OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Odd attack string

From: Jack Bristow (morriswurmyahoo.com)
Date: Tue May 04 2004 - 10:31:32 CDT

We've picked up on a few URL strings here that are obviously BO's.
I researched in order to try and identify what the offensive program may be but I have had no luck. Has anyone else seen anything like the following?

Random Source IP:Random Source Port -> Random Dest IP:Port 80
URL:/�.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.±.

Thanks

- Jack

---------------------------------------------------------------------------
----------------------------------------------------------------------------