# $Id: sid-msg.map,v 1.107.2.7 2003/04/07 17:26:55 cazz Exp $ # Format: SID || MSG || Optional References || Optional References ... # SID -> MSG map 103 || BACKDOOR subseven 22 || arachnids,485 || url,www.hackfix.org/subseven/ 104 || BACKDOOR - Dagger_1.4.0_client_connect || url,www.tlsecurity.net/backdoor/Dagger.1.4.html || arachnids,483 105 || BACKDOOR - Dagger_1.4.0 || arachnids,484 || url,www.tlsecurity.net/backdoor/Dagger.1.4.html 106 || BACKDOOR ACKcmdC trojan scan || arachnids,445 107 || BACKDOOR subseven DEFCON8 2.1 access 108 || BACKDOOR QAZ Worm Client Login access || MCAFEE,98775 109 || BACKDOOR netbus active || arachnids,401 110 || BACKDOOR netbus getinfo || arachnids,403 111 || BACKDOOR netbus getinfo || arachnids,403 112 || BACKDOOR BackOrifice access || arachnids,400 113 || BACKDOOR DeepThroat access || arachnids,405 114 || BACKDOOR netbus active || arachnids,401 115 || BACKDOOR netbus active || arachnids,401 116 || BACKDOOR BackOrifice access || arachnids,399 117 || BACKDOOR Infector.1.x || arachnids,315 118 || BACKDOOR SatansBackdoor.2.0.Beta || arachnids,316 119 || BACKDOOR Doly 2.0 access || arachnids,312 120 || BACKDOOR Infector 1.6 Server to Client 121 || BACKDOOR Infector 1.6 Client to Server Connection Request 122 || BACKDOOR DeepThroat 3.1 System Info Client Request || arachnids,106 124 || BACKDOOR DeepThroat 3.1 FTP Status Client Request || arachnids,106 125 || BACKDOOR DeepThroat 3.1 E-Mail Info From Server || arachnids,106 126 || BACKDOOR DeepThroat 3.1 E-Mail Info Client Request || arachnids,106 127 || BACKDOOR DeepThroat 3.1 Server Status From Server || arachnids,106 128 || BACKDOOR DeepThroat 3.1 Server Status Client Request || arachnids,106 129 || BACKDOOR DeepThroat 3.1 Drive Info From Server || arachnids,106 130 || BACKDOOR DeepThroat 3.1 System Info From Server || arachnids,106 131 || BACKDOOR DeepThroat 3.1 Drive Info Client Request || arachnids,106 132 || BACKDOOR DeepThroat 3.1 Server FTP Port Change From Server || arachnids,106 133 || BACKDOOR DeepThroat 3.1 Cached Passwords Client Request || arachnids,106 134 || BACKDOOR DeepThroat 3.1 RAS Passwords Client Request || arachnids,106 135 || BACKDOOR DeepThroat 3.1 Server Password Change Client Request || arachnids,106 136 || BACKDOOR DeepThroat 3.1 Server Password Remove Client Request || arachnids,106 137 || BACKDOOR DeepThroat 3.1 Rehash Client Request || arachnids,106 138 || BACKDOOR DeepThroat 3.1 Server Rehash Client Request || arachnids,106 140 || BACKDOOR DeepThroat 3.1 ICQ Alert OFF Client Request || arachnids,106 141 || BACKDOOR HackAttack 1.20 Connect 142 || BACKDOOR DeepThroat 3.1 ICQ Alert ON Client Request || arachnids,106 143 || BACKDOOR DeepThroat 3.1 Change Wallpaper Client Request || arachnids,106 144 || FTP ADMw0rm ftp login attempt || arachnids,01 145 || BACKDOOR GirlFriendaccess || arachnids,98 146 || BACKDOOR NetSphere access || arachnids,76 147 || BACKDOOR GateCrasher || arachnids,99 148 || BACKDOOR DeepThroat 3.1 Keylogger Active on Network || arachnids,106 149 || BACKDOOR DeepThroat 3.1 Client Sending Data to Server on Network || arachnids,106 150 || BACKDOOR DeepThroat 3.1 Server Active on Network || arachnids,106 151 || BACKDOOR DeepThroat 3.1 Client Sending Data to Server on Network || arachnids,106 152 || BACKDOOR BackConstruction 2.1 Connection 153 || BACKDOOR DonaldDick 1.53 Traffic 154 || BACKDOOR DeepThroat 3.1 Wrong Password || arachnids,106 155 || BACKDOOR NetSphere 1.31.337 access || arachnids,76 156 || BACKDOOR DeepThroat 3.1 Visible Window List Client Request || arachnids,106 157 || BACKDOOR BackConstruction 2.1 Client FTP Open Request 158 || BACKDOOR BackConstruction 2.1 Server FTP Open Reply 159 || BACKDOOR NetMetro File List || arachnids,79 161 || BACKDOOR Matrix 2.0 Client connect || arachnids,83 162 || BACKDOOR Matrix 2.0 Server access || arachnids,83 163 || BACKDOOR WinCrash 1.0 Server Active || arachnids,36 164 || BACKDOOR DeepThroat 3.1 Server Active on Network || arachnids,106 165 || BACKDOOR DeepThroat 3.1 Keylogger on Server ON || arachnids,106 166 || BACKDOOR DeepThroat 3.1 Show Picture Client Request || arachnids,106 167 || BACKDOOR DeepThroat 3.1 Hide/Show Clock Client Request || arachnids,106 168 || BACKDOOR DeepThroat 3.1 Hide/Show Desktop Client Request || arachnids,106 169 || BACKDOOR DeepThroat 3.1 Swap Mouse Buttons Client Request || arachnids,106 170 || BACKDOOR DeepThroat 3.1 Enable/Disable CTRL-ALT-DEL Client Request || arachnids,106 171 || BACKDOOR DeepThroat 3.1 Freeze Mouse Client Request || arachnids,106 172 || BACKDOOR DeepThroat 3.1 Show Dialog Box Client Request || arachnids,106 173 || BACKDOOR DeepThroat 3.1 Show Replyable Dialog Box Client Request || arachnids,106 174 || BACKDOOR DeepThroat 3.1 Hide/Show Start Button Client Request || arachnids,106 175 || BACKDOOR DeepThroat 3.1 Resolution Change Client Request || arachnids,106 176 || BACKDOOR DeepThroat 3.1 Hide/Show Start Button Client Request || arachnids,106 177 || BACKDOOR DeepThroat 3.1 Keylogger on Server OFF || arachnids,106 179 || BACKDOOR DeepThroat 3.1 FTP Server Port Client Request || arachnids,106 180 || BACKDOOR DeepThroat 3.1 Process List Client request || arachnids,106 181 || BACKDOOR DeepThroat 3.1 Close Port Scan Client Request || arachnids,106 182 || BACKDOOR DeepThroat 3.1 Registry Add Client Request || arachnids,106 183 || BACKDOOR SIGNATURE - Q ICMP || arachnids,202 184 || BACKDOOR Q access || arachnids,203 185 || BACKDOOR CDK || arachnids,263 186 || BACKDOOR DeepThroat 3.1 Monitor on/off Client Request || arachnids,106 187 || BACKDOOR DeepThroat 3.1 Delete File Client Request || arachnids,106 188 || BACKDOOR DeepThroat 3.1 Kill Window Client Request || arachnids,106 189 || BACKDOOR DeepThroat 3.1 Disable Window Client Request || arachnids,106 190 || BACKDOOR DeepThroat 3.1 Enable Window Client Request || arachnids,106 191 || BACKDOOR DeepThroat 3.1 Change Window Title Client Request || arachnids,106 192 || BACKDOOR DeepThroat 3.1 Hide Window Client Request || arachnids,106 193 || BACKDOOR DeepThroat 3.1 Show Window Client Request || arachnids,106 194 || BACKDOOR DeepThroat 3.1 Send Text to Window Client Request || arachnids,106 195 || BACKDOOR DeepThroat 3.1 Server Response || arachnids,106 196 || BACKDOOR DeepThroat 3.1 Hide/Show Systray Client Request || arachnids,106 197 || BACKDOOR DeepThroat 3.1 Create Directory Client Request || arachnids,106 198 || BACKDOOR DeepThroat 3.1 All Window List Client Request || arachnids,106 199 || BACKDOOR DeepThroat 3.1 Play Sound Client Request || arachnids,106 200 || BACKDOOR DeepThroat 3.1 Run Program Normal Client Request || arachnids,106 201 || BACKDOOR DeepThroat 3.1 Run Program Hidden Client Request || arachnids,106 202 || BACKDOOR DeepThroat 3.1 Get NET File Client Request || arachnids,106 203 || BACKDOOR DeepThroat 3.1 Find File Client Request || arachnids,106 204 || BACKDOOR DeepThroat 3.1 Find File Client Request || arachnids,106 205 || BACKDOOR DeepThroat 3.1 HUP Modem Client Request || arachnids,106 206 || BACKDOOR DeepThroat 3.1 CD ROM Open Client Request || arachnids,106 207 || BACKDOOR DeepThroat 3.1 CD ROM Close Client Request || arachnids,106 208 || BACKDOOR PhaseZero Server Active on Network 209 || BACKDOOR w00w00 attempt || arachnids,510 210 || BACKDOOR attempt 211 || BACKDOOR MISC r00t attempt 212 || BACKDOOR MISC rewt attempt 213 || BACKDOOR MISC linux rootkit attempt 214 || BACKDOOR MISC linux rootkit attempt lrkr0x 215 || BACKDOOR MISC linux rootkit attempt 216 || BACKDOOR MISC linux rootkit satori attempt || arachnids,516 217 || BACKDOOR MISC sm4ck attempt 218 || BACKDOOR MISC solaris 2.5 attempt 219 || BACKDOOR HidePak backdoor attempt 220 || BACKDOOR HideSource backdoor attempt 221 || DDOS TFN Probe || arachnids,443 222 || DDOS tfn2k icmp possible communication || arachnids,425 223 || DDOS Trin00\:DaemontoMaster(PONGdetected) || arachnids,187 224 || DDOS Stacheldraht server-spoof || arachnids,193 225 || DDOS Stacheldraht server-response-gag || arachnids,195 226 || DDOS Stacheldraht server-response || arachnids,191 227 || DDOS Stacheldraht client-spoofworks || arachnids,192 228 || DDOS TFN client command BE || arachnids,184 229 || DDOS Stacheldraht client-check || arachnids,190 230 || DDOS shaft client to handler || arachnids,254 231 || DDOS Trin00\:DaemontoMaster(messagedetected) || arachnids,186 232 || DDOS Trin00\:DaemontoMaster(*HELLO*detected) || arachnids,185 || url,www.sans.org/newlook/resources/IDFAQ/trinoo.htm 233 || DDOS Trin00\:Attacker to Master default startup password || arachnids,197 234 || DDOS Trin00 Attacker to Master default password 235 || DDOS Trin00 Attacker to Master default mdie password 236 || DDOS Stacheldraht client-check-gag || arachnids,194 237 || DDOS Trin00\:MastertoDaemon(defaultpassdetected!) || arachnids,197 238 || DDOS TFN server response || arachnids,182 239 || DDOS shaft handler to agent || arachnids,255 240 || DDOS shaft agent to handler || arachnids,256 241 || DDOS shaft synflood || arachnids,253 243 || DDOS mstream agent to handler 244 || DDOS mstream handler to agent || cve,CAN-2000-0138 245 || DDOS mstream handler ping to agent || cve,CAN-2000-0138 246 || DDOS mstream agent pong to handler 247 || DDOS mstream client to handler || cve,CAN-2000-0138 248 || DDOS mstream handler to client || cve,CAN-2000-0138 249 || DDOS mstream client to handler || arachnids,111 || cve,CAN-2000-0138 250 || DDOS mstream handler to client || cve,CAN-2000-0138 251 || DDOS - TFN client command LE || arachnids,183 253 || DNS SPOOF query response PTR with TTL\: 1 min. and no authority 254 || DNS SPOOF query response with ttl\: 1 min. and no authority 255 || DNS zone transfer TCP || cve,CAN-1999-0532 || arachnids,212 256 || DNS named authors attempt || nessus,10728 || arachnids,480 257 || DNS named version attempt || nessus,10028 || arachnids,278 258 || DNS EXPLOIT named 8.2->8.2.1 || cve,CVE-1999-0833 || bugtraq,788 259 || DNS EXPLOIT named overflow (ADM) || cve,CVE-1999-0833 || bugtraq,788 260 || DNS EXPLOIT named overflow (ADMROCKS) || cve,CVE-1999-0833 || url,www.cert.org/advisories/CA-1999-14.html || bugtraq,788 261 || DNS EXPLOIT named overflow attempt || url,www.cert.org/advisories/CA-1998-05.html 262 || DNS EXPLOIT x86 linux overflow attempt 264 || DNS EXPLOIT x86 linux overflow attempt 265 || DNS EXPLOIT x86 linux overflow attempt (ADMv2) 266 || DNS EXPLOIT x86 freebsd overflow attempt 267 || DNS EXPLOIT sparc overflow attempt 268 || DOS Jolt attack || cve,CAN-1999-0345 269 || DOS Land attack || cve,CVE-1999-0016 270 || DOS Teardrop attack || cve,CAN-1999-0015 || url,www.cert.org/advisories/CA-1997-28.html || bugtraq,124 271 || DOS UDP echo+chargen bomb || cve,CAN-1999-0635 || cve,CVE-1999-0103 272 || DOS IGMP dos attack || cve,CVE-1999-0918 273 || DOS IGMP dos attack || cve,CVE-1999-0918 274 || DOS ath || cve,CAN-1999-1228 || arachnids,264 275 || DOS NAPTHA || cve,CAN-2000-1039 || url,www.microsoft.com/technet/security/bulletin/MS00-091.asp || url,www.cert.org/advisories/CA-2000-21.html || url,razor.bindview.com/publish/advisories/adv_NAPTHA.html || bugtraq,2022 276 || DOS Real Audio Server || bugtraq,1288 || cve,CVE-2000-0474 || arachnids,411 277 || DOS Real Server template.html || cve,CVE-2000-0474 || bugtraq,1288 278 || DOS Real Server template.html || cve,CVE-2000-0474 || bugtraq,1288 279 || DOS Bay/Nortel Nautica Marlin || bugtraq,1009 || cve,CVE-2000-0221 281 || DOS Ascend Route || bugtraq,714 || cve,CVE-1999-0060 || arachnids,262 282 || DOS arkiea backup || bugtraq,662 || cve,CVE-1999-0788 || arachnids,261 283 || EXPLOIT netscape 4.7 client overflow || cve,CVE-2000-1187 || bugtraq,822 || arachnids,215 284 || POP2 x86 linux overflow 285 || POP2 x86 linux overflow 286 || POP3 EXPLOIT x86 bsd overflow 287 || POP3 EXPLOIT x86 bsd overflow 288 || POP3 EXPLOIT x86 linux overflow 289 || POP3 EXPLOIT x86 sco overflow 290 || POP3 EXPLOIT qpopper overflow || bugtraq,830 || cve,CAN-1999-0822 291 || NNTP Cassandra Overflow || cve,CAN-2000-0341 || arachnids,274 292 || EXPLOIT x86 linux samba overflow || bugtraq,1816 || cve,CVE-1999-0811 || cve,CVE-1999-0182 300 || EXPLOIT nlps x86 solaris overflow || bugtraq,2319 301 || EXPLOIT LPRng overflow || cve,CVE-2000-0917 || bugtraq,1712 302 || EXPLOIT redhat 7.0 lprd overflow 303 || DNS EXPLOIT named tsig overflow attempt || cve,CVE-2001-0010 || bugtraq,2302 || arachnids,482 304 || EXPLOIT sco calserver overflow || cve,CVE-2000-0306 || bugtraq,2353 305 || EXPLOIT delegate proxy overflow || arachnids,267 || bugtraq,808 || cve,CVE-2000-0165 306 || EXPLOIT VQServer admin || bugtraq,1610 || url,www.vqsoft.com/vq/server/docs/other/control.html || cve,CAN-2000-0766 307 || CHAT IRC EXPLOIT topic overflow || cve,CVE-1999-0672 || bugtraq,573 308 || EXPLOIT NextFTP client overflow || bugtraq,572 || cve,CVE-1999-0671 309 || EXPLOIT sniffit overflow || bugtraq,1158 || cve,CAN-2000-0343 || arachnids,273 310 || EXPLOIT x86 windows MailMax overflow || bugtraq,2312 || cve,CVE-1999-0404 311 || EXPLOIT netscape 4.7 unsucessful overflow || cve,CVE-2000-1187 || bugtraq,822 || arachnids,214 312 || EXPLOIT ntpdx overflow attempt || arachnids,492 || bugtraq,2540 313 || EXPLOIT ntalkd x86 linux overflow || bugtraq,210 314 || DNS EXPLOIT named tsig overflow attempt || cve,CVE-2001-0010 || bugtraq,2303 315 || EXPLOIT x86 linux mountd overflow || cve,CVE-1999-0002 || bugtraq,121 316 || EXPLOIT x86 linux mountd overflow || cve,CVE-1999-0002 || bugtraq,121 317 || EXPLOIT x86 linux mountd overflow || cve,CVE-1999-0002 || bugtraq,121 318 || EXPLOIT bootp x86 bsd overfow || bugtraq,324 || cve,CVE-1999-0914 319 || EXPLOIT bootp x86 linux overflow || cve,CVE-1999-0799 || cve,CAN-1999-0798 || cve,CAN-1999-0389 320 || FINGER cmd_rootsh backdoor attempt || nessus,10070 || cve,CAN-1999-0660 || url,www.sans.org/y2k/TFN_toolkit.htm || url,www.sans.org/y2k/fingerd.htm 