Re: www.google.com reference in directory-traversal attack

From: Jason Falciola (falciolaat_private)
Date: Fri Jul 25 2003 - 10:44:05 PDT

  • Next message: Rodrigo Barbosa: "Re: Scan of TCP 552-554" 

    On 14 Jul 2003 17:35:36 -0000, sgt_b <sgt_b2002at_private> wrote:
> 
> 
> I've included a link to a tcpdump taken that shows a standard IIS 
> directory-traversal attack. I was looking over the packets and noticed a 

> reference to www.google.com. Could someone take a look, and let me know 
> what this is being used for?
> 
> http://12.208.102.165/attack3.dump
> atack3.dump=1.6kb

Anyone have a copy of the tcpdump file?  The link is dead.

Thanks!

Jason Falciola
Security Intelligence Analyst
IBM Managed Security Services
falciolaat_private

---------------------------------------------------------------------------
----------------------------------------------------------------------------

    This archive was generated by hypermail 2b30 : Sun Jul 27 2003 - 11:11:40 PDT