RE: New attack or old Vulnerability Scanner?

["James C. Slora, Jr." <James.Slora () fairfax phra com>]

Mark Embrich wrote Thursday, April 24, 2003 7:44 PM

> Does anyone recognize this pattern of a TCP connect scan, then 65 GETs?
> Note that it also included:  "User-Agent:.Mozilla/3.0.
> (compatible;.Indy.Library)...."

I don't know the tool, but I have seen a similar and possibly related scan before.
http://cert.uni-stuttgart.de/archive/intrusions/2002/07/msg00119.html

- Indy.Library in user-agent
- Nimda-like directory traversal attempts
- Looks for shell.exe and root.exe and cmd.exe

Mine appeared to come from a Windows box, so I don't think it's a NIX only tool.

----------------------------------------------------------------------------
Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the
world's premier event for IT and network security experts.  The two-day
Training features 6 hand-on courses on May 12-13 taught by professionals.
The two-day Briefings on May 14-15 features 24 top speakers with no vendor
sales pitches.  Deadline for the best rates is April 25.  Register today to
ensure your place. http://www.securityfocus.com/BlackHat-incidents
----------------------------------------------------------------------------