[Snort-users] DOUBLE DECODING ATTACK

Mark Sargent powderkeg at ...11462...
Mon Mar 28 21:50:36 EST 2005


Hi All,

what is a

> DOUBLE DECODING ATTACK

03/16-14:31:26.935885  [**] [119:2:1] (http_inspect) DOUBLE DECODING 
ATTACK [**]  {TCP} 192.168.0.12:34027 -> 64.4.55.109:80
found in Snort. The IP is msnhotmail. I imagine harmless, yes..? Cheers.

Mark Sargent.




More information about the Snort-users mailing list