321 || FINGER account enumeration attempt || nessus,10788 322 || FINGER search query || cve,CVE-1999-0259 || arachnids,375 323 || FINGER root query || arachnids,376 324 || FINGER null request || arachnids,377 325 || FINGER probe 0 attempt || arachnids,378 326 || FINGER remote command \; execution attempt || cve,CVE-1999-0150 || bugtraq,974 || arachnids,379 327 || FINGER remote command pipe execution attempt || cve,CVE-1999-0152 || bugtraq,2220 || arachnids,380 328 || FINGER bomb attempt || arachnids,381 || cve,CAN-1999-0106 329 || FINGER cybercop redirection || arachnids,11 330 || FINGER redirection attempt || nessus,10073 || arachnids,251 || cve,CAN-1999-0105 331 || FINGER cybercop query || arachnids,132 || cve,CVE-1999-0612 332 || FINGER 0 query || nessus,10069 || arachnids,378 || arachnids,131 || cve,CAN-1999-0197 333 || FINGER . query || nessus,10072 || arachnids,130 || cve,CAN-1999-0198 334 || FTP .forward || arachnids,319 335 || FTP .rhosts || arachnids,328 336 || FTP CWD ~root attempt || cve,CVE-1999-0082 || arachnids,318 337 || FTP CEL overflow attempt || bugtraq,679 || cve,CVE-1999-0789 || arachnids,257 353 || FTP adm scan || arachnids,332 354 || FTP iss scan || arachnids,331 355 || FTP pass wh00t || arachnids,324 356 || FTP passwd retreval attempt || arachnids,213 357 || FTP piss scan 358 || FTP saint scan || arachnids,330 359 || FTP satan scan || arachnids,329 360 || FTP serv-u directory transversal || bugtraq,2025 || cve,CVE-2001-0054 361 || FTP site exec || bugtraq,2241 || arachnids,317 362 || FTP tar parameters || bugtraq,2240 || arachnids,134 || cve,CVE-1999-0202 363 || ICMP IRDP router advertisement || bugtraq,578 || cve,CVE-1999-0875 || arachnids,173 364 || ICMP IRDP router selection || bugtraq,578 || cve,CVE-1999-0875 || arachnids,174 365 || ICMP PING (Undefined Code!) 366 || ICMP PING *NIX 368 || ICMP PING BSDtype || arachnids,152 369 || ICMP PING BayRS Router || arachnids,438 || arachnids,444 370 || ICMP PING BeOS4.x || arachnids,151 371 || ICMP PING Cisco Type.x || arachnids,153 372 || ICMP PING Delphi-Piette Windows || arachnids,155 373 || ICMP PING Flowpoint2200 or Network Management Software || arachnids,156 374 || ICMP PING IP NetMonitor Macintosh || arachnids,157 375 || ICMP PING LINUX/*BSD || arachnids,447 376 || ICMP PING Microsoft Windows || arachnids,159 377 || ICMP PING Network Toolbox 3 Windows || arachnids,161 378 || ICMP PING Ping-O-MeterWindows || arachnids,164 379 || ICMP PING Pinger Windows || arachnids,163 380 || ICMP PING Seer Windows || arachnids,166 381 || ICMP PING Sun Solaris || arachnids,448 382 || ICMP PING Windows || arachnids,169 384 || ICMP PING 385 || ICMP traceroute || arachnids,118 386 || ICMP Address Mask Reply 387 || ICMP Address Mask Reply (Undefined Code!) 388 || ICMP Address Mask Request 389 || ICMP Address Mask Request (Undefined Code!) 390 || ICMP Alternate Host Address 391 || ICMP Alternate Host Address (Undefined Code!) 392 || ICMP Datagram Conversion Error 393 || ICMP Datagram Conversion Error (Undefined Code!) 394 || ICMP Destination Unreachable (Destination Host Unknown) 395 || ICMP Destination Unreachable (Destination Network Unknown) 396 || ICMP Destination Unreachable (Fragmentation Needed and DF bit was set) 397 || ICMP Destination Unreachable (Host Precedence Violation) 398 || ICMP Destination Unreachable (Host Unreachable for Type of Service) 399 || ICMP Destination Unreachable (Host Unreachable) 400 || ICMP Destination Unreachable (Network Unreachable for Type of Service) 401 || ICMP Destination Unreachable (Network Unreachable) 402 || ICMP Destination Unreachable (Port Unreachable) 403 || ICMP Destination Unreachable (Precedence Cutoff in effect) 404 || ICMP Destination Unreachable (Protocol Unreachable) 405 || ICMP Destination Unreachable (Source Host Isolated) 406 || ICMP Destination Unreachable (Source Route Failed) 407 || ICMP Destination Unreachable (Undefined Code!) 408 || ICMP Echo Reply 409 || ICMP Echo Reply (Undefined Code!) 410 || ICMP Fragment Reassembly Time Exceeded 411 || ICMP IPV6 I-Am-Here 412 || ICMP IPV6 I-Am-Here (Undefined Code! 413 || ICMP IPV6 Where-Are-You 414 || ICMP IPV6 Where-Are-You (Undefined Code!) 415 || ICMP Information Reply 416 || ICMP Information Reply (Undefined Code!) 417 || ICMP Information Request 418 || ICMP Information Request (Undefined Code!) 419 || ICMP Mobile Host Redirect 420 || ICMP Mobile Host Redirect (Undefined Code!) 421 || ICMP Mobile Registration Reply 422 || ICMP Mobile Registration Reply (Undefined Code!) 423 || ICMP Mobile Registration Request 424 || ICMP Mobile Registration Request (Undefined Code! 425 || ICMP Parameter Problem (Bad Length) 426 || ICMP Parameter Problem (Missing a Requiered Option) 427 || ICMP Parameter Problem (Unspecified Error) 428 || ICMP Parameter Problem (Undefined Code!) 429 || ICMP Photuris (Reserved) 430 || ICMP Photuris (Unknown Security Parameters Index) 431 || ICMP Photuris (Valid Security Parameters, But Authentication Failed) 432 || ICMP Photuris (Valid Security Parameters, But Decryption Failed) 433 || ICMP Photuris (Undefined Code!) 436 || ICMP Redirect (for TOS and Host) 437 || ICMP Redirect (for TOS and Network) 438 || ICMP Redirect (Undefined Code!) 439 || ICMP Reserved for Security (Type 19) 440 || ICMP Reserved for Security (Type 19) (Undefined Code!) 441 || ICMP Router Advertisment || arachnids,173 443 || ICMP Router Selection || arachnids,174 445 || ICMP SKIP 446 || ICMP SKIP (Undefined Code! 448 || ICMP Source Quench (Undefined Code!) 449 || ICMP Time-To-Live Exceeded in Transit 450 || ICMP Time-To-Live Exceeded in Transit (Undefined Code!) 451 || ICMP Timestamp Reply 452 || ICMP Timestamp Reply (Undefined Code!) 453 || ICMP Timestamp Request 454 || ICMP Timestamp Request (Undefined Code!) 455 || ICMP Traceroute ipopts || arachnids,238 456 || ICMP Traceroute 457 || ICMP Traceroute (Undefined Code!) 458 || ICMP Unassigned! (Type 1) 459 || ICMP Unassigned! (Type 1) (Undefined Code) 460 || ICMP Unassigned! (Type 2) 461 || ICMP Unassigned! (Type 2) (Undefined Code) 462 || ICMP Unassigned! (Type 7) 463 || ICMP Unassigned! (Type 7) (Undefined Code!) 465 || ICMP ISS Pinger || arachnids,158 466 || ICMP L3retriever Ping || arachnids,311 467 || ICMP Nemesis v1.1 Echo || arachnids,449 469 || ICMP PING NMAP || arachnids,162 471 || ICMP icmpenum v1.1.1 || arachnids,450 472 || ICMP redirect host || arachnids,135 || cve,CVE-1999-0265 473 || ICMP redirect net || arachnids,199 || cve,CVE-1999-0265 474 || ICMP superscan echo 475 || ICMP traceroute ipopts || arachnids,238 476 || ICMP webtrends scanner || arachnids,307 477 || ICMP Source Quench 478 || ICMP Broadscan Smurf Scanner 480 || ICMP PING speedera 481 || ICMP TJPingPro1.1Build 2 Windows || arachnids,167 482 || ICMP PING WhatsupGold Windows || arachnids,168 483 || ICMP PING CyberKit 2.2 Windows || arachnids,154 484 || ICMP PING Sniffer Pro/NetXRay network scan 485 || ICMP Destination Unreachable (Communication Administratively Prohibited) 486 || ICMP Destination Unreachable (Communication with Destination Host is Administratively Prohibited) 487 || ICMP Destination Unreachable (Communication with Destination Network is Administratively Prohibited) 488 || INFO Connection Closed MSG from Port 80 489 || INFO FTP No Password || arachnids,322 490 || INFO battle-mail traffic 491 || FTP Bad login 492 || TELNET Bad Login 493 || INFO psyBNC access 494 || ATTACK RESPONSES command completed 495 || ATTACK RESPONSES command error 496 || ATTACK RESPONSES directory listing 497 || ATTACK RESPONSES file copied ok 498 || ATTACK RESPONSES id check returned root 499 || ICMP Large ICMP Packet || arachnids,246 500 || MISC source route lssr || bugtraq,646 || cve,CVE-1999-0909 || arachnids,418 501 || MISC source route lssre || bugtraq,646 || cve,CVE-1999-0909 || arachnids,420 502 || MISC source route ssrr || arachnids,422 503 || MISC Source Port 20 to <1024 || arachnids,06 504 || MISC source port 53 to <1024 || arachnids,07 505 || MISC Insecure TIMBUKTU Password || arachnids,229 506 || MISC ramen worm incoming || arachnids,460 507 || MISC PCAnywhere Attempted Administrator Login 508 || MISC gopher proxy || arachnids,409 509 || WEB-MISC PCCS mysql database admin tool access || arachnids,300 510 || POLICY HP JetDirect LCD modification attempt || bugtraq,2245 || arachnids,302 511 || MISC Invalid PCAnywhere Login 512 || MISC PCAnywhere Failed Login || arachnids,240 513 || MISC Cisco Catalyst Remote Access || arachnids,129 || cve,CVE-1999-0430 514 || MISC ramen worm || arachnids,461 516 || MISC SNMP NT UserList 517 || MISC xdmcp query || arachnids,476 518 || TFTP Put || cve,CVE-1999-0183 || arachnids,148 519 || TFTP parent directory || cve,CAN-2002-1209 || arachnids,137 || cve,CVE-1999-0183 520 || TFTP root directory || arachnids,138 || cve,CVE-1999-0183 521 || MISC Large UDP Packet || arachnids,247 522 || MISC Tiny Fragments 523 || BAD TRAFFIC ip reserved bit set 524 || BAD TRAFFIC tcp port 0 traffic 525 || BAD TRAFFIC udp port 0 traffic || cve,CVE-1999-0675 || nessus,10074 526 || BAD TRAFFIC data in TCP SYN packet || url,www.cert.org/incident_notes/IN-99-07.html 527 || BAD TRAFFIC same SRC/DST || cve,CVE-1999-0016 || url,www.cert.org/advisories/CA-1997-28.html 528 || BAD TRAFFIC loopback traffic || url,rr.sans.org/firewall/egress.php 529 || NETBIOS DOS RFPoison || arachnids,454 530 || NETBIOS NT NULL session || bugtraq,1163 || cve,CVE-2000-0347 || arachnids,204 532 || NETBIOS SMB ADMIN$access || arachnids,340 533 || NETBIOS SMB C$ access || arachnids,339 534 || NETBIOS SMB CD.. || arachnids,338 535 || NETBIOS SMB CD... || arachnids,337 536 || NETBIOS SMB D$access || arachnids,336 537 || NETBIOS SMB IPC$access || arachnids,335 538 || NETBIOS SMB IPC$access || arachnids,334 539 || NETBIOS Samba clientaccess || arachnids,341 540 || CHAT MSN chat access 541 || CHAT ICQ access 542 || CHAT IRC nick change 543 || FTP \"STOR 1MB\" possible warez site 544 || FTP \"RETR 1MB\" possible warez site 545 || FTP \"CWD /\" possible warez site 546 || FTP \"CWD \" possible warez site 547 || FTP \"MKD \" possible warez site 548 || FTP \"MKD . \" possible warez site 549 || P2P napster login 550 || P2P napster new user login 551 || P2P napster download attempt 552 || P2P napster upload request 553 || POLICY FTP anonymous login attempt 554 || FTP \"MKD / \" possible warez site 555 || POLICY WinGate telnet server response || arachnids,366 || cve,CAN-1999-0657 556 || P2P Outbound GNUTella client request 557 || P2P GNUTella client request 558 || INFO Outbound GNUTella client request 559 || P2P Inbound GNUTella client request 560 || POLICY VNC server response 561 || P2P Napster Client Data 562 || P2P Napster Client Data 563 || P2P Napster Client Data 564 || P2P Napster Client Data 565 || P2P Napster Server Login 566 || POLICY PCAnywhere server response || arachnids,239 567 || POLICY SMTP relaying denied || url,mail-abuse.org/tsi/ar-fix.html || arachnids,249 568 || POLICY HP JetDirect LCD modification attempt || bugtraq,2245 || arachnids,302 569 || RPC snmpXdmi overflow attempt || bugtraq,2417 || cve,CAN-2001-0236 || url,www.cert.org/advisories/CA-2001-05.html 572 || RPC DOS ttdbserv solaris || bugtraq,122 || arachnids,241 || cve,CVE-1999-0003 574 || RPC mountd TCP export request || arachnids,26 575 || RPC portmap request admind || arachnids,18 576 || RPC portmap request amountd || arachnids,19 577 || RPC portmap request bootparam || cve,CAN-1999-0647 || arachnids,16 578 || RPC portmap request cmsd || arachnids,17 579 || RPC portmap request mountd || arachnids,13 580 || RPC portmap request nisd || arachnids,21 581 || RPC portmap request pcnfsd || arachnids,22 582 || RPC portmap request rexd || arachnids,23 583 || RPC portmap request rstatd || arachnids,10 584 || RPC portmap request rusers || cve,CVE-1999-0626 || arachnids,133 585 || RPC portmap request sadmind || arachnids,20 586 || RPC portmap request selection_svc || arachnids,25 587 || RPC portmap request status || arachnids,15 588 || RPC portmap request ttdbserv || cve,CVE-1999-0003 || cve,CVE-1999-0687 || cve,CAN-1999-1075 || cve,CAN-2001-0717 || url,www.cert.org/advisories/CA-2001-05.html || bugtraq,122 || arachnids,24 589 || RPC portmap request yppasswd || arachnids,14 590 || RPC portmap request ypserv || arachnids,12 591 || RPC portmap request ypupdated || arachnids,125 593 || RPC tcp portmap request snmpXdmi || cve,CAN-2001-0236 || url,www.cert.org/advisories/CA-2001-05.html || bugtraq,2417 595 || RPC portmap request espd || cve,CAN-2001-0331 598 || RPC portmap listing TCP 111 || arachnids,429 599 || RPC portmap listing TCP 32771 || arachnids,429 601 || RSERVICES rlogin LinuxNIS 602 || RSERVICES rlogin bin || arachnids,384 603 || RSERVICES rlogin echo++ || arachnids,385 604 || RSERVICES rsh froot || arachnids,386 605 || RSERVICES rlogin login failure || arachnids,393 606 || RSERVICES rlogin root || arachnids,389 607 || RSERVICES rsh bin || arachnids,390 608 || RSERVICES rsh echo + + || arachnids,388 609 || RSERVICES rsh froot || arachnids,387 610 || RSERVICES rsh root || arachnids,391 611 || RSERVICES rlogin login failure || arachnids,392 612 || RPC rusers query || cve,CVE-1999-0626 || arachnids,136 613 || SCAN myscan || arachnids,439 614 || BACKDOOR hack-a-tack attempt || arachnids,314 615 || SCAN SOCKS Proxy attempt || url,help.undernet.org/proxyscan/ 616 || SCAN ident version request || arachnids,303 618 || SCAN Squid Proxy attempt 619 || SCAN cybercop os probe || arachnids,146 620 || SCAN Proxy \(8080\) attempt 621 || SCAN FIN || arachnids,27 622 || SCAN ipEye SYN scan || arachnids,236 623 || SCAN NULL || arachnids,4 624 || SCAN SYN FIN || arachnids,198 625 || SCAN XMAS || arachnids,144 626 || SCAN cybercop os PA12 attempt || arachnids,149 627 || SCAN cybercop os SFU12 probe || arachnids,150 628 || SCAN nmap TCP || arachnids,28 629 || SCAN