Re: www.google.com reference in directory-traversal attack

From: sa7ori (sa7oriat_private)
Date: Sun Jul 27 2003 - 18:03:24 PDT

  • Next message: Remko Lodder: "Re: [security-elvandar] "access_log?hello" ?" 

    posts like that you should be wary of.



---
"The strong give up and move on, while the weak give up and stay."
---

On Fri, 25 Jul 2003, Jason Falciola wrote:

> On 14 Jul 2003 17:35:36 -0000, sgt_b <sgt_b2002at_private> wrote:
> >
> >
> > I've included a link to a tcpdump taken that shows a standard IIS
> > directory-traversal attack. I was looking over the packets and noticed a
>
> > reference to www.google.com. Could someone take a look, and let me know
> > what this is being used for?
> >
> > http://12.208.102.165/attack3.dump
> > atack3.dump=1.6kb
>
> Anyone have a copy of the tcpdump file?  The link is dead.
>
> Thanks!
>
> Jason Falciola
> Security Intelligence Analyst
> IBM Managed Security Services
> falciolaat_private
>
> ---------------------------------------------------------------------------
> ----------------------------------------------------------------------------
>

---------------------------------------------------------------------------
----------------------------------------------------------------------------

    This archive was generated by hypermail 2b30 : Mon Jul 28 2003 - 10:08:38 PDT