Security Incidents mailing list archives

Odd attack string

From: Jack Bristow <morriswurm () yahoo com>
Date: 4 May 2004 15:31:32 -0000




We've picked up on a few URL strings here that are obviously BO's.
I researched in order to try and identify what the offensive program may be but I have had no luck. Has anyone else 
seen anything like the following?

Random Source IP:Random Source Port -> Random Dest IP:Port 80
URL:/&#65533;.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.

Thanks

- Jack

---------------------------------------------------------------------------
----------------------------------------------------------------------------

Current thread:

Odd attack string Jack Bristow (May 04)
- Re: Odd attack string Jose Nazario (May 04)
- <Possible follow-ups>
- RE: Odd attack string Levinson, Karl (May 04)