nmap fingerprint attempt || arachnids,05 630 || SCAN synscan portscan || arachnids,441 631 || SMTP ehlo cybercop attempt || arachnids,372 632 || SMTP expn cybercop attempt || arachnids,371 634 || SCAN Amanda client version request 635 || SCAN XTACACS logout || arachnids,408 636 || SCAN cybercop udp bomb || arachnids,363 637 || SCAN Webtrends Scanner UDP Probe || arachnids,308 638 || SHELLCODE SGI NOOP || arachnids,356 639 || SHELLCODE SGI NOOP || arachnids,357 640 || SHELLCODE aix NOOP 641 || SHELLCODE digital unix NOOP || arachnids,352 642 || SHELLCODE hpux NOOP || arachnids,358 643 || SHELLCODE hpux NOOP || arachnids,359 644 || SHELLCODE sparc NOOP || arachnids,345 645 || SHELLCODE sparc NOOP || arachnids,353 646 || SHELLCODE sparc NOOP || arachnids,355 647 || SHELLCODE sparc setuid 0 || arachnids,282 648 || SHELLCODE x86 NOOP || arachnids,181 649 || SHELLCODE x86 setgid 0 || arachnids,284 650 || SHELLCODE x86 setuid 0 || arachnids,436 651 || SHELLCODE x86 stealth NOOP || arachnids,291 652 || SHELLCODE linux shellcode || arachnids,343 653 || SHELLCODE x86 unicode NOOP 655 || SMTP sendmail 8.6.9 exploit || arachnids,140 || cve,CVE-1999-0204 656 || SMTP EXPLOIT x86 windows CSMMail overflow || bugtraq,895 || cve,CVE-2000-0042 658 || SMTP exchange mime DOS 659 || SMTP expn decode || arachnids,32 660 || SMTP expn root || arachnids,31 661 || SMTP majordomo ifs || cve,CVE-1999-0208 || arachnids,143 662 || SMTP sendmail 5.5.5 exploit || arachnids,119 663 || SMTP sendmail 5.5.8 overflow || arachnids,172 || cve,CVE-1999-0095 664 || SMTP RCPT TO decode attempt || arachnids,121 || cve,CVE-1999-0203 665 || SMTP sendmail 5.6.5 exploit || arachnids,122 666 || SMTP sendmail 8.4.1 exploit || arachnids,120 667 || SMTP sendmail 8.6.10 exploit || arachnids,123 668 || SMTP sendmail 8.6.10 exploit || arachnids,124 669 || SMTP sendmail 8.6.9 exploit || arachnids,142 || cve,CVE-1999-0204 670 || SMTP sendmail 8.6.9 exploit || cve,CVE-1999-0204 || arachnids,139 671 || SMTP sendmail 8.6.9c exploit || arachnids,141 || cve,CVE-1999-0204 672 || SMTP vrfy decode || arachnids,373 673 || MS-SQL sp_start_job - program execution 674 || MS-SQL xp_displayparamstmt possible buffer overflow || bugtraq,2030 || cve,CAN-2000-1081 675 || MS-SQL xp_setsqlsecurity possible buffer overflow || bugtraq,2043 676 || MS-SQL/SMB sp_start_job - program execution 677 || MS-SQL/SMB sp_password password change 678 || MS-SQL/SMB sp_delete_alert log file deletion 679 || MS-SQL/SMB sp_adduser database user creation 680 || MS-SQL/SMB sa login failed 681 || MS-SQL/SMB xp_cmdshell program execution 682 || MS-SQL xp_enumresultset possible buffer overflow 683 || MS-SQL sp_password - password change 684 || MS-SQL sp_delete_alert log file deletion 685 || MS-SQL sp_adduser - database user creation 686 || MS-SQL xp_reg* - registry access 687 || MS-SQL xp_cmdshell - program execution 688 || MS-SQL sa login failed 689 || MS-SQL/SMB xp_reg* registry access 690 || MS-SQL/SMB xp_printstatements possible buffer overflow || bugtraq,2041 || cve,CAN-2000-1086 691 || MS-SQL shellcode attempt 692 || MS-SQL/SMB shellcode attempt 693 || MS-SQL shellcode attempt 694 || MS-SQL/SMB shellcode attempt 695 || MS-SQL/SMB xp_sprintf possible buffer overflow || bugtraq,1204 696 || MS-SQL/SMB xp_showcolv possible buffer overflow || bugtraq,2038 697 || MS-SQL/SMB xp_peekqueue possible buffer overflow || bugtraq,2040 || cve,CAN-2000-1085 698 || MS-SQL/SMB xp_proxiedmetadata possible buffer overflow || bugtraq,2042 || cve,CAN-2000-1087 699 || MS-SQL xp_printstatements possible buffer overflow || bugtraq,2041 || cve,CAN-2000-1086 700 || MS-SQL/SMB xp_updatecolvbm possible buffer overflow || bugtraq,2039 || cve,CAN-2000-1084 701 || MS-SQL xp_updatecolvbm possible buffer overflow || bugtraq,2039 || cve,CAN-2000-1084 702 || MS-SQL/SMB xp_displayparamstmt possible buffer overflow || bugtraq,2030 || cve,CAN-2000-1081 703 || MS-SQL/SMB xp_setsqlsecurity possible buffer overflow || bugtraq,2043 704 || MS-SQL xp_sprintf possible buffer overflow || bugtraq,1204 705 || MS-SQL xp_showcolv possible buffer overflow || bugtraq,2038 || cve,CAN-2000-1083 706 || MS-SQL xp_peekqueue possible buffer overflow || bugtraq,2040 || cve,CAN-2000-1085 707 || MS-SQL xp_proxiedmetadata possible buffer overflow || bugtraq,2024 || cve,CAN-2000-1087 708 || MS-SQL/SMB xp_enumresultset possible buffer overflow || bugtraq,2031 || cve,CAN-2000-1082 709 || TELNET 4Dgifts SGI account attempt || cve,CAN-1999-0501 710 || TELNET EZsetup account attempt || cve,CAN-1999-0501 711 || TELNET SGI telnetd format bug || arachnids,304 712 || TELNET ld_library_path || cve,CVE-1999-0073 || arachnids,367 713 || TELNET livingston DOS || arachnids,370 714 || TELNET resolv_host_conf || arachnids,369 715 || TELNET Attempted SU from wrong group 716 || TELNET access || arachnids,08 || cve,CAN-1999-0619 717 || TELNET not on console || arachnids,365 718 || TELNET login incorrect || arachnids,127 719 || TELNET root login 720 || Virus - SnowWhite Trojan Incoming 721 || Virus - Possible pif Worm 722 || Virus - Possible NAVIDAD Worm 723 || Virus - Possible MyRomeo Worm 724 || Virus - Possible MyRomeo Worm 725 || Virus - Possible MyRomeo Worm 726 || Virus - Possible MyRomeo Worm 727 || Virus - Possible MyRomeo Worm 728 || Virus - Possible MyRomeo Worm 729 || Virus - Possible scr Worm 730 || Virus - Possible shs Worm 731 || Virus - Possible QAZ Worm || MCAFEE,98775 732 || Virus - Possible QAZ Worm Infection || MCAFEE,98775 733 || Virus - Possible QAZ Worm Calling Home || MCAFEE,98775 734 || Virus - Possible Matrix worm 735 || Virus - Possible MyRomeo Worm 736 || Virus - Successful eurocalculator execution 737 || Virus - Possible eurocalculator.exe file 738 || Virus - Possible Pikachu Pokemon Virus || MCAFEE,98696 739 || Virus - Possible Triplesix Worm || MCAFEE,10389 740 || Virus - Possible Tune.vbs || MCAFEE,10497 741 || Virus - Possible NAIL Worm || MCAFEE,10109 742 || Virus - Possible NAIL Worm || MCAFEE,10109 743 || Virus - Possible NAIL Worm || MCAFEE,10109 744 || Virus - Possible NAIL Worm || MCAFEE,10109 745 || Virus - Possible Papa Worm || MCAFEE,10145 746 || Virus - Possible Freelink Worm || MCAFEE,10225 747 || Virus - Possible Simbiosis Worm 748 || Virus - Possible BADASS Worm || MCAFEE,10388 749 || Virus - Possible ExploreZip.B Worm || MCAFEE,10471 751 || Virus - Possible wscript.KakWorm || MCAFEE,10509 752 || Virus Possible Suppl Worm || MCAFEE,10361 753 || Virus - Possible NewApt.Worm - theobbq.exe || MCAFEE,10540 754 || Virus - Possible Word Macro - VALE || MCAFEE,10502 755 || Virus - Possible IROK Worm || MCAFEE,98552 756 || Virus - Possible Fix2001 Worm || MCAFEE,10355 757 || Virus - Possible Y2K Zelu Trojan || MCAFEE,10505 758 || Virus - Possible The_Fly Trojan || MCAFEE,10478 759 || Virus - Possible Word Macro - VALE || MCAFEE,10502 760 || Virus - Possible Passion Worm || MCAFEE,10467 761 || Virus - Possible NewApt.Worm - cooler3.exe || MCAFEE,10540 762 || Virus - Possible NewApt.Worm - party.exe || MCAFEE,10540 763 || Virus - Possible NewApt.Worm - hog.exe || MCAFEE,10540 764 || Virus - Possible NewApt.Worm - goal1.exe || MCAFEE,10540 765 || Virus - Possible NewApt.Worm - pirate.exe || MCAFEE,10540 766 || Virus - Possible NewApt.Worm - video.exe || MCAFEE,10540 767 || Virus - Possible NewApt.Worm - baby.exe || MCAFEE,10540 768 || Virus - Possible NewApt.Worm - cooler1.exe || MCAFEE,10540 769 || Virus - Possible NewApt.Worm - boss.exe || MCAFEE,10540 770 || Virus - Possible NewApt.Worm - g-zilla.exe || MCAFEE,10540 771 || Virus - Possible ToadieE-mail Trojan || MCAFEE,10540 772 || Virus - Possible PrettyPark Trojan || MCAFEE,10175 773 || Virus - Possible Happy99 Virus || MCAFEE,10144 774 || Virus - Possible CheckThis Trojan 775 || Virus - Possible Bubbleboy Worm || MCAFEE,10418 776 || Virus - Possible NewApt.Worm - copier.exe || MCAFEE,10540 777 || Virus - Possible MyPics Worm || MCAFEE,10467 778 || Virus - Possible Babylonia - X-MAS.exe || MCAFEE,10461 779 || Virus - Possible NewApt.Worm - gadget.exe || MCAFEE,10540 780 || Virus - Possible NewApt.Worm - irnglant.exe || MCAFEE,10540 781 || Virus - Possible NewApt.Worm - casper.exe || MCAFEE,10540 782 || Virus - Possible NewApt.Worm - fborfw.exe || MCAFEE,10540 783 || Virus - Possible NewApt.Worm - saddam.exe || MCAFEE,10540 784 || Virus - Possible NewApt.Worm - bboy.exe || MCAFEE,10540 785 || Virus - Possible NewApt.Worm - monica.exe || MCAFEE,10540 786 || Virus - Possible NewApt.Worm - goal.exe || MCAFEE,10540 787 || Virus - Possible NewApt.Worm - panther.exe || MCAFEE,10540 788 || Virus - Possible NewApt.Worm - chestburst.exe || MCAFEE,10540 789 || Virus - Possible NewApt.Worm - farter.exe || MCAFEE,1054 790 || Virus - Possible Common Sense Worm 791 || Virus - Possible NewApt.Worm - cupid2.exe || MCAFEE,10540 792 || Virus - Possible Resume Worm || MCAFEE,98661 793 || Virus - Mail .VBS 794 || Virus - Possible Resume Worm || MCAFEE,98661 795 || Virus - Possible Worm - txt.vbs file 796 || Virus - Possible Worm - xls.vbs file 797 || Virus - Possible Worm - jpg.vbs file 798 || Virus - Possible Worm - gif.vbs file 799 || Virus - Possible Timofonica Worm || MCAFEE,98674 800 || Virus - Possible Resume Worm || MCAFEE,98661 801 || Virus - Possible Worm - doc.vbs file 802 || Virus - Possbile Zipped Files Trojan || MCAFEE,10450 803 || WEB-CGI HyperSeek hsx.cgi directory traversal attempt || bugtraq,2314 || cve,CAN-2001-0253 804 || WEB-CGI SWSoft ASPSeek Overflow attempt || cve,CAN-2001-0476 || bugtraq,2492 805 || WEB-CGI webspeed access || arachnids,467 || cve,CVE-2000-0127 || nessus,10304 806 || WEB-CGI yabb.cgi directory traversal attempt || cve,CVE-2000-0853 || arachnids,462 || bugtraq,1668 807 || WEB-CGI /wwwboard/passwd.txt access || arachnids,463 || cve,CVE-1999-0953 || nessus,10321 || bugtraq,649 808 || WEB-CGI webdriver access || arachnids,473 || bugtraq,2166 || nessus,10592 809 || WEB-CGI whois_raw.cgi arbitrary command execution attempt || cve,CAN-1999-1063 || arachnids,466 || nessus,10306 810 || WEB-CGI whois_raw.cgi access || cve,CAN-1999-1063 || arachnids,466 || nessus,10306 811 || WEB-CGI websitepro path access || cve,CAN-2000-0066 || arachnids,468 812 || WEB-CGI webplus version access || cve,CVE-2000-0282 || arachnids,470 813 || WEB-CGI webplus directory traversal || cve,CVE-2000-0282 || arachnids,471 815 || WEB-CGI websendmail access || cve,CVE-1999-0196 || arachnids,469 || bugtraq,2077 || nessus,10301 817 || WEB-CGI dcboard.cgi invalid user addition attempt || bugtraq,2728 818 || WEB-CGI dcforum.cgi access || bugtraq,2728 819 || WEB-CGI mmstdod.cgi access || cve,CVE-2001-0021 820 || WEB-CGI anaconda directory transversal attempt || cve,CVE-2000-0975 || bugtraq,2388 821 || WEB-CGI imagemap.exe overflow attempt || arachnids,412 || cve,CVE-1999-0951 823 || WEB-CGI cvsweb.cgi access || cve,CVE-2000-0670 || bugtraq,1469 824 || WEB-CGI php.cgi access || cve,CAN-1999-0238 || bugtraq,2250 || arachnids,232 825 || WEB-CGI glimpse access || bugtraq,2026 826 || WEB-CGI htmlscript access || bugtraq,2001 || cve,CVE-1999-0264 827 || WEB-CGI info2www access || bugtraq,1995 || cve,CVE-1999-0266 828 || WEB-CGI maillist.pl access 829 || WEB-CGI nph-test-cgi access || nessus,10165 || arachnids,224 || cve,CVE-1999-0045 || bugtraq,686 830 || WEB-CGI NPH-publish access || cve,CAN-1999-1177 832 || WEB-CGI perl.exe access || cve,CAN-1999-0509 || url,www.cert.org/advisories/CA-1996-11.html || arachnids,219 || nessus,10173 833 || WEB-CGI rguest.exe access || cve,CAN-1999-0467 || bugtraq,2024 834 || WEB-CGI rwwwshell.pl access || url,www.itsecurity.com/papers/p37.htm 835 || WEB-CGI test-cgi access || nessus,10282 || cve,CVE-1999-0070 || arachnids,218 836 || WEB-CGI textcounter.pl access || cve,CAN-1999-1479 837 || WEB-CGI uploader.exe access || cve,CVE-1999-0177 || nessus,10291 838 || WEB-CGI webgais access || arachnids,472 || bugtraq,2058 || cve,CVE-1999-0176 || nessus,10300 839 || WEB-CGI finger access || arachnids,221 || cve,CVE-1999-0612 || nessus,10071 840 || WEB-CGI perlshop.cgi access || cve,CAN-1999-1374 841 || WEB-CGI pfdisplay.cgi access || bugtraq,64 || cve,CVE-1999-0270 842 || WEB-CGI aglimpse access || nessus,10095 || cve,CVE-1999-0147 || bugtraq,2026 843 || WEB-CGI anform2 access || cve,CVE-1999-0066 || arachnids,225 844 || WEB-CGI args.bat access || cve,CAN-1999-1374 845 || WEB-CGI AT-admin.cgi access || cve,CAN-1999-1072 846 || WEB-CGI bnbform.cgi access || cve,CVE-1999-0937 || bugtraq,1469 847 || WEB-CGI campas access || cve,CVE-1999-0146 || bugtraq,1975 848 || WEB-CGI view-source directory traversal || cve,CVE-1999-0174 849 || WEB-CGI view-source access || cve,CVE-1999-0174 850 || WEB-CGI wais.pl access 851 || WEB-CGI files.pl access || cve,CAN-1999-1081 852 || WEB-CGI wguest.exe access || cve,CAN-1999-0467 || bugtraq,2024 853 || WEB-CGI wrap access || nessus,10317 || bugtraq,373 || arachnids,234 || cve,CVE-1999-0149 854 || WEB-CGI classifieds.cgi access || bugtraq,2020 || cve,CVE-1999-0934 855 || WEB-CGI edit.pl access || bugtraq,2713 856 || WEB-CGI environ.cgi access 857 || WEB-CGI faxsurvey access || cve,CVE-1999-0262 || bugtraq,2056 || nessus,10067 858 || WEB-CGI filemail access || cve,CAN-1999-1154 859 || WEB-CGI man.sh access || cve,CAN-1999-1179 860 || WEB-CGI snork.bat access || bugtraq,1053 || cve,CVE-2000-0169 || arachnids,220 861 || WEB-CGI w3-msql access || bugtraq,591 || cve,CVE-1999-0276 || arachnids,210 || nessus,10296 || cve,CVE-2000-0012 862 || WEB-CGI csh access || url,www.cert.org/advisories/CA-1996-11.html || cve,CAN-1999-0509 863 || WEB-CGI day5datacopier.cgi access || cve,CAN-1999-1232 864 || WEB-CGI day5datanotifier.cgi access || cve,CAN-1999-1232 865 || WEB-CGI ksh access || url,www.cert.org/advisories/CA-1996-11.html || cve,CAN-1999-0509 866 || WEB-CGI post-query access || cve,CAN-2001-0291 867 || WEB-CGI visadmin.exe access || bugtraq,1808 || cve,CAN-1999-1970 || nessus,10295 868 || WEB-CGI rsh access || cve,CAN-1999-0509 || url,www.cert.org/advisories/CA-1996-11.html 869 || WEB-CGI dumpenv.pl access || cve,CAN-1999-1178 870 || WEB-CGI snorkerz.cmd access 871 || WEB-CGI survey.cgi access || bugtraq,1817 || cve,CVE-1999-0936 872 || WEB-CGI tcsh access || url,www.cert.org/advisories/CA-1996-11.html || cve,CAN-1999-0509 873 || WEB-CGI scriptalias access || cve,CVE-1999-0236 || bugtraq,2300 || arachnids,227 874 || WEB-CGI w3-msql solaris x86 access || cve,CVE-1999-0276 || arachnids,211 875 || WEB-CGI win-c-sample.exe access || bugtraq,2078 || arachnids,231 || cve,CVE-1999-0178 || nessus,10008 877 || WEB-CGI rksh access || url,www.cert.org/advisories/CA-1996-11.html || cve,CAN-1999-0509 878 || WEB-CGI w3tvars.pm access 879 || WEB-CGI admin.pl access || url,online.securityfocus.com/archive/1/249355 || bugtraq,3839 880 || WEB-CGI LWGate access || url,www.netspace.org/~dwb/lwgate/lwgate-history.html || url,www.wiretrip.net/rfp/p/doc.asp/i2/d6.htm 881 || WEB-CGI archie access 882 || WEB-CGI calendar access 883 || WEB-CGI flexform access || url,www.wiretrip.net/rfp/p/doc.asp/i2/d6.htm 884 || WEB-CGI formmail access || nessus,10782 || nessus,10076 || bugtraq,1187 || cve,CVE-1999-0172 || arachnids,226 885 || WEB-CGI bash access || cve,CAN-1999-0509 || url,www.cert.org/advisories/CA-1996-11.html 886 || WEB-CGI phf access || bugtraq,629 || arachnids,128 || cve,CVE-1999-0067 887 || WEB-CGI www-sql access || url,marc.theaimsgroup.com/?l=bugtraq&m=88704258804054&w=2 888 || WEB-CGI wwwadmin.pl access 889 || WEB-CGI ppdscgi.exe access || bugtraq,491 || url,online.securityfocus.com/archive/1/16878 890 || WEB-CGI sendform.cgi access || cve,CAN-2002-0710 || bugtraq,5286 || url,www.scn.org/help/sendform.txt 891 || WEB-CGI upload.pl access 892 || WEB-CGI AnyForm2 access || bugtraq,719 || cve,CVE-1999-0066 893 || WEB-CGI MachineInfo access || cve,CAN-1999-1067 894 || WEB-CGI bb-hist.sh access || nessus,10025 || cve,CAN-1999-1462 || bugtraq,142 895 || WEB-CGI redirect access || bugtraq,1179 || cve,CVE-2000-0382 896 || WEB-CGI way-board access || bugtraq,2370 || cve,CAN-2001-0214 || nessus,10610 897 || WEB-CGI pals-cgi access || cve,CAN-2001-0216 || cve,CAN-2001-0217 || bugtraq,2372 || nessus,10611 898 || WEB-CGI commerce.cgi access || nessus,10612 || bugtraq,2361 || cve,CAN-2001-0210 899 || WEB-CGI Amaya templates sendtemp.pl directory traversal attempt || bugtraq,2504 || cve,CAN-2001-0272 900 || WEB-CGI webspirs.cgi directory traversal attempt || cve,CAN-2001-0211 || bugtraq,2362 || nessus,10616 901 || WEB-CGI webspirs.cgi access || cve,CAN-2001-0211 || bugtraq,2362 || nessus,10616 902 || WEB-CGI tstisapi.dll access || cve,CAN-2001-0302 903 || WEB-COLDFUSION cfcache.map access || bugtraq,917 || cve,CVE-2000-0057 904 || WEB-COLDFUSION exampleapp application.cfm || bugtraq,1021 905 || WEB-COLDFUSION application.cfm access || bugtraq,1021 906 || WEB-COLDFUSION getfile.cfm access || bugtraq,229 907 || WEB-COLDFUSION addcontent.cfm access 908 || WEB-COLDFUSION administrator access || cve,CVE-2000-0538 909 || WEB-COLDFUSION datasource username attempt || bugtraq,550 910 || WEB-COLDFUSION fileexists.cfm access || bugtraq,550 911 || WEB-COLDFUSION exprcalc access || cve,CVE-1999-0455 || bugtraq,550 912 || WEB-COLDFUSION parks access || bugtraq,550 913 || WEB-COLDFUSION cfappman access || bugtraq,550 914 || WEB-COLDFUSION beaninfo access || bugtraq,550 915 || WEB-COLDFUSION evaluate.cfm access || bugtraq,550 916 || WEB-COLDFUSION getodbcdsn access || bugtraq,550 917 || WEB-COLDFUSION db connections flush attempt || bugtraq,550 918 || WEB-COLDFUSION expeval access || bugtraq,550 || cve,CAN-1999-0477 919 || WEB-COLDFUSION datasource passwordattempt || bugtraq,550 920 || WEB-COLDFUSION datasource attempt || bugtraq,550 921 || WEB-COLDFUSION admin encrypt attempt || bugtraq,550 922 || WEB-COLDFUSION displayfile access || bugtraq,550 923 || WEB-COLDFUSION getodbcin attempt || bugtraq,550 924 || WEB-COLDFUSION admin decrypt attempt || bugtraq,550 925 || WEB-COLDFUSION mainframeset access || bugtraq,550 926 || WEB-COLDFUSION set odbc ini attempt || bugtraq,550 927 || WEB-COLDFUSION settings refresh attempt || bugtraq,550 928 || WEB-COLDFUSION exampleapp access 929 || WEB-COLDFUSION CFUSION_VERIFYMAIL access || bugtraq,550 930 || WEB-COLDFUSION snippets attempt || bugtraq,550 931 || WEB-COLDFUSION cfmlsyntaxcheck.cfm access || bugtraq,550 932 || WEB-COLDFUSION application.cfm access || bugtraq,550 || arachnids,268 || cve,CAN-2000-0189 933 || WEB-COLDFUSION onrequestend.cfm access || bugtraq,550 || arachnids,269 || cve,CAN-2000-0189 935 || WEB-COLDFUSION startstop DOS access || bugtraq,247 936 || WEB-COLDFUSION gettempdirectory.cfm access || bugtraq,550 937 || WEB-FRONTPAGE _vti_rpc access || bugtraq,2144 939 || WEB-FRONTPAGE posting 940 || WEB-FRONTPAGE shtml.dll access || arachnids,292 941 || WEB-FRONTPAGE contents.htm access 942 || WEB-FRONTPAGE orders.htm access 943 || WEB-FRONTPAGE fpsrvadm.exe access 944 || WEB-FRONTPAGE fpremadm.exe access 945 || WEB-FRONTPAGE fpadmin.htm access 946 || WEB-FRONTPAGE fpadmcgi.exe access 947 || WEB-FRONTPAGE orders.txt access 948 || WEB-FRONTPAGE form_results access 949 || WEB-FRONTPAGE registrations.htm access 950 || WEB-FRONTPAGE cfgwiz.exe access 951 || WEB-FRONTPAGE authors.pwd access || cve,CVE-1999-0386 || nessus,10078 952 || WEB-FRONTPAGE author.exe access 953 || WEB-FRONTPAGE administrators.pwd access || bugtraq,1205 954 || WEB-FRONTPAGE form_results.htm access 955 || WEB-FRONTPAGE access.cnf access 956 || WEB-FRONTPAGE register.txt access 957 || WEB-FRONTPAGE registrations.txt access 958 || WEB-FRONTPAGE service.cnf access 959 || WEB-FRONTPAGE service.pwd || bugtraq,1205 960 || WEB-FRONTPAGE service.stp access 961 || WEB-FRONTPAGE services.cnf access 962 || WEB-FRONTPAGE shtml.exe access || nessus,10405 || cve,CAN-2000-0413 || cve,CAN-2000-0709 || bugtraq,1608 || bugtraq,1174 963 || WEB-FRONTPAGE svcacl.cnf access 964 || WEB-FRONTPAGE users.pwd access 965 || WEB-FRONTPAGE writeto.cnf access 966 || WEB-FRONTPAGE fourdots request || bugtraq,989 || cve,CAN-2000-0153 || arachnids,248 967 || WEB-FRONTPAGE dvwssr.dll access || bugtraq,1108 || cve,CVE-2000-0260 || arachnids,271 || url,www.microsoft.com/technet/security/bulletin/ms00-025.asp 968 || WEB-FRONTPAGE register.htm access 969 || WEB-IIS webdav file lock attempt || bugtraq,2736 970 || WEB-IIS multiple decode attempt || cve,CAN-2001-0333 971 || WEB-IIS ISAPI .printer access || cve,CAN-2001-0241 || arachnids,533 972 || WEB-IIS %2E-asp access || bugtraq,1814 || cve,CAN-1999-0253 973 || WEB-IIS *.idc attempt || bugtraq,1448 || cve,CVE-1999-0874 974 || WEB-IIS ..\.. access || bugtraq,2218 || cve,CAN-1999-0229 975 || WEB-IIS .asp\:\:$DATA access || bugtraq,149 || url,support.microsoft.com/default.aspx?scid=kb\;EN-US\;q188806 || cve,CVE-1999-0278 || nessus,10362 976 || WEB-IIS .bat? access || bugtraq,2023 || cve,CVE-1999-0233 || url,support.microsoft.com/support/kb/articles/Q148/1/88.asp || url,support.microsoft.com/support/kb/articles/Q155/0/56.asp 977 || WEB-IIS .cnf access 978 || WEB-IIS ASP contents view || cve,CAN-2000-0302 || bugtraq,1084 979 || WEB-IIS ASP contents view || bugtraq,1864 980 || WEB-IIS CGImail.exe access || cve,CAN-2000-0726 || bugtraq,1623 981 || WEB-IIS unicode directory traversal attempt || cve,CVE-2000-0884 982 || WEB-IIS unicode directory traversal attempt || cve,CVE-2000-0884 983 || WEB-IIS unicode directory traversal attempt || cve,CVE-2000-0884 986 || WEB-IIS MSProxy access 987 || WEB-IIS .htr access || cve,CVE-2000-0630 988 || WEB-IIS SAM Attempt 989 || WEB-IIS Unicode2.pl script (File permission canonicalization) 990 || WEB-IIS _vti_inf access 991 || WEB-IIS achg.htr access || cve,CVE-1999-0407 || bugtraq,2110 993 || WEB-IIS iisadmin access 994 || WEB-IIS /scripts/iisadmin/default.htm access 995 || WEB-IIS ism.dll access || cve,CVE-2000-0630 || bugtraq,189 996 || WEB-IIS anot.htr access || bugtraq,2110 || cve,CVE-1999-0407 997 || WEB-IIS asp-dot attempt 998 || WEB-IIS asp-srch attempt 1000 || WEB-IIS bdir.htr access 1001 || WEB-MISC carbo.dll access || cve,CAN-1999-1069 || bugtraq,2126 1002 || WEB-IIS cmd.exe access 1003 || WEB-IIS cmd? access 1007 || WEB-IIS cross-site scripting attempt 1008 || WEB-IIS del attempt 1009 || WEB-IIS directory listing 1010 || WEB-IIS encoding access || arachnids,200 1011 || WEB-IIS exec-src access 1012 || WEB-IIS fpcount attempt || bugtraq,2252 1013 || WEB-IIS fpcount access || bugtraq,2252 1015 || WEB-IIS getdrvs.exe access 1016 || WEB-IIS global.asa access || nessus,10491 || cve,CVE-2000-0778 1017 || WEB-IIS idc-srch attempt || cve,CVE-1999-0874 1018 || WEB-IIS iisadmpwd attempt || bugtraq,2110 || cve,CVE-2000-0304 1019 || WEB-IIS index server file sourcecode attempt 1020 || WEB-IIS isc$data attempt || bugtraq,307 || cve,CVE-1999-0874 1021 || WEB-IIS ism.dll attempt || cve,CAN-2000-0457 || bugtraq,1193 1022 || WEB-IIS jet vba access || bugtraq,286 || cve,CVE-1999-0874 1023 || WEB-IIS msadcs.dll access || cve,CVE-1999-1011 || bugtraq,529 1024 || WEB-IIS newdsn.exe access || bugtraq,1818 || cve,CVE-1999-0191 1025 || WEB-IIS perl access 1026 || WEB-IIS perl-browse0a attempt 1027 || WEB-IIS perl-browse20 attempt 1029 || WEB-IIS scripts-browse access 1030 || WEB-IIS search97.vts access || bugtraq,162 1037 || WEB-IIS showcode.asp access || cve,CAN-1999-0736 || bugtraq,167 || nessus,10007 1038 || WEB-IIS site server config access || bugtraq,256 1039 || WEB-IIS srch.htm access 1040 || WEB-IIS srchadm access 1041 || WEB-IIS uploadn.asp access 1042 || WEB-IIS view source via translate header || arachnids,305 || bugtraq,1578 1043 || WEB-IIS viewcode.asp access || nessus,10576 1044 || WEB-IIS webhits access || arachnids,237 1046 || WEB-IIS site/iisamples access 1047 || WEB-MISC Netscape Enterprise DOS || cve,CAN-2001-0251 || bugtraq,2294 1048 || WEB-MISC Netscape Enterprise directory listing attempt || cve,CAN-2001-0250 || bugtraq,2285 1049 || WEB-MISC iPlanet ../../ DOS attempt || bugtraq,2282 || cve,CAN-2001-0252 1050 || WEB-MISC iPlanet GETPROPERTIES attempt 1051 || WEB-CGI technote main.cgi file directory traversal attempt || cve,CVE-2001-0075 || bugtraq,2156 1052 || WEB-CGI technote print.cgi directory traversal attempt || cve,CAN-2001-0075 || bugtraq,2156 1053 || WEB-CGI ads.cgi command execution attempt || cve,CAN-2001-0025 || bugtraq,2103 1054 || WEB-MISC weblogic view source attempt || bugtraq,2527 1055 || WEB-MISC tomcat directory traversal attempt || bugtraq,2518 1056 || WEB-MISC tomcat view source attempt || bugtraq,2527 1057 || WEB-MISC ftp attempt 1058 || WEB-MISC enumdsn attempt 1059 || WEB-MISC filelist attempt 1060 || WEB-MISC availablemedia attempt 1061 || WEB-MISC cmdshell attempt 1062 || WEB-MISC nc.exe attempt 1064 || WEB-MISC wsh attempt 1065 || WEB-MISC rcmd attempt 1066 || WEB-MISC telnet attempt 1067 || WEB-MISC net attempt 1068 || WEB-MISC tftp attempt 1069 || WEB-MISC xp_regread attempt 1070 || WEB-MISC webdav search access || arachnids,474 1071 || WEB-MISC .htpasswd access 1072 || WEB-MISC Lotus Domino directory traversal || cve,CVE-2001-0009 || bugtraq,2173 1075 || WEB-MISC postinfo.asp access 1076 || WEB-IIS repost.asp access || nessus,10372 1077 || WEB-MISC queryhit.htm access 1078 || WEB-MISC counter.exe access || bugtraq,267 1079 || WEB-MISC webdav propfind access || bugtraq,1656 || cve,CVE-2000-0869 1080 || WEB-MISC unify eWave ServletExec upload || bugtraq,1868 || cve,CVE-2000-1024 1081 || WEB-MISC netscape servers suite DOS || bugtraq,1868 1082 || WEB-MISC amazon 1-click cookie theft || bugtraq,1194 || cve,CVE-2000-0439 1083 || WEB-MISC unify eWave ServletExec DOS 1084 || WEB-MISC Allaire JRUN DOS attempt || bugtraq,2337 1085 || WEB-MISC PHP strings overflow || bugtraq,802 || arachnids,431 1086 || WEB-MISC PHP strings overflow || arachnids,430 1087 || WEB-MISC whisker tab splice attack || arachnids,415 || url,www.wiretrip.net/rfp/pages/whitepapers/whiskerids.html 1088 || WEB-CGI eXtropia webstore directory traversal || bugtraq,1774 || cve,CVE-2000-1005 1089 || WEB-CGI shopping cart directory traversal || bugtraq,1777 1090 || WEB-CGI Allaire Pro Web Shell attempt 1091 || WEB-MISC ICQ Webfront HTTP DOS 1092 || WEB-CGI Armada Style Master Index directory traversal 1093 || WEB-CGI moreover shopping cart directory traversal || bugtraq,1762 1095 || WEB-MISC Talentsoft Web+ Source Code view access || bugtraq,1722 1096 || WEB-MISC Talentsoft Web+ internal IP Address access || bugtraq,1720 1097 || WEB-CGI Talentsoft Web+ exploit attempt || bugtraq,1725 1098 || WEB-MISC SmartWin CyberOffice Shopping Cart access || bugtraq,1734 1099 || WEB-MISC cybercop scan || arachnids,374 1100 || WEB-MISC L3retriever HTTP Probe || arachnids,310 1101 || WEB-MISC Webtrends HTTP probe || arachnids,309 1102 || WEB-MISC Nessus 404 probe || arachnids,301 1103 || WEB-MISC netscape admin passwd || bugtraq,1579 1104 || WEB-MISC whisker space splice attack || arachnids,296 || url,www.wiretrip.net/rfp/pages/whitepapers/whiskerids.html 1105 || WEB-MISC BigBrother access 1106 || WEB-CGI Poll-it access || cve,CAN-2000-0590 || bugtraq,1431 1107 || WEB-MISC ftp.pl access || cve,CAN-2000-0674 || bugtraq,1471 || nessus,10467 1108 || WEB-MISC tomcat server snoop access || cve,CAN-2000-0760 || bugtraq,1532 1109 || WEB-MISC ROXEN directory list attempt || bugtraq,1510 || cve,CVE-2000-0671 1110 || WEB-MISC apache source.asp file access || bugtraq,1457 || cve,CVE-2000-0628 1111 || WEB-MISC tomcat server exploit access 1112 || WEB-MISC http directory traversal || arachnids,298 1113 || WEB-MISC http directory traversal || arachnids,297 1114 || WEB-MISC prefix-get // 1115 || WEB-MISC ICQ webserver DOS || cve,CVE-1999-0474 1116 || WEB-MISC Lotus DelDoc attempt 1117 || WEB-MISC Lotus EditDoc attempt || url,www.securiteam.com/exploits/5NP080A1RE.html 1118 || WEB-MISC ls%20-l 1119 || WEB-MISC mlog.phtml access || bugtraq,713 || cve,CVE-1999-0346 1120 || WEB-MISC mylog.phtml access || bugtraq,713 || cve,CVE-1999-0346 1121 || WEB-MISC O'Reilly args.bat access 1122 || WEB-MISC /etc/passwd 1123 || WEB-MISC ?PageServices access || bugtraq,1063 || cve,CVE-1999-0269 1124 || WEB-MISC Ecommerce check.txt access 1125 || WEB-MISC webcart access || nessus,10298 || cve,CAN-1999-0610 1126 || WEB-MISC AuthChangeUrl access 1127 || WEB-MISC convert.bas access || bugtraq,2025 || cve,CVE-1999-0175 1128 || WEB-MISC cpshost.dll access 1129 || WEB-MISC .htaccess access 1130 || WEB-MISC .wwwacl access 1131 || WEB-MISC .wwwacl access 1132 || WEB-MISC netscape unixware overflow || arachnids,180 1133 || SCAN cybercop os probe || arachnids,145 1134 || WEB-MISC Phorum admin access || bugtraq,2271 || arachnids,205 1136 || WEB-MISC cd.. 1137 || WEB-MISC Phorum auth access || bugtraq,2274 || arachnids,206 1138 || WEB-MISC Cisco Web DOS attempt || arachnids,275 1139 || WEB-MISC whisker HEAD/./ || url,www.wiretrip.net/rfp/pages/whitepapers/whiskerids.html 1140 || WEB-MISC guestbook.pl access || nessus,10099 || bugtraq,776 || cve,CVE-1999-0237 || arachnids,228 1141 || WEB-MISC handler access || nessus,10100 || bugtraq,380 || arachnids,235 || cve,CVE-1999-0148 1142 || WEB-MISC /.... 