.138.38.206	5	17	1	1
24.201.23.63	5	16	1	1
24.91.57.211	5	16	1	1
24.153.56.26	5	16	1	1
24.90.92.167	5	17	1	1
24.150.86.224	5	12	1	1
24.160.157.79	5	16	1	1
24.126.120.88	5	16	1	1
24.85.206.152	5	18	1	1
24.206.140.78	5	16	1	1
24.84.101.194	5	16	1	1
24.205.10.247	5	16	1	1
24.127.15.16	5	21	1	1
24.209.36.207	5	17	1	1
24.54.164.105	5	16	1	1
24.106.83.102	5	16	1	1
24.148.37.196	5	16	1	1
24.76.98.113	5	16	1	1
24.167.224.150	5	17	1	1
24.71.58.208	5	17	1	1
24.60.182.124	5	15	1	1
24.91.103.152	5	18	1	1
24.162.12.210	5	16	1	1
24.130.204.30	5	15	1	1
24.175.171.180	5	15	1	1
24.94.212.166	5	16	1	1
24.214.128.126	5	16	1	1
24.164.56.165	5	17	1	1
24.28.27.201	5	17	1	1
24.150.19.123	5	16	1	1
24.158.5.113	5	16	1	1
24.62.112.148	5	16	1	1
24.245.36.142	5	21	1	1
24.208.232.173	5	16	1	1
24.198.148.104	5	17	1	1
24.198.96.149	5	16	1	1
24.161.112.40	5	16	1	1
24.197.103.210	5	16	1	1
24.99.90.28	5	16	1	1
24.203.10.194	5	17	1	1
24.43.35.50	5	15	1	1
24.226.120.167	5	17	1	1
24.114.19.203	5	16	1	1
24.25.55.93	5	16	1	1
24.161.94.61	5	16	1	1
24.162.219.203	5	16	1	1
24.78.148.85	5	15	1	1
24.91.112.149	5	18	1	1
24.150.22.139	5	18	1	1
24.114.84.143	5	17	1	1
24.202.81.59	5	16	1	1
24.203.221.5	5	18	1	1
24.120.188.236	5	16	1	1
24.201.150.218	5	17	1	1
24.220.31.3	5	16	1	1
24.61.174.158	5	18	1	1
24.30.204.145	5	16	1	1
24.95.244.129	5	17	1	1
24.226.59.104	5	17	1	1
24.201.83.152	5	16	1	1
24.236.70.2	5	17	1	1
24.140.13.155	5	17	1	1
24.98.223.233	5	15	1	1
24.112.68.208	5	16	1	1
24.171.142.32	5	17	1	1
24.98.61.177	5	18	1	1
24.174.223.212	5	16	1	1
24.99.96.131	5	15	1	1
24.114.34.24	5	18	1	1
24.201.31.41	5	17	1	1
24.202.15.240	5	16	1	1
24.148.68.177	5	17	1	1
24.62.250.72	5	16	1	1
24.47.19.144	5	16	1	1
24.201.229.67	5	15	1	1
24.92.146.111	5	16	1	1
24.243.175.144	5	15	1	1
24.165.15.145	5	16	1	1
24.84.94.195	5	17	1	1
24.198.102.60	5	17	1	1
24.200.41.113	5	16	1	1
24.98.20.14	5	17	1	1
24.34.91.29	5	14	1	1
24.74.33.155	4	15	1	1
24.50.102.88	4	16	1	1
24.217.213.111	4	11	1	1
24.148.85.85	4	18	1	1
24.157.60.48	4	20	1	1
24.99.136.16	4	14	1	1
24.148.73.90	3	10	1	1
24.114.38.37	3	11	1	1
24.203.49.12	3	9	1	1
24.98.129.251	3	12	1	1
24.199.65.162	3	10	1	1
24.131.113.37	3	9	1	1
24.29.111.166	3	9	1	1
24.101.10.51	2	11	1	1
24.91.100.180	2	8	1	1
24.130.75.33	2	14	1	1
24.225.185.140	2	8	1	1
24.214.98.64	1	6	1	1
24.136.163.137	1	6	1	1
24.237.65.167	1	6	1	1
24.122.7.136	1	7	1	1
24.203.122.222	1	6	1	1

Destinations receiving this attack signature

Destinations	# Alerts (sig)	# Alerts (total)	# Srcs (sig)	# Srcs (total)
192.168.1.6	1500	7770	191	624

SnortSnarf brought to you courtesy of Silicon Defense
Authors: Jim Hoagland and Stuart Staniford
See also the Snort Page by Marty Roesch
Page generated at Tue Jun 17 09:03:48 2003