[Dshield] Re: New IIS directory traversal worm, or just a tool sig?

James C Slora Jr Jim.Slora at phra.com
Thu Nov 7 18:42:17 GMT 2002


From: Tim Rushing wrote

> All of mine are of the format that Mr. Simpson indicates.

This is just a difference in log format. My packet captures match the
Rushing and Simpson logs. My HTTP request log simply concatenates the Host
specified in the GET statement with the raw request.

Sorry to post the logs in an odd format.




More information about the list mailing list