Re: dos commands via iis 4 (TFTP)

[Lincoln Yeoh <lyeoh () POP JARING MY>]

At 02:01 PM 15-11-2000 +0100, Bluefish (P.Magnusson) wrote:
> An more reliable attack though, would be to download and execute a client
> which connects to www.attacker.com:80, only port 80 won't be running a
> webserver but a server for the client.

> That way it will overcome more firewalls; only an application level
> firewall or a closed DMZ would cause problems, where as the attack you
> describe rely on some server port not being firewalled.

Yep. That could work. One more reason to not allow anything out
transparently - make the hacker work a bit harder to sniff out which is the
web proxy and if there are any passwords which need to be used (I believe
IE's autocomplete makes that part easier though :) ).

Cheerio,
Link.