1143 || WEB-MISC ///cgi-bin 1144 || WEB-MISC /cgi-bin/// access 1145 || WEB-MISC /~root access 1146 || WEB-MISC Ecommerce import.txt access 1147 || WEB-MISC cat%20 access || cve,CVE-1999-0039 || bugtraq,374 1148 || WEB-MISC Ecommerce import.txt access 1149 || WEB-CGI count.cgi access || bugtraq,128 || cve,CVE-1999-0021 || nessus,10049 1150 || WEB-MISC Domino catalog.nsf access 1151 || WEB-MISC Domino domcfg.nsf access 1152 || WEB-MISC Domino domlog.nsf access 1153 || WEB-MISC Domino log.nsf access 1154 || WEB-MISC Domino names.nsf access 1155 || WEB-MISC Ecommerce checks.txt access 1156 || WEB-MISC apache DOS attempt 1157 || WEB-MISC netscape PublishingXpert 2 Exploit || cve,CAN-2000-1196 1158 || WEB-MISC windmail.exe access || cve,CAN-2000-0242 || bugtraq,1073 || arachnids,465 || nessus,10365 1159 || WEB-MISC webplus access || cve,CVE-2000-1005 || bugtraq,1174 || bugtraq,1720 || bugtraq,1722 || bugtraq,1725 1160 || WEB-MISC netscape dir index wp || bugtraq,1063 || cve,CVE-2000-0236 || arachnids,270 1161 || WEB-MISC piranha passwd.php3 access || bugtraq,1149 || cve,CVE-2000-0322 || arachnids,272 1162 || WEB-MISC cart 32 AdminPwd access || cve,CAN-2000-0429 || bugtraq,1153 1163 || WEB-CGI webdist.cgi access || bugtraq,374 || cve,CVE-1999-0039 || nessus,10299 1164 || WEB-MISC shopping cart access access 1165 || WEB-MISC novell groupwise gwweb.exe access || bugtraq,879 || cve,CAN-1999-1006 1166 || WEB-MISC ws_ftp.ini access || cve,CAN-1999-1078 || bugtraq,547 1167 || WEB-MISC rpm_query access || cve,CVE-2000-0192 || bugtraq,1036 1168 || WEB-MISC mall log order access 1172 || WEB-CGI bigconf.cgi access || nessus,10027 || bugtraq,778 || cve,CVE-1999-1550 1173 || WEB-MISC architext_query.pl access 1174 || WEB-CGI /cgi-bin/jj access || bugtraq,2002 || cve,CVE-1999-0260 1175 || WEB-MISC wwwboard.pl access || bugtraq,649 || bugtraq,1795 || cve,CAN-1999-0930 1176 || WEB-MISC order.log access 1177 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 1178 || WEB-MISC Phorum read access || arachnids,208 1179 || WEB-MISC Phorum violation access || bugtraq,2272 || arachnids,209 1180 || WEB-MISC get32.exe access || bugtraq,1485 || arachnids,258 1181 || WEB-MISC Annex Terminal DOS attempt || cve,CAN-1999-1070 || arachnids,260 1182 || WEB-MISC cgitest.exe attempt || nessus,10623 || nessus,10040 || cve,CVE-2000-0521 || bugtraq,3885 || arachnids,265 1183 || WEB-MISC Netscape Enterprise Server directory view || cve,CVE-2000-0236 || bugtraq,1063 1184 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 1185 || WEB-CGI bizdbsearch attempt || cve,CAN-2000-0287 || bugtraq,1104 1186 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 1187 || WEB-MISC SalesLogix Eviewer web command attempt || bugtraq,1089 || cve,CAN-2000-0289 1188 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 1189 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 1190 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 1191 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 1192 || WEB-MISC Trend Micro OfficeScan access || bugtraq,1057 1193 || WEB-MISC oracle web arbitrary command execution attempt || cve,CVE-2000-0169 || bugtraq,1053 || nessus,10348 1194 || WEB-CGI sojourn.cgi File attempt || bugtraq,1052 || cve,CAN-2000-0180 1195 || WEB-CGI sojourn.cgi access || bugtraq,1052 || cve,CAN-2000-0180 1196 || WEB-CGI SGI InfoSearch fname attempt || bugtraq,1031 || arachnids,290 || cve,CVE-2000-0207 1197 || WEB-MISC Phorum code access || arachnids,207 1198 || WEB-MISC Netscape Enterprise Server directory view || bugtraq,1063 1199 || WEB-MISC Compaq Insight directory traversal || bugtraq,282 || arachnids,244 || cve,CVE-1999-0771 1200 || ATTACK RESPONSES Invalid URL 1201 || ATTACK RESPONSES 403 Forbidden 1202 || WEB-MISC search.vts access 1204 || WEB-CGI ax-admin.cgi access 1205 || WEB-CGI axs.cgi access 1206 || WEB-CGI cachemgr.cgi access || cve,CVE-1999-0710 || nessus,10034 1207 || WEB-MISC htgrep access || cve,CAN-2000-0832 1208 || WEB-CGI responder.cgi access 1209 || WEB-MISC .nsconfig access 1211 || WEB-CGI web-map.cgi access 1212 || WEB-MISC Admin_files access 1213 || WEB-MISC backup access 1214 || WEB-MISC intranet access 1215 || WEB-CGI ministats admin access 1216 || WEB-MISC filemail access 1217 || WEB-MISC plusmail access 1218 || WEB-MISC adminlogin access 1219 || WEB-CGI dfire.cgi access || cve,CAN-1999-0913 1220 || WEB-MISC ultraboard access 1221 || WEB-MISC musicat empower access 1222 || WEB-CGI pals-cgi arbitrary file access attempt || cve,CAN-2001-0217 || bugtraq,2372 || nessus,10611 1224 || WEB-MISC ROADS search.pl attempt || cve,CAN-2001-0215 || bugtraq,2371 || nessus,10627 1225 || X11 MIT Magic Cookie detected || arachnids,396 1226 || X11 xopen || arachnids,395 1227 || X11 outbound client connection detected || arachnids,126 1228 || SCAN nmap XMAS || arachnids,30 1229 || FTP CWD ... 1230 || WEB-MISC VirusWall FtpSave access || bugtraq,2808 || cve,CAN-2001-0432 || nessus,10733 1231 || WEB-MISC VirusWall catinfo access || bugtraq,2808 || bugtraq,2579 || nessus,10650 || cve,CAN-2001-0432 1232 || WEB-MISC VirusWall catinfo access || bugtraq,2808 || bugtraq,2579 || nessus,10650 || cve,CAN-2001-0432 1233 || WEB-CLIENT Outlook EML access 1234 || WEB-MISC VirusWall FtpSaveCSP access || bugtraq,2808 || cve,CAN-2001-0432 || nessus,10733 1235 || WEB-MISC VirusWall FtpSaveCVP access || bugtraq,2808 || cve,CAN-2001-0432 || nessus,10733 1236 || WEB-MISC Tomcat sourcode view 1237 || WEB-MISC Tomcat sourcode view 1238 || WEB-MISC Tomcat sourcode view 1239 || NETBIOS RFParalyze Attempt 1240 || EXPLOIT MDBMS overflow || bugtraq,1252 || cve,CVE-2000-0446 1241 || WEB-MISC SWEditServlet directory traversal attempt 1242 || WEB-IIS ISAPI .ida access || arachnids,552 || cve,CAN-2000-0071 || bugtraq,1065 1243 || WEB-IIS ISAPI .ida attempt || arachnids,552 || bugtraq,1065 || cve,CAN-2000-0071 1244 || WEB-IIS ISAPI .idq attempt || arachnids,553 || cve,CAN-2000-0071 || bugtraq,1065 1245 || WEB-IIS ISAPI .idq access || arachnids,553 || cve,CAN-2000-0071 || bugtraq,1065 1246 || WEB-FRONTPAGE rad overflow attempt || arachnids,555 || bugtraq,2906 || cve,CAN-2001-0341 || url,www.microsoft.com/technet/security/bulletin/MS01-035.asp 1247 || WEB-FRONTPAGE rad overflow attempt || cve,CAN-2001-0341 || bugtraq,2906 1248 || WEB-FRONTPAGE rad fp30reg.dll access || arachnids,555 || bugtraq,2906 || cve,CAN-2001-0341 || url,www.microsoft.com/technet/security/bulletin/MS01-035.asp 1249 || WEB-FRONTPAGE frontpage rad fp4areg.dll access || cve,CAN-2001-0341 || bugtraq,2906 1250 || WEB-MISC Cisco IOS HTTP configuration attempt || bugtraq,2936 1251 || TELNET Bad Login 1252 || TELNET bsd telnet exploit response || bugtraq,3064 || cve,CAN-2001-0554 1253 || TELNET bsd exploit client finishing || bugtraq,3064 || cve,CAN-2001-0554 1254 || WEB-MISC PHPLIB remote command attempt || bugtraq,3079 1255 || WEB-MISC PHPLIB remote command attempt || bugtraq,3079 1256 || WEB-IIS CodeRed v2 root.exe access || url,www.cert.org/advisories/CA-2001-19.html 1257 || DOS Winnuke attack || bugtraq,2010 || cve,CVE-1999-0153 1258 || WEB-MISC HP Openview Manager DOS || bugtraq,2845 1259 || WEB-MISC SWEditServlet access 1260 || WEB-MISC long basic authorization string || bugtraq,3230 1261 || EXPLOIT aix pdnsd overflow || cve,CVE-1999-0745 || bugtraq,3237 1262 || RPC portmap request admind || arachnids,18 1263 || RPC portmap request amountd || arachnids,19 1264 || RPC portmap request bootparam || cve,CAN-1999-0647 || arachnids,16 1265 || RPC portmap request cmsd || arachnids,17 1266 || RPC portmap request mountd || arachnids,13 1267 || RPC portmap request nisd || arachnids,21 1268 || RPC portmap request pcnfsd || arachnids,22 1269 || RPC portmap request rexd || arachnids,23 1270 || RPC portmap request rstatd || arachnids,10 1271 || RPC portmap request rusers || arachnids,133 || cve,CVE-1999-0626 1272 || RPC portmap request sadmind || arachnids,20 1273 || RPC portmap request selection_svc || arachnids,25 1274 || RPC portmap request ttdbserv || cve,CAN-2001-0717 || cve,CVE-1999-0003 || cve,CVE-1999-0687 || cve,CAN-1999-1075 || url,www.cert.org/advisories/CA-2001-05.html || arachnids,24 1275 || RPC portmap request yppasswd || arachnids,14 1276 || RPC portmap request ypserv || arachnids,12 1277 || RPC portmap request ypupdated || arachnids,125 1279 || RPC udp portmap request snmpXdmi || cve,CAN-2001-0236 || url,www.cert.org/advisories/CA-2001-05.html || bugtraq,2417 1280 || RPC portmap listing UDP 111 || arachnids,429 1281 || RPC portmap listing UDP 32771 || arachnids,429 1283 || WEB-IIS outlook web dos || bugtraq,3223 1284 || WEB-CLIENT readme.eml download attempt || url,www.cert.org/advisories/CA-2001-26.html 1285 || WEB-IIS msdac access 1286 || WEB-IIS _mem_bin access 1288 || WEB-FRONTPAGE /_vti_bin/ access 1289 || TFTP GET Admin.dll || url,www.cert.org/advisories/CA-2001-26.html 1290 || WEB-CLIENT readme.eml autoload attempt || url,www.cert.org/advisories/CA-2001-26.html 1291 || WEB-MISC sml3com access || bugtraq,2721 1292 || ATTACK RESPONSES http dir listing 1293 || NETBIOS nimda .eml || url,www.datafellows.com/v-descs/nimda.shtml 1294 || NETBIOS nimda .nws || url,www.datafellows.com/v-descs/nimda.shtml 1295 || NETBIOS nimda RICHED20.DLL || url,www.datafellows.com/v-descs/nimda.shtml 1296 || RPC portmap request yppasswdd || bugtraq,2763 1297 || RPC portmap request yppasswdd || bugtraq,2763 1298 || RPC portmap request tooltalk || cve,CAN-2001-0717 || cve,CVE-1999-0003 || cve,CVE-1999-0687 || cve,CAN-1999-1075 || url,www.cert.org/advisories/CA-2001-05.html 1299 || RPC portmap request tooltalk || cve,CAN-2001-0717 || cve,CVE-1999-0003 || cve,CVE-1999-0687 || cve,CAN-1999-1075 || url,www.cert.org/advisories/CA-2001-05.html 1300 || WEB-MISC admin.php file upload attempt || bugtraq,3361 1301 || WEB-MISC admin.php access || bugtraq,3361 1302 || WEB-MISC console.exe access || bugtraq,3375 1303 || WEB-MISC cs.exe access || bugtraq,3375 1304 || WEB-CGI txt2html.cgi access 1305 || WEB-CGI txt2html.cgi directory traversal attempt 1307 || WEB-CGI store.cgi access || nessus,10639 || bugtraq,2385 || cve,CAN-2001-0305 1308 || WEB-CGI sendmessage.cgi access 1309 || WEB-CGI zsh access || url,www.cert.org/advisories/CA-1996-11.html || cve,CAN-1999-0509 1310 || PORN free XXX 1311 || PORN hardcore anal 1312 || PORN nude cheerleader 1313 || PORN up skirt 1315 || PORN hot young sex 1316 || PORN fuck fuck fuck 1317 || PORN anal sex 1318 || PORN hardcore rape 1319 || PORN real snuff 1320 || PORN fuck movies 1321 || BAD TRAFFIC 0 ttl || url,www.isi.edu/in-notes/rfc1122.txt || url,support.microsoft.com/default.aspx?scid=kb\;EN-US\;q138268 1322 || BAD TRAFFIC bad frag bits 1323 || EXPLOIT rwhoisd format string attempt || cve,CAN-2001-0838 || bugtraq,3474 1324 || EXPLOIT ssh CRC32 overflow /bin/sh || bugtraq,2347 || cve,CVE-2001-0144 1326 || EXPLOIT ssh CRC32 overflow NOOP || bugtraq,2347 || cve,CVE-2001-0144 1327 || EXPLOIT ssh CRC32 overflow || bugtraq,2347 || cve,CVE-2001-0144 1328 || WEB-ATTACKS ps command attempt 1329 || WEB-ATTACKS /bin/ps command attempt 1330 || WEB-ATTACKS wget command attempt 1331 || WEB-ATTACKS uname -a command attempt 1332 || WEB-ATTACKS /usr/bin/id command attempt 1333 || WEB-ATTACKS id command attempt 1334 || WEB-ATTACKS echo command attempt 1335 || WEB-ATTACKS kill command attempt 1336 || WEB-ATTACKS chmod command attempt 1337 || WEB-ATTACKS chgrp command attempt 1338 || WEB-ATTACKS chown command attempt 1339 || WEB-ATTACKS chsh command attempt 1340 || WEB-ATTACKS tftp command attempt 1341 || WEB-ATTACKS /usr/bin/gcc command attempt 1342 || WEB-ATTACKS gcc command attempt 1343 || WEB-ATTACKS /usr/bin/cc command attempt 1344 || WEB-ATTACKS cc command attempt 1345 || WEB-ATTACKS /usr/bin/cpp command attempt 1346 || WEB-ATTACKS cpp command attempt 1347 || WEB-ATTACKS /usr/bin/g++ command attempt 1348 || WEB-ATTACKS g++ command attempt 1349 || WEB-ATTACKS bin/python access attempt 1350 || WEB-ATTACKS python access attempt 1351 || WEB-ATTACKS bin/tclsh execution attempt 1352 || WEB-ATTACKS tclsh execution attempt 1353 || WEB-ATTACKS bin/nasm command attempt 1354 || WEB-ATTACKS nasm command attempt 1355 || WEB-ATTACKS /usr/bin/perl execution attempt 1356 || WEB-ATTACKS perl execution attempt 1357 || WEB-ATTACKS nt admin addition attempt 1358 || WEB-ATTACKS traceroute command attempt 1359 || WEB-ATTACKS ping command attempt 1360 || WEB-ATTACKS netcat command attempt 1361 || WEB-ATTACKS nmap command attempt 1362 || WEB-ATTACKS xterm