[Snort-users] web iis attack

Alwin Raymundo alrayworld at ...131...
Fri Oct 25 04:55:03 EDT 2002


Hi Guys,

I got a massive attack from one IP doing something on
my one IIS server.  I already post it, some say that I
should look at the iss log files if they succeded
getting in or not.

Almost a week I puzzled my self because the snort
detect it and log the packets and everything while on
ISS log there is nothing. Absolutely nothing.

BTW, here are the sample logs in snort 
HEAD
/samples/check.bat/..%c1%1c..%c1%1c..%c1%1cwinnt/system32/cmd.exe?/c+dir?/c+dir+c:\
HTTP/1.0..Host: xxx.xx.xx.91

Is there any software or utilities that can do this?
let me know because I want to try it myself.

I need your help guys.

Thanks in Advance

Your brother in snort 

=====
Alwin Raymundo

__________________________________________________
Do you Yahoo!?
New DSL Internet Access from SBC & Yahoo!
http://sbc.yahoo.com




More information about the Snort-users mailing list