Security Incidents mailing list archives
Odd attack string
From: Jack Bristow <morriswurm () yahoo com>
Date: 4 May 2004 15:31:32 -0000
We've picked up on a few URL strings here that are obviously BO's. I researched in order to try and identify what the offensive program may be but I have had no luck. Has anyone else seen anything like the following? Random Source IP:Random Source Port -> Random Dest IP:Port 80 URL:/�.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±. Thanks - Jack --------------------------------------------------------------------------- ----------------------------------------------------------------------------
Current thread:
- Odd attack string Jack Bristow (May 04)
- Re: Odd attack string Jose Nazario (May 04)
- <Possible follow-ups>
- RE: Odd attack string Levinson, Karl (May 04)