command attempt 1363 || WEB-ATTACKS X application to remote host attempt 1364 || WEB-ATTACKS lsof command attempt 1365 || WEB-ATTACKS rm command attempt 1366 || WEB-ATTACKS mail command attempt 1367 || WEB-ATTACKS mail command attempt 1368 || WEB-ATTACKS /bin/ls| command attempt 1369 || WEB-ATTACKS /bin/ls command attempt 1370 || WEB-ATTACKS /etc/inetd.conf access 1371 || WEB-ATTACKS /etc/motd access 1372 || WEB-ATTACKS /etc/shadow access 1373 || WEB-ATTACKS conf/httpd.conf attempt 1374 || WEB-ATTACKS .htgroup access 1375 || WEB-MISC sadmind worm access || url,www.cert.org/advisories/CA-2001-11.html 1376 || WEB-MISC jrun directory browse attempt 1377 || FTP wu-ftp bad file completion attempt [ || cve,CVE-2001-0550 || cve,CAN-2001-0886 || bugtraq,3581 1378 || FTP wu-ftp bad file completion attempt { || cve,CVE-2001-0550 || cve,CAN-2001-0886 || bugtraq,3581 1379 || FTP STAT overflow attempt || url,labs.defcom.com/adv/2001/def-2001-31.txt 1380 || WEB-IIS cross-site scripting attempt 1381 || WEB-MISC Trend Micro OfficeScan attempt || bugtraq,1057 1382 || CHAT IRC EXPLOIT Ettercap parse overflow attempt || url,www.bugtraq.org/dev/GOBBLES-12.txt 1383 || P2P Fastrack (kazaa/morpheus) GET request || url,www.musiccity.com/technology.htm || url,www.kazaa.com 1384 || MISC UPNP malformed advertisement || cve,CAN-2001-0876 || cve,CAN-2001-0877 1385 || WEB-MISC mod-plsql administration access || nessus,10849 || bugtraq,3726 || bugtraq,3727 1386 || MS-SQL/SMB raiserror possible buffer overflow || bugtraq,3733 1387 || MS-SQL raiserror possible buffer overflow || bugtraq,3733 1388 || MISC UPNP Location overflow || cve,CAN-2001-0876 1390 || SHELLCODE x86 inc ebx NOOP 1391 || WEB-MISC Phorecast remote code execution attempt || bugtraq,3388 1392 || WEB-CGI lastlines.cgi access || bugtraq,3755 || bugtraq,3754 1393 || MISC AIM AddGame attempt || url,www.w00w00.org/files/w00aimexp/ || bugtraq,3769 || cve,CAN-2002-0005 1394 || SHELLCODE x86 NOOP 1395 || WEB-CGI zml.cgi attempt || cve,CAN-2001-1209 || bugtraq,3759 1396 || WEB-CGI zml.cgi access || cve,CAN-2001-1209 || bugtraq,3759 1397 || WEB-CGI wayboard attempt || bugtraq,2370 || cve,CAN-2001-0214 1398 || EXPLOIT CDE dtspcd exploit attempt || cve,CAN-2001-0803 || url,www.cert.org/advisories/CA-2002-01.html 1399 || WEB-MISC PHP-Nuke remote file include attempt || bugtraq,3889 1400 || WEB-IIS /scripts/samples/ access 1401 || WEB-IIS /msadc/samples/ access 1402 || WEB-IIS iissamples access 1403 || WEB-MISC viewcode access 1404 || WEB-MISC showcode access 1405 || WEB-CGI AHG search.cgi access || bugtraq,3985 1406 || WEB-CGI agora.cgi access || nessus,10836 || cve,CAN-2001-1199 || bugtraq,3976 1407 || WEB-MISC smssend.php access || bugtraq,3982 1408 || DOS MSDTC attempt || bugtraq,4006 1409 || SNMP community string buffer overflow attempt || url,www.cert.org/advisories/CA-2002-03.html || cve,CAN-2002-0012 || cve,CAN-2002-0013 1410 || WEB-CGI dcboard.cgi access || bugtraq,2728 1411 || SNMP public access udp || cve,CAN-1999-0517 || cve,CAN-2002-0012 || cve,CAN-2002-0013 1412 || SNMP public access tcp || cve,CAN-1999-0517 || cve,CAN-2002-0012 || cve,CAN-2002-0013 1413 || SNMP private access udp || cve,CAN-2002-0012 || cve,CAN-2002-0013 1414 || SNMP private access tcp || cve,CAN-2002-0012 || cve,CAN-2002-0013 1415 || SNMP Broadcast request || cve,CAN-2002-0012 || cve,CAN-2002-0013 1416 || SNMP broadcast trap || cve,CAN-2002-0012 || cve,CAN-2002-0013 1417 || SNMP request udp || cve,CAN-2002-0012 || cve,CAN-2002-0013 1418 || SNMP request tcp || cve,CAN-2002-0012 || cve,CAN-2002-0013 1419 || SNMP trap udp || cve,CAN-2002-0012 || cve,CAN-2002-0013 1420 || SNMP trap tcp || cve,CAN-2002-0012 || cve,CAN-2002-0013 1421 || SNMP AgentX/tcp request || cve,CAN-2002-0012 || cve,CAN-2002-0013 1422 || SNMP community string buffer overflow attempt (with evasion) || url,www.cert.org/advisories/CA-2002-03.html || cve,CAN-2002-0012 || cve,CAN-2002-0013 1423 || WEB-PHP content-disposition memchr overlfow || bugtraq,4183 1424 || SHELLCODE x86 EB OC NOOP 1425 || WEB-PHP content-disposition || bugtraq,4183 1426 || SNMP PROTOS test-suite-req-app attempt || url,www.ee.oulu.fi/research/ouspg/protos/testing/c06/snmpv1/index.html 1427 || SNMP PROTOS test-suite-trap-app attempt || url,www.ee.oulu.fi/research/ouspg/protos/testing/c06/snmpv1/index.html 1428 || MULTIMEDIA audio galaxy keepalive 1429 || POLICY poll.gotomypc.com access || url,www.gotomypc.com/help2.tmpl 1430 || TELNET solaris memory mismanagement exploit attempt 1431 || BAD TRAFFIC syn to multicast address 1432 || P2P GNUTella GET 1433 || WEB-MISC .history access 1434 || WEB-MISC .bash_history access 1435 || DNS named authors attempt || nessus,10728 || arachnids,480 1436 || MULTIMEDIA Quicktime User Agent access 1437 || MULTIMEDIA Windows Media audio download 1438 || MULTIMEDIA Windows Media Video download 1439 || MULTIMEDIA Shoutcast playlist redirection 1440 || MULTIMEDIA Icecast playlist redirection 1441 || TFTP GET nc.exe 1442 || TFTP GET shadow 1443 || TFTP GET passwd 1444 || TFTP Get 1445 || FTP file_id.diz access 1446 || SMTP vrfy root 1447 || MISC MS Terminal server request (RDP) || cve,CAN-2001-0540 1448 || MISC MS Terminal server request || cve,CAN-2001-0540 1449 || POLICY FTP anonymous (ftp) login attempt 1450 || SMTP expn *@ || cve,CAN-1999-1200 1451 || WEB-CGI NPH-publish access || cve,CAN-2001-0400 1452 || WEB-CGI args.cmd access || cve,CAN-1999-1374 1453 || WEB-CGI AT-generated.cgi access || cve,CAN-1999-1072 1454 || WEB-CGI wwwwais access || nessus,10597 || cve,CAN-2001-0223 1455 || WEB-CGI calender.pl access || cve,CVE-2000-0432 1457 || WEB-CGI user_update_admin.pl access || cve,CVE-2000-0627 1458 || WEB-CGI user_update_passwd.pl access || cve,CVE-2000-0627 1459 || WEB-CGI bb-histlog.sh access || bugtraq,142 || cve,CAN-1999-1462 1460 || WEB-CGI bb-histsvc.sh access || bugtraq,142 || cve,CAN-1999-1462 1461 || WEB-CGI bb-rep.sh access || bugtraq,142 || cve,CAN-1999-1462 1462 || WEB-CGI bb-replog.sh access || bugtraq,142 || cve,CAN-1999-1462 1463 || CHAT IRC message 1464 || ATTACK RESPONSES oracle one hour install 1465 || WEB-CGI auktion.cgi access || nessus,10638 || bugtraq,2367 || cve,CAN-2001-0212 1466 || WEB-CGI cgiforum.pl access || nessus,10552 || bugtraq,1963 || cve,CVE-2000-1171 1467 || WEB-CGI directorypro.cgi access || cve,CAN-2001-0780 1468 || WEB-CGI Web Shopper shopper.cgi attempt || cve,CVE-2000-0922 || bugtraq,1776 1469 || WEB-CGI Web Shopper shopper.cgi access || cve,CVE-2000-0922 || bugtraq,1776 1470 || WEB-CGI listrec.pl access || cve,CAN-2001-0997 1471 || WEB-CGI mailnews.cgi access || cve,CAN-2001-0271 1472 || WEB-CGI book.cgi access || cve,CVE-2001-1114 || bugtraq,3178 || nessus,10721 1473 || WEB-CGI newsdesk.cgi access || cve,CAN-2001-0232 1474 || WEB-CGI cal_make.pl access || cve,CVE-2001-0463 || bugtraq,2663 1475 || WEB-CGI mailit.pl access 1476 || WEB-CGI sdbsearch.cgi access || cve,CAN-2001-1130 1477 || WEB-CGI swc attempt 1478 || WEB-CGI swc access 1479 || WEB-CGI ttawebtop.cgi arbitrary file attempt || cve,CVE-2001-0805 || bugtraq,2890 || nessus,10696 1480 || WEB-CGI ttawebtop.cgi access || cve,CVE-2001-0805 || bugtraq,2890 || nessus,10696 || bugtraq,2890 1481 || WEB-CGI upload.cgi access || nessus,10290 1482 || WEB-CGI view_source access || nessus,10294 1483 || WEB-CGI ustorekeeper.pl access || cve,CAN-2001-0466 || nessus,10646 1484 || WEB-IIS /isapi/tstisapi.dll access || cve,CAN-2001-0302 || bugtraq,2381 1485 || WEB-IIS mkilog.exe access 1486 || WEB-IIS ctss.idc access 1487 || WEB-IIS /iisadmpwd/aexp2.htr access 1488 || WEB-CGI store.cgi directory traversal attempt || nessus,10639 || bugtraq,2385 || cve,CAN-2001-0305 1489 || WEB-MISC /~nobody access 1490 || WEB-MISC phorum /support/common.php attempt 1491 || WEB-MISC phorum /support/common.php access 1492 || WEB-MISC RBS ISP /newuser directory traversal attempt 1493 || WEB-MISC RBS ISP /newuser access 1494 || WEB-CGI SIX webboard generate.cgi attempt || cve,CAN-2001-1115 || bugtraq,3175 1495 || WEB-CGI SIX webboard generate.cgi access || cve,CAN-2001-1115 || bugtraq,3175 1496 || WEB-CGI spin_client.cgi access 1497 || WEB-MISC cross site scripting attempt 1498 || WEB-MISC PIX firewall manager directory traversal attempt 1499 || WEB-MISC SiteScope Service access || nessus,10778 1500 || WEB-MISC ExAir access || cve,CVE-1999-0449 1501 || WEB-CGI a1stats a1disp3.cgi directory traversal attempt || nessus,10669 || cve,CAN-2001-0561 1502 || WEB-CGI a1stats a1disp3.cgi access || nessus,10669 || cve,CAN-2001-0561 1503 || WEB-CGI admentor admin.asp access || nessus,10880 || cve,CAN-2002-0308 || bugtraq,4152 || url,www.securiteam.com/windowsntfocus/5DP0N1F6AW.html 1504 || MISC AFS access || nessus,10441 1505 || WEB-CGI alchemy http server PRN arbitrary command execution attempt || cve,CAN-2001-0871 1506 || WEB-CGI alchemy http server NUL arbitrary command execution attempt || cve,CAN-2001-0871 1507 || WEB-CGI alibaba.pl arbitrary command execution attempt || cve,CAN-1999-0885 1508 || WEB-CGI alibaba.pl access || cve ,CAN-1999-0885 1509 || WEB-CGI AltaVista Intranet Search directory traversal attempt || cve,CVE-2000-0039 || nessus,10015 1510 || WEB-CGI test.bat arbitrary command execution attempt || nessus,10016 || cve,CVE-1999-0947 1511 || WEB-CGI test.bat access || nessus,10016 || cve,CVE-1999-0947 1512 || WEB-CGI input.bat arbitrary command execution attempt || nessus,10016 || cve,CVE-1999-0947 1513 || WEB-CGI input.bat access || nessus,10016 || cve,CVE-1999-0947 1514 || WEB-CGI input2.bat arbitrary command execution attempt || nessus,10016 || cve,CVE-1999-0947 1515 || WEB-CGI input2.bat access || nessus,10016 || cve,CVE-1999-0947 1516 || WEB-CGI envout.bat arbitrary command execution attempt || nessus,10016 || cve,CVE-1999-0947 1517 || WEB-CGI envout.bat access || nessus,10016 || cve,CVE-1999-0947 1518 || WEB-MISC nstelemetry.adp access 1519 || WEB-MISC apache ?M=D directory list attempt || cve,CVE-2001-0731 || bugtraq,3009 1520 || WEB-MISC server-info access 1521 || WEB-MISC server-status access 1522 || WEB-MISC ans.pl attempt || cve,CAN-2002-0307 || nessus,10875 || bugtraq,4147 || bugtraq,4149 1523 || WEB-MISC ans.pl access || cve,CAN-2002-0307 || nessus,10875 || bugtraq,4147 || bugtraq,4149 1524 || WEB-MISC AxisStorpoint CD attempt || cve,CAN-2000-0191 1525 || WEB-MISC Axis Storpoint CD access || cve,CAN-2000-0191 1526 || WEB-MISC basilix sendmail.inc access || nessus,10601 || cve,CAN-2001-1044 1527 || WEB-MISC basilix mysql.class access || nessus,10601 || cve,CAN-2001-1044 1528 || WEB-MISC BBoard access || nessus,10507 || cve,CAN-2000-0629 1529 || FTP SITE overflow attempt || cve,CAN-2001-0755 || cve,CAN-2001-0770 || cve,CVE-1999-0838 1530 || FTP format string attempt 1531 || WEB-CGI bb-hist.sh attempt || nessus,10025 || cve,CAN-1999-1462 || bugtraq,142 1532 || WEB-CGI bb-hostscv.sh attempt || nessus,10460 || cve,CVE-2000-0638 1533 || WEB-CGI bb-hostscv.sh access || nessus,10460 || cve,CVE-2000-0638 1534 || WEB-CGI agora.cgi attempt || nessus,10836 || cve,CAN-2001-1199 || bugtraq,3976 1535 || WEB-CGI bizdbsearch access || cve,CAN-2000-0287 || bugtraq,1104 1536 || WEB-CGI calendar_admin.pl arbitrary command execution attempt || cve,CVE-2000-0432 1537 || WEB-CGI calendar_admin.pl access || cve,CVE-2000-0432 1538 || NNTP AUTHINFO USER overflow attempt || cve,CAN-2000-0341 || arachnids,274 1539 || WEB-CGI /cgi-bin/ls access || cve,CAN-2000-0079 || bugtraq,936 1540 || WEB-COLDFUSION ?Mode=debug attempt 1541 || FINGER version query 1542 || WEB-CGI cgimail access || cve,CVE-2000-0726 1543 || WEB-CGI cgiwrap access || nessus,10041 || cve,CVE-1999-1530 || cve,CVE-2000-0431 || cve,CVE-2001-0987 1544 || WEB-MISC Cisco Catalyst command execution attempt || cve,CAN-2000-0945 1545 || DOS cisco attempt 1546 || WEB-MISC cisco /%% DOS attempt 1547 || WEB-CGI csSearch.cgi arbitrary command execution attempt || bugtraq,4368 || nessus,10924 || cve,CAN-2002-0495 1548 || WEB-CGI csSearch.cgi access || bugtraq,4368 || nessus,10924 || cve,CAN-2002-0495 1549 || SMTP HELO overflow attempt || cve,CVE-2000-0042 || nessus,10324 1550 || SMTP ETRN overflow attempt || cve,CAN-2000-0490 1551 || WEB-MISC /CVS/Entries access 1552 || WEB-MISC cvsweb version access || cve,CAN-2000-0670 1553 || WEB-CGI /cart/cart.cgi access || cve,CVE-2000-0252 1554 || WEB-CGI dbman db.cgi access || cve,CVE-2000-0381 || nessus,10403 1555 || WEB-CGI DCShop access || cve,CAN-2001-0821 1556 || WEB-CGI DCShop orders.txt access || cve,CAN-2001-0821 1557 || WEB-CGI DCShop auth_user_file.txt access || cve,CAN-2001-0821 1558 || WEB-MISC Delegate whois overflow attempt || cve,CVE-2000-0165 1559 || WEB-MISC /doc/packages access 1560 || WEB-MISC /doc/ access || cve,CVE-1999-0678 || bugtraq,318 1561 || WEB-MISC ?open access 1562 || FTP SITE CHOWN overflow attempt || cve,CAN-2001-0065 1563 || WEB-MISC login.htm attempt || cve,CAN-1999-1533 1564 || WEB-MISC login.htm access || cve,CAN-1999-1533 1565 || WEB-CGI eshop.pl arbitrary commane execution attempt || cve,CAN-2001-1014 1566 || WEB-CGI eshop.pl access || cve,CAN-2001-1014 1567 || WEB-MISC /exchange/root.asp attempt 1568 || WEB-MISC /exchange/root.asp access 1569 || WEB-CGI loadpage.cgi directory traversal attempt 1570 || WEB-CGI loadpage.cgi access 1571 || WEB-CGI dcforum.cgi directory traversal attempt || cve,CAN-2001-0436 1572 || WEB-CGI commerce.cgi arbitrary file access attempt || nessus,10612 || bugtraq,2361 || cve,CAN-2001-0210 1573 || WEB-CGI cgiforum.pl attempt || nessus,10552 || bugtraq,1963 || cve,CVE-2000-1171 1574 || WEB-CGI directorypro.cgi attempt || cve,CAN-2001-0780 1575 || WEB-MISC Domino mab.nsf access 1576 || WEB-MISC Domino cersvr.nsf access 1577 || WEB-MISC Domino setup.nsf access 1578 || WEB-MISC Domino statrep.nsf access 1579 || WEB-MISC Domino webadmin.nsf access 1580 || WEB-MISC Domino events4.nsf access 1581 || WEB-MISC Domino ntsync4.nsf access 1582 || WEB-MISC Domino collect4.nsf access 1583 || WEB-MISC Domino mailw46.nsf access 1584 || WEB-MISC Domino bookmark.nsf access 1585 || WEB-MISC Domino agentrunner.nsf access 1586 || WEB-MISC Domino mail.box access 1587 || WEB-MISC cgitest.exe access || nessus,10623 || cve,CVE-2000-0521 || nessus,10040 || bugtraq,3885 || arachnids,265 1588 || WEB-MISC SalesLogix Eviewer access || bugtraq,1089 || cve,CAN-2000-0289 1589 || WEB-MISC musicat empower attempt 1590 || WEB-CGI faqmanager.cgi arbitrary file access attempt || nessus,10837 || bugtraq,3810 1591 || WEB-CGI faqmanager.cgi access || nessus,10837 || bugtraq,3810 1592 || WEB-CGI /fcgi-bin/echo.exe access || nessus,10838 1593 || WEB-CGI FormHandler.cgi external site redirection attempt || nessus,10075 || cve,CAN-1999-1050 1594 || WEB-CGI FormHandler.cgi access || nessus,10075 || cve,CAN-1999-1050 1595 || WEB-IIS htimage.exe access || nessus,10376 || cve,CAN-2000-0256 || cve,CAN-2000-0122 1597 || WEB-CGI guestbook.cgi access || nessus,10098 || cve,CVE-1999-0237 1598 || WEB-CGI Home Free search.cgi directory traversal attempt || cve,CAN-2000-0054 || bugtraq,921 1599 || WEB-CGI search.cgi access || cve,CAN-2000-0054 || bugtraq,921 1600 || WEB-CGI htsearch arbitrary configuration file attempt || cve,CVE-2000-0208 1601 || WEB-CGI htsearch arbitrary file read attempt || cve,CVE-2000-0208 1602 || WEB-CGI htsearch access || cve,CVE-2000-0208 1603 || WEB-MISC DELETE attempt 1604 || WEB-MISC iChat directory traversal attempt || cve,CAN-1999-0897 1605 || DOS iParty DOS attempt || cve,CAN-1999-1566 1606 || WEB-CGI icat access || cve,CAN-1999-1069 1607 || WEB-CGI HyperSeek hsx.cgi access || bugtraq,2314 || cve,CAN-2001-0253 1608 || WEB-CGI htmlscript attempt || bugtraq,2001 || cve,CVE-1999-0264 1609 || WEB-CGI faxsurvey arbitrary file read attempt || nessus,10067 || cve,CVE-1999-0262 || bugtraq,2056 1610 || WEB-CGI formmail arbitrary command execution attempt || nessus,10782 || nessus,10076 || bugtraq,1187 || cve,CVE-1999-0172 || arachnids,226 1611 || WEB-CGI eXtropia webstore access || bugtraq,1774 || cve,CVE-2000-1005 1612 || WEB-MISC ftp.pl attempt || cve,CAN-2000-0674 || bugtraq,1471 || nessus,10467 1613 || WEB-MISC handler attempt || nessus,10100 || bugtraq,380 || arachnids,235 || cve,CVE-1999-0148 1614 || WEB-MISC novell groupwise gwweb.exe attempt || bugtraq,879 || cve,CAN-1999-1006 1615 || WEB-MISC htgrep attempt || cve,CAN-2000-0832 1616 || DNS named version attempt || nessus,10028 || arachnids,278 1617 || WEB-CGI Bugzilla doeditvotes.cgi access || cve,CAN-2002-0011 1618 || WEB-IIS .asp Transfer-Encoding\: chunked || bugtraq,4474 || cve,CAN-2002-0079 1619 || EXPERIMENTAL WEB-IIS .htr request || bugtraq,4474 || cve,CAN-2002-0071 1620 || BAD TRAFFIC Non-Standard IP protocol 1621 || FTP CMD overflow attempt 1622 || FTP RNFR ././ attempt 1623 || FTP invalid MODE 1624 || FTP large PWD command 1625 || FTP large SYST command 1626 || WEB-IIS /StoreCSVS/InstantOrder.asmx request 1627 || BAD TRAFFIC Unassigned/Reserved IP protocol 1628 || WEB-CGI FormHandler.cgi directory traversal attempt attempt || nessus,10075 || cve,CAN-1999-1050 1629 || OTHER-IDS SecureNetPro traffic 1631 || CHAT AIM login 1632 || CHAT AIM send message 1633 || CHAT AIM recieve message 1634 || POP3 PASS overflow attempt || cve,CAN-1999-1511 || nessus,10325 1635 || POP3 APOP overflow attempt || cve,CAN-2000-0841 || bugtraq,1652 || nessus,10559 1636 || MISC Xtramail Username overflow attempt || cve,CAN-1999-1511 || bugtraq,791 1637 || WEB-CGI yabb.cgi access || cve,CVE-2000-0853 || arachnids,462 || bugtraq,1668 1638 || SCAN SSH Version map attempt 1639 || CHAT IRC DCC file transfer request 1640 || CHAT IRC DCC chat request 1641 || DOS DB2 dos attempt 1642 || WEB-CGI document.d2w access || cve,CAN-2000-1110 || bugtraq,2017 1643 || WEB-CGI db2www access || cve,CVE-2000-0677 1644 || WEB-CGI test-cgi attempt || nessus,10282 || cve,CVE-1999-0070 || arachnids,218 1645 || WEB-CGI testcgi access 1646 || WEB-CGI test.cgi access 1647 || WEB-CGI faxsurvey attempt (full path) || cve,CVE-1999-0262 || bugtraq,2056 || nessus,10067 1648 || WEB-CGI perl.exe command attempt || cve,CAN-1999-0509 || url,www.cert.org/advisories/CA-1996-11.html || arachnids,219 || nessus,10173 1649 || WEB-CGI perl command attempt || cve,CAN-1999-0509 || url,www.cert.org/advisories/CA-1996-11.html || arachnids,219 || nessus,10173 1650 || WEB-CGI tst.bat access || cve,CAN-1999-0885 || bugtraq,770 1651 || WEB-CGI enivorn.pl access 1652 || WEB-CGI campus attempt 1653 || WEB-CGI campus access 1654 || WEB-CGI cart32.exe access 1655 || WEB-CGI pfdispaly.cgi arbitrary command execution attempt 1656 || WEB-CGI pfdispaly.cgi access 1657 || WEB-CGI pagelog.cgi directory traversal attempt || nessus,10591 || cve,CAN-2000-0940 || bugtraq,1864 1658 || WEB-CGI pagelog.cgi access || cve,CAN-2000-0940 || bugtraq,1864 || nessus,10591 1659 || WEB-COLDFUSION sendmail.cfm access 1660 || WEB-IIS trace.axd access 1661 || WEB-IIS cmd32.exe access 1662 || WEB-MISC /~ftp access 1663 || WEB-MISC *%0a.pl access 1664 || WEB-MISC mkplog.exe access 1665 || WEB-MISC mkilog.exe access 1666 || ATTACK RESPONSES index of /cgi-bin/ response 1667 || WEB-MISC cross site scripting \(img src=javascript\) attempt 1668 || WEB-CGI /cgi-bin/ access 1669 || WEB-CGI /cgi-dos/ access 1670 || WEB-MISC /home/ftp access 1671 || WEB-MISC /home/www access 1672 || FTP CWD ~ attempt || cve,CAN-2001-0421 || bugtraq,2601 1673 || ORACLE EXECUTE_SYSTEM attempt 1674 || ORACLE connect_data\(command=version\) attempt 1675 || ORACLE misparsed login response 1676 || ORACLE select union attempt 1677 || ORACLE select like '%' attempt 1678 || ORACLE select like \"%\" attempt 1679 || ORACLE describe attempt 1680 || ORACLE all_constraints access 1681 || ORACLE all_views access 1682 || ORACLE all_source access 1683 || ORACLE all_tables access 1684 || ORACLE all_tab_columns access 1685 || ORACLE all_tab_privs access 1686 || ORACLE dba_tablespace access 1687 || ORACLE dba_tables access 1688 || ORACLE user_tablespace access 1689 || ORACLE sys.all_users access 1690 || ORACLE grant attempt 1691 || ORACLE ALTER USER attempt 1692 || ORACLE drop table attempt 1693 || ORACLE create table attempt 1694 || ORACLE alter table attempt 1695 || ORACLE truncate table attempt 1696 || ORACLE create database attempt 1697 || ORACLE alter database attempt 1698 || ORACLE execute_system attempt 1699 || P2P Fastrack (kazaa/morpheus) traffic || url,www.kazaa.com 1700 || WEB-CGI imagemap.exe access || cve,CVE-1999-0951 || arachnids,412 1701 || WEB-CGI calendar-admin.pl access || bugtraq,1215 1702 || WEB-CGI Amaya templates sendtemp.pl access || bugtraq,2504 || cve,CAN-2001-0272 1703 || WEB-CGI auktion.cgi directory traversal attempt || nessus,10638 || bugtraq,2367 || cve,CAN-2001-0212 1704 || WEB-CGI cal_make.pl directory traversal attempt || cve,CVE-2001-0463 || bugtraq,2663 1705 || WEB-CGI echo.bat arbitrary command execution attempt || nessus,10246 || cve,CAN-2000-0213 1706 || WEB-CGI echo.bat access || nessus,10246 || cve,CAN-2000-0213 1707 || WEB-CGI hello.bat arbitrary command execution attempt || nessus,10246 || cve,CAN-2000-0213 1708 || WEB-CGI hello.bat access || nessus,10246 || cve,CAN-2000-0213 1709 || WEB-CGI ad.cgi access 1710 || WEB-CGI bbs_forum.cgi access 1711 || WEB-CGI bsguest.cgi access 1712 || WEB-CGI bslist.cgi access 1713 || WEB-CGI cgforum.cgi access 1714 || WEB-CGI newdesk access 1715 || WEB-CGI register.cgi access 1716 || WEB-CGI gbook.cgi access 1717 || WEB-CGI simplestguest.cgi access 1718 || WEB-CGI statusconfig.pl access 1719 || WEB-CGI talkback.cgi directory traversal attempt 1720 || WEB-CGI talkback.cgi access 1721 || WEB-CGI adcycle access 1722 || WEB-CGI MachineInfo access 1723 || WEB-CGI emumail.cgi NULL attempt 1724 || WEB-CGI emumail.cgi access 1725 || WEB-IIS +.htr code fragment attempt || cve,CVE-2000-0630 1726 || WEB-IIS doctodep.btr access 1727 || WEB-CGI SGI InfoSearch fname access || bugtraq,1031 || arachnids,290 || cve,CVE-2000-0207 1728 || FTP CWD ~ attempt || cve,CAN-2001-0421 || bugtraq,2601 1729 || CHAT IRC channel join 1730 || WEB-CGI ustorekeeper.pl directory traversal attempt || cve,CAN-2001-0466 || nessus,10645 1731 || WEB-CGI a1stats access || nessus,10669 || cve,CAN-2001-0561 1732 || RPC UDP rwalld request 1733 || RPC TCP rwalld request 1734 || FTP USER overflow attempt || bugtraq,4638 || cve,CAN-2000-0479 || cve,CAN-2000-0656 || cve,CAN-2000-1035 || cve,CAN-2000-1194 || cve,CAN-2001-0794 || cve,CAN-2001-0826 || cve,CAN-2002-0126 || cve,CVE-2000-0943 1735 || WEB-CLIENT XMLHttpRequest attempt 1736 || WEB-PHP squirrelmail spellcheck arbitrary command attempt || bugtraq,3952 1737 || WEB-PHP squirrelmail theme arbitrary command attempt || bugtraq,4385 1738 || WEB-MISC global.inc access || bugtraq,4612 1739 || WEB-PHP DNSTools administror authentication bypass attempt || bugtraq,4617 1740 || WEB-PHP DNSTools authentication bypass attempt || bugtraq,4617 1741 || WEB-PHP DNSTools access || bugtraq,4617 1742 || WEB-PHP Blahz-DNS dostuff.php modify user attempt || bugtraq,4618 1743 || WEB-PHP Blahz-DNS dostuff.php access || bugtraq,4618 1744 || WEB-MISC SecureSite authentication bypass attempt || bugtraq,4621 1745 || WEB-PHP Messagerie supp_membre.php access || bugtraq,4635 1746 || RPC UDP cachefsd request || cve,CAN-2002-0084 || bugtraq,4674 1747 || RPC TCP cachefsd request || cve,CAN-2002-0084 || bugtraq,4674 1748 || FTP command overflow attempt || bugtraq,4638 1749 || EXPERIMENTAL WEB-IIS .NET trace.axd access 1750 || WEB-IIS users.xml access 1751 || EXPLOIT cachefsd buffer overflow attempt || cve,CAN-2002-0084 || bugtraq,4631 1752 || MISC AIM AddExternalApp attempt || url,www.w00w00.org/files/w00aimexp/ 1753 || WEB-IIS as_web.exe access || bugtraq,4670 1754 || WEB-IIS as_web4.exe access || bugtraq,4670 1755 || IMAP partial body buffer overflow attempt || bugtraq,4713 || cve,CAN-2002-0379 1756 || WEB-IIS NewsPro administration authentication attempt 1757 || WEB-MISC b2 arbitrary command execution attempt 1758 || WEB-MISC b2 access 1759 || MS-SQL xp_cmdshell program execution (445) 1760 || OTHER-IDS ISS RealSecure 6 event collector connection attempt 1761 || OTHER-IDS ISS RealSecure 6 daemon connection attempt 1762 || WEB-CGI phf arbitrary command execution attempt || bugtraq,629 || arachnids,128 || cve,CVE-1999-0067 1763 || WEB-CGI Nortel Contivity cgiproc DOS attempt || nessus,10160 || bugtraq,938 || cve,CVE-2000-0064 || cve,CVE-2000-0063 1764 || WEB-CGI Nortel Contivity cgiproc DOS attempt || nessus,10160 || bugtraq,938 || cve,CVE-2000-0064 || cve,CVE-2000-0063 1765 || WEB-CGI Nortel Contivity cgiproc access || nessus,10160 || bugtraq,938 || cve,CVE-2000-0064 || cve,CVE-2000-0063 1766 || WEB-MISC search.dll directory listing attempt || cve,CAN-2000-0835 || nessus,10514 1767 || WEB-MISC search.dll access || nessus,10514 || cve,CAN-2000-0835 1768 || WEB-IIS header field buffer overflow attempt || bugtraq,4476 1769 || WEB-MISC .DS_Store access || url,www.macintouch.com/mosxreaderreports46.html 1770 || WEB-MISC .FBCIndex access || url,www.securiteam.com/securitynews/5LP0O005FS.html 1772 || WEB-IIS pbserver access || url,www.microsoft.com/technet/security/bulletin/ms00-094.asp 1773 || WEB-PHP php.exe access || url,www.securitytracker.com/alerts/2002/Jan/1003104.html 1774 || WEB-PHP bb_smilies.php access || url,www.securiteam.com/securitynews/Serious_security_hole_in_PHP-Nuke__bb_smilies_.html 1775 || MYSQL root login attempt 1776 || MYSQL show databases attempt 1777 || FTP EXPLOIT STAT * dos attempt || bugtraq,4482 1778 || FTP EXPLOIT STAT ? dos attempt || bugtraq,4482 1779 || FTP CWD .... attempt || bugtraq,4884 1780 || IMAP EXPLOIT partial body overflow attempt || bugtraq,4713 1781 || PORN dildo 1782 || PORN nipple clamp 1783 || PORN oral sex 1784 || PORN nude celeb 1786 || PORN raw sex 1787 || WEB-CGI csPassword.cgi access || bugtraq,4885 || bugtraq,4886 || bugtraq,4887 || bugtraq,4889 1788 || WEB-CGI csPassword password.cgi.tmp access || bugtraq,4889 1789 || CHAT IRC dns request 1790 || CHAT IRC dns response 1791 || BACKDOOR fragroute trojan connection attempt || bugtraq,4898 1792 || NNTP return code buffer overflow attempt || bugtraq,4900 || cve,CAN-2002-0909 1794 || PORN masturbation 1795 || PORN ejaculation 1797 || PORN BDSM 1800 || VIRUS Klez Incoming 1805 || WEB-CGI Oracle reports CGI access || bugtraq,4848 1806 || WEB-IIS .htr Transfer-Encoding\: chunked || bugtraq,5003 || cve,CAN-2002-0364 1807 || WEB-MISC Transfer-Encoding\: chunked || bugtraq,4474 || cve,CAN-2002-0079 || bugtraq,5033 || cve,CAN-2002-0392 1808 || WEB-MISC apache chunked encoding memory corruption exploit attempt || bugtraq,5033 || cve,CAN-2002-0392 1809 || WEB-MISC Apache Chunked-Encoding worm attempt || bugtraq,4474 || cve,CAN-2002-0079 || bugtraq,5033 || cve,CAN-2002-0392 1810 || ATTACK-RESPONSE successful gobbles ssh exploit (GOBBLE) || bugtraq,5093 1811 || ATTACK-RESPONSE successful gobbles ssh exploit (uname) || bugtraq,5093 1812 || EXPLOIT gobbles SSH exploit attempt || bugtraq,5093 1813 || ICMP digital island bandwidth query 1814 || WEB-MISC CISCO VoIP DOS ATTEMPT || bugtraq,4794 1815 || WEB-PHP directory.php arbitrary command attempt || bugtraq,4278 || cve,CAN-2002-0434 1816 || WEB-PHP directory.php access || bugtraq,4278 || cve,CAN-2002-0434 1817 || WEB-IIS MS Site Server default login attempt || nessus,11018 1818 || WEB-IIS MS Site Server admin attempt || nessus,11018 1819 || MISC Alcatel PABX 4400 connection attempt || nessus,11019 1820 || WEB-MISC IBM Net.Commerce orderdspc.d2w access || cve,CVE-2001-0319 || nessus,11020 1821 || EXPLOIT LPD dvips remote command execution attempt || cve,CVE-2001-1002 || nessus,11023 1822 || WEB-CGI alienform.cgi directory traversal attempt || nessus,11027 || bugtraq,4983 1823 || WEB-CGI AlienForm af.cgi directory traversal attempt || nessus,11027 || bugtraq,4983 1824 || WEB-CGI alienform.cgi access || nessus,11027 || bugtraq,4983 1825 || WEB-CGI AlienForm af.cgi access || nessus,11027 || bugtraq,4983 1826 || WEB-MISC WEB-INF access || nessus,11037 1827 || WEB-MISC tomcat servlet mapping cross site scripting attempt || nessus,11041 || bugtraq,5193 1828 || WEB-MISC iPlanet Search directory traversal attempt || nessus,11043 || bugtraq,5191 1829 || WEB-MISC tomcat TroubleShooter servlet access || nessus,11046 || bugtraq,4575 1830 || WEB-MISC tomcat SnoopServlet servlet access || nessus,11046 || bugtraq,4575 1831 || WEB-MISC jigsaw dos attempt || nessus,11047 1832 || CHAT ICQ forced user addition || bugtraq,3226 || cve,CAN-2001-1305 1833 || PORN naked lesbians 1834 || WEB-PHP PHP-Wiki cross site scripting attempt || bugtraq,5254 1835 || WEB-MISC Macromedia SiteSpring cross site scripting attempt || bugtraq,5249 1836 || PORN alt.binaries.pictures.erotica 1837 || PORN alt.binaries.pictures.tinygirls 1838 || EXPLOIT SSH server banner overflow || bugtraq,5287 1839 || WEB-MISC mailman cross site scripting attempt || bugtraq,5298 1840 || WEB-CLIENT javascript document.domain attempt || bugtraq,5346 1841 || WEB-CLIENT javascript URL host spoofing attempt || bugtraq,5293 1842 || IMAP login buffer overflow attempt || nessus,10125 || cve,CVE-1999-0005 1843 || BACKDOOR trinity connection attempt || nessus,10501 || cve,CAN-2000-0138 1844 || IMAP authenticate overflow attempt || nessus,10292 || cve,CVE-1999-0042 1845 || IMAP list overflow attempt || nessus,10374 || cve,CAN-2000-0284 1846 || EXPERIMENTAL POLICY vncviewer java applet download attempt || nessus,10758 1847 || WEB-MISC webalizer access || nessus,10816 || cve,CAN-1999-0643 1848 || WEB-MISC webcart-lite access || cve,CAN-1999-0610 || nessus,10298 1849 || WEB-MISC webfind.exe access || cve,CAN-2000-0622 || nessus,10475 1850 || WEB-MISC way-board.cgi access || nessus,10610 1851 || WEB-MISC active.log access || nessus,10470 || cve,CAN-2000-0642 1852 || WEB-MISC robots.txt access || nessus,10302 1853 || BACKDOOR win-trin00 connection attempt || cve,CAN-2000-0138 || nessus,10307 1854 || DDOS Stacheldraht handler->agent (niggahbitch) || url,staff.washington.edu/dittrich/misc/stacheldraht.analysis 1855 || DDOS Stacheldraht agent->handler (skillz) || url,staff.washington.edu/dittrich/misc/stacheldraht.analysis 1856 || DDOS Stacheldraht handler->agent (ficken) || url,staff.washington.edu/dittrich/misc/stacheldraht.analysis 1857 || WEB-MISC robot.txt access || nessus,10302 1858 || WEB-MISC CISCO PIX Firewall Manager directory traversal attempt || bugtraq,691 || nessus,10819 1859 || WEB-MISC Sun JavaServer default password login attempt || nessus,10995 1860 || WEB-MISC Linksys router default password login attempt \(\:admin\) || nessus,10999 1861 || EXPERIMENTAL WEB-MISC Linksys router default password login attempt \(admin\:admin\) || nessus,10999 1862 || WEB-CGI mrtg.cgi directory traversal attempt || nessus,11001 1863 || WEB-CGI mrtg.cgi access || nessus,11001 1864 || FTP SITE NEWER attempt || cve,CVE-1999-0880 || nessus,10319 1865 || WEB-CGI webdist.cgi arbitrary command attempt || bugtraq,374 || cve,CVE-1999-0039 || nessus,10299 1866 || POP3 USER overflow attempt || bugtraq,789 || cve,CVE-1999-0494 || nessus,10311 1867 || MISC xdmcp info query || nessus,10891 1868 || WEB-CGI story.pl arbitrary file read attempt || nessus,10817 || cve,CVE-2001-0804 1869 || WEB-CGI story.pl access || nessus,10817 || cve,CVE-2001-0804 1870 || WEB-CGI siteUserMod.cgi access || nessus,10253 || cve,CVE-2000-0117 1871 || WEB-MISC Oracle XSQLConfig.xml access || nessus,10855 || cve,CAN-2002-0568 1872 || WEB-MISC Oracle Dynamic Monitoring Services (dms) access || nessus,10848 1873 || WEB-MISC globals.jsa access || nessus,10850 || cve,CAN-2002-0562 1874 || WEB-MISC Oracle Java Process Manager access || nessus,10851 1875 || WEB-CGI cgicso access || nessus,10779 || nessus,10780 1876 || WEB-CGI nph-publish.cgi access || nessus,10164 || cve,CVE-1999-1177 1877 || WEB-CGI printenv access || nessus,10503 || cve,CVE-2000-0868 1878 || WEB-CGI sdbsearch.cgi access || nessus,10503 || cve,CVE-2000-0868 1879 || WEB-CGI book.cgi arbitrary command execution attempt || cve,CVE-2001-1114 || bugtraq,3178 || nessus,10721 1880 || WEB-MISC oracle web application server access || cve,CVE-2000-0169 || bugtraq,1053 || nessus,10348 1881 || WEB-MISC bad HTTP/1.1 request, potentual worm attack || url,securityresponse.symantec.com/avcenter/security/Content/2002.09.13.html 1882 || ATTACK RESPONSES id check returned www 1883 || ATTACK RESPONSES id check returned nobody 1884 || ATTACK RESPONSES id check returned web 1885 || ATTACK RESPONSES id check returned http 1886 || ATTACK RESPONSES id check returned apache 1887 || MISC OpenSSL Worm traffic || url,www.cert.org/advisories/CA-2002-27.html 1888 || FTP SITE CPWD overflow attempt || bugtraq,5427 || cve,CAN-2002-0826 1889 || MISC slapper worm admin traffic || url,www.cert.org/advisories/CA-2002-27.html || url,isc.incidents.org/analysis.html?id=167 1890 || RPC status GHBN format string attack || bugtraq,1480 || cve,CVE-2000-0666 1891 || RPC status GHBN format string attack || bugtraq,1480 || cve,CVE-2000-0666 1892 || SNMP null community string attempt || cve,CAN-1999-0517 1893 || SNMP missing community string attempt || cve,CAN-1999-0517 1894 || EXPLOIT kadmind buffer overflow attempt || cve,CAN-2002-1235 || url,www.kb.cert.org/vuls/id/875073 1895 || EXPLOIT kadmind buffer overflow attempt || cve,CAN-2002-1235 || url,www.kb.cert.org/vuls/id/875073 1896 || EXPLOIT kadmind buffer overflow attempt || cve,CAN-2002-1235 || url,www.kb.cert.org/vuls/id/875073 1897 || EXPLOIT kadmind buffer overflow attempt || cve,CAN-2002-1235 || url,www.kb.cert.org/vuls/id/875073 1898 || EXPLOIT kadmind buffer overflow attempt || cve,CAN-2002-1235 || url,www.kb.cert.org/vuls/id/875073 1899 || EXPLOIT kadmind buffer overflow attempt || cve,CAN-2002-1235 || url,www.kb.cert.org/vuls/id/875073 1900 || ATTACK-RESPONSE successful kadmind bufferflow attempt || cve,CAN-2002-1235 || url,www.kb.cert.org/vuls/id/875073 1901 || ATTACK-RESPONSE successful kadmind bufferflow attempt || cve,CAN-2002-1235 || url,www.kb.cert.org/vuls/id/875073 1902 || IMAP lsub overflow attempt || nessus,10374 || cve,CAN-2000-0284 1903 || IMAP rename overflow attempt || nessus,10374 || cve,CAN-2000-0284 1904 || IMAP find overflow attempt || nessus,10374 || cve,CAN-2000-0284 1905 || RPC AMD UDP amqproc_mount plog overflow attempt || cve,CVE-1999-0704 || bugtraq,614 1906 || RPC AMD TCP amqproc_mount plog overflow attempt || cve,CVE-1999-0704 || bugtraq,614 1907 || RPC CMSD UDP CMSD_CREATE buffer overflow attempt || cve,CVE-1999-0696 || bugtraq,524 1908 || RPC CMSD TCP CMSD_CREATE buffer overflow attempt || cve,CVE-1999-0696 || bugtraq,524 1909 || RPC CMSD TCP CMSD_INSERT buffer overflow attempt || cve,CVE-1999-0696 || url,www.cert.org/advisories/CA-99-08-cmsd.html 1910 || RPC CMSD udp CMSD_INSERT buffer overflow attempt || cve,CVE-1999-0696 || url,www.cert.org/advisories/CA-99-08-cmsd.html 1911 || RPC sadmind UDP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt || cve,CVE-1999-0977 || bugtraq,866 1912 || RPC sadmind TCP NETMGT_PROC_SERVICE CLIENT_DOMAIN overflow attempt || cve,CVE-1999-0977 || bugtraq,866 1913 || RPC STATD UDP stat mon_name format string exploit attempt || cve,CVE-2000-0666 || bugtraq,1480 1914 || RPC STATD TCP stat mon_name format string exploit attempt || cve,CVE-2000-0666 || bugtraq,1480 1915 || RPC STATD UDP monitor mon_name format string exploit attempt || cve,CVE-2000-0666 || bugtraq,1480 1916 || RPC STATD TCP monitor mon_name format string exploit attempt || cve,CVE-2000-0666 || bugtraq,1480 1917 || SCAN UPNP service discover attempt 1918 || SCAN SolarWinds IP scan attempt 1919 || FTP CWD overflow attempt || cve,CAN-2000-1035 || cve,CAN-2000-1194 || cve,CAN-2002-0126 1920 || FTP SITE NEWER overflow attempt || cve,CVE-1999-0800 1921 || FTP SITE ZIPCHK attempt || cve,CVE-2000-0040 1922 || RPC portmap TCP proxy attempt 1923 || RPC portmap UDP proxy attempt 1924 || RPC mountd UDP export request || arachnids,26 1925 || RPC mountd TCP exportall request || arachnids,26 1926 || RPC mountd UDP exportall request || arachnids,26 1927 || FTP authorized_keys 1928 || FTP shadow retreval attempt 1929 || BACKDOOR TCPDUMP/PCAP trojan traffic || url,hlug.fscker.com 1930 || IMAP auth overflow attempt || cve,CVE-1999-0005 1931 || WEB-CGI rpc-nlog.pl access || cve,CAN-1999-1278 1932 || WEB-CGI rpc-smb.pl access || cve,CAN-1999-1278 1933 || WEB-CGI cart.cgi access 1934 || POP2 FOLD overflow attempt || bugtraq,283 || cve,CVE-1999-0920 1935 || POP2 FOLD arbitrary file attempt 1936 || POP3 AUTH overflow attempt 1937 || POP3 LIST overflow attempt || bugtraq,948 || cve,CAN-2000-0096 1938 || POP3 XTND overflow attempt 1939 || MISC bootp hardware address lenght overflow || cve,CAN-1999-0798 1940 || MISC bootp invalid hardware type || cve,CAN-1999-0798 1941 || TFTP filename overflow attempt || cve,CAN-2002-0813 || bugtraq,5328 1942 || FTP RMDIR overflow attempt 1943 || WEB-MISC /Carello/add.exe access || cve,CVE-2000-0396 || bugtraq,1245 1944 || WEB-MISC /ecscripts/ecware.exe access 1945 || WEB-IIS unicode directory traversal attempt || cve,CVE-2000-0884 1946 || WEB-MISC answerbook2 admin attempt 1947 || WEB-MISC answerbook2 arbitrary command execution attempt 1948 || DNS zone transfer UDP || cve,CAN-1999-0532 || arachnids,212 1949 || RPC portmap SET attempt TCP 111 1950 || RPC portmap SET attempt UDP 111 1951 || RPC mountd TCP mount request 1952 || RPC mountd UDP export request 1953 || RPC AMD TCP pid request 1954 || RPC AMD UDP pid request 1955 || RPC AMD TCP version request 1956 || RPC AMD UDP version request 1957 || RPC sadmind UDP PING || bugtraq,866 1958 || RPC sadmind TCP PING || bugtraq,866 1959 || RPC portmap request NFS UDP 1960 || RPC portmap request NFS TCP 1961 || RPC portmap request RQUOTA UDP 1962 || RPC portmap request RQUOTA TCP 1963 || RPC RQUOTA UDP getquota overflow attempt || cve,CVE-1999-0974 || bugtraq,864 1964 || RPC tooltalk UDP overflow attempt || cve,CVE-1999-0003 || bugtraq,122 1965 || RPC tooltalk TCP overflow attempt || cve,CVE-1999-0003 || bugtraq,122 1966 || MISC GlobalSunTech Access Point Information Discolsure attempt || bugtraq,6100 1967 || WEB-PHP phpbb quick-reply.php arbitrary command attempt || bugtraq,6173 1968 || WEB-PHP phpbb quick-reply.php access || bugtraq,6173 1969 || WEB-MISC ion-p access || bugtraq,6091 1970 || WEB-IIS MDAC Content-Type overflow attempt || cve,CAN-2002-1142 || url,www.foundstone.com/knowledge/randd-advisories-display.html?id=337 1971 || FTP SITE EXEC format string attempt 1972 || FTP PASS overflow attempt || cve,CAN-2000-1035 || cve,CAN-2002-0126 1973 || FTP MKD overflow attempt || cve,CAN-1999-0911 || bugtraq,612 1974 || FTP REST overflow attempt || cve,CAN-2001-0826 1975 || FTP DELE overflow attempt || cve,CAN-2001-0826 1976 || FTP RMD overflow attempt || cve,CAN-2001-0826 1977 || WEB-MISC xp_regwrite attempt 1978 || WEB-MISC xp_regdeletekey attempt 1979 || WEB-MISC perl post attempt || bugtraq,5520 || nessus,11158 1980 || BACKDOOR DeepThroat 3.1 Connection attempt 1981 || BACKDOOR DeepThroat 3.1 Connection attempt [3150] 1982 || BACKDOOR DeepThroat 3.1 Server Response [3150] || arachnids,106 1983 || BACKDOOR DeepThroat 3.1 Connection attempt [4120] 1984 || BACKDOOR DeepThroat 3.1 Server Response [4120] || arachnids,106 1985 || BACKDOOR Doly 1.5 server response 1986 || CHAT MSN file transfer request 1 1988 || CHAT MSN file transfer accept 1989 || CHAT MSN file transfer reject 1990 || CHAT MSN user search 1991 || CHAT MSN login attempt 1992 || FTP LIST directory traversal attempt || nessus,11112 || bugtraq,2618 || cve,CVE-2001-0680 1993 || IMAP login buffer overflow attempt || bugtraq,6298 1994 || WEB-CGI vpasswd.cgi access || nessus,11165 1995 || WEB-CGI alya.cgi access || nessus,11118 1996 || WEB-CGI viralator.cgi access || cve,CAN-2001-0849 || nessus,11107 1997 || WEB-PHP read_body.php access attempt || bugtraq,6302 1998 || WEB-PHP calendar.php access || bugtraq,5820 || nessus,11179 1999 || WEB-PHP edit_image.php access || cve,CVE-2001-1020 || nessus,11104 2000 || WEB-PHP readmsg.php access || nessus,11073 2001 || WEB-CGI smartsearch.cgi access 2002 || WEB-PHP external include path 2003 || MS-SQL Worm propagation attempt || url,vil.nai.com/vil/content/v_99992.htm || bugtraq,5311 || bugtraq,5310 2004 || MS-SQL Worm propagation attempt OUTBOUND 2005 || RPC UDP kcms_server request 2006 || RPC TCP kcms_server request 2007 || RPC kcms_server directory traversal attempt 2008 || MISC CVS invalid user authentication response 2009 || MISC CVS invalid repository response 2010 || MISC CVS double free exploit attempt response || bugtraq,6650 || cve,CAN-2003-0015 2011 || MISC CVS invalid directory response || bugtraq,6650 || cve,CAN-2003-0015 2012 || MISC CVS missing cvsroot response 2013 || MISC CVS invalid module response 2087 || SMTP From comment overflow 2090 || WEB-IIS WEBDAV exploit attempt || bugtraq,7716 || cve,CAN-2003-0109 2091 || WEB-IIS WEBDAV nessus safe scan attempt || nessus,11412 || bugtraq,7116 || cve,CAN-2003-0109 2100 || BACKDOOR SubSeven 2.1 Gold server connection response 2101 || NETBIOS SMB SMB_COM_TRANSACTION Max Parameter of 0 DOS Attempt || url,www.corest.com/common/showdoc.php?idx=262 || url,www.microsoft.com/technet/security/bulletin/MS02-045.asp || cve,CAN-2002-0724 2102 || NETBIOS SMB SMB_COM_TRANSACTION Max Data Count of 0 DOS Attempt || url,www.corest.com/common/showdoc.php?idx=262 || url,www.microsoft.com/technet/security/bulletin/MS02-045.asp || cve,CAN-2002-0724 2103 || NETBIOS SMB trans2open buffer overflow attempt || url,www.digitaldefense.net/labs/advisories/DDI-1013.txt || cve,CAN-2003-0201