unkown directory traversal attempts

["Kevin Holmquist" <kevinh () netronin org>]

I found some directory traversal attempts in my snort logs today.  Does
anyone know what tool is being used?

Here is a sample:

CID:45922 [**] IDS297/web-misc_http-directory-traversal1 [**]
2001-10-12 19:12:47 202.119.199.39:1357 -> xxx.xxx.xxx.xxx:80
TCP TTL:35 TOS:0x0 ID:29610 IPLen: DgmLen:1500 HLen:5 CSumIP:0x6B68
***A**** Seq:0x3EADCA69 Ack:0x3049A264 Win:0x4470 CSumTCP:0x2422
Payload (Hex):
4745 5420 2F69 6E64 6578 2E68 746D 6C25 3366 6E6E
6F6D 7769 6F70 7365 696B 3D2F 2E2E 2F6E 6F62 7176
7561 6674 6165 7467 777A 7963 7678 7564 6A78 6463
7877 726E 7169 6674 6962 7968 6364 706A 6A6E 7671
7274 766E 6B76 716B 6966 7A62 7A69 6F67 6676 667A
6176 616B 7875 7670 7769 6977 6277 6264 666E 6567
767A 7468 777A 6165 7162 706F 6D64 6E64 7072 6A6A
6E7A 6361 766B 716A 676E 6D64 726D 7A6C 7761 6570
667A 7374 746A 7665 7A74 6462 6961 6A75 7070 6177
7777 6678 7479 667A 7A61 7263 796B 7A63 626B 7172
686F 736D 6169 6A79 6761 6379 7268 6367 6B64 716C
6D6D 6F6E 6C72 7A74 786B 756D 696A 7368 6A7A 7A77
686E 6962 7468 6B7A 7871 6165 766B 6668 676B 7468
7276 6566 6367 7976 6A79 6E75 7468 7065 6363 6563
6572 7570 706B 7965 6166 6669 6766 6E68 7478 6B65
6E66 786B 7268 647A 6B63 7363 7478 6E78 7764 7666
7872 6F63 6471 6968 666E 6E77 636A 7A67 6462 646F
7069 6B78 756D 6E73 766B 6A66 6267 737A 6A74 6469
7471 786F 7375 6B75 6E65 6676 6473 6366 6575 6761
6F6A 7271 756A 7975 757A 7464 6877 637A 666E 6A67
7368 7775 6F78 726B 716B 6567 7371 6273 776E 6F78
6D72 6F71 6F61 7375 6471 7876 6964 6E78 7563 6277
7673 7265 7673 6E75 6866 6867 6B72 6E6B 6F71 6C76
7277 6564 7764 7671 627A 7775 7367 6472 6D6B 6A70
6C70 7667 6D75 7570 6973 6D75 7076 6766 7868 7368
6B63 6673 787A 626A 6762 7565 6364 6463 7777 7968
726D 6875 6A69 776C 6C6E 6E64 797A 706C 7762 6C65
7466 7A6E 656A 6774 7065 756C 6874 7279 6762 666B
6A68 7071 6366 7776 756F 6F6F 6C63 6C61 686B 6E7A
7078 6464 7771 6868 6C76 6D74 7772 7870 726D 636E
6676 7761 766F 6261 7266 6D69 7564 6D68 7973 6174
6C6C 776A 6C70 736D 756E 6F6B 6178 6A73 6E6F 7A76
6870 6669 616A 7A64 6866 6574 796D 746E 6577 6362
6668 7877 646F 6F74 636C 7871 6576 7A7A 7477 6473
787A 6A77 6264 6978 6870 6F68 796A 6775 6267 6765
6A69 6E6A 7677 6B75 706D 7263 6163 6373 7063 7171
7077 7269 6774 7463 716B 676F 696F 7A69 7576 6178
6C78 6E66 6179 6B65 6279 6875 626C 6475 766E 6879
6D6C 7975 656E 6763 6675 6F76 6F65 6864 6B62 6D72
7564 6F64 7662 687A 7A79 6F61 786B 7275 6873 7164
636B 696E 7378 6777 706C 7779 7370 6B71 646F 6577
6B70 616D 7473 797A 7962 6262 7370 6C6D 7261 7962
7066 7074 646C 6878 7971 6C6C 657A 6679 6E70 7662
6566 646C 626D 7063 7878 7869 6C62 6F64 7067 6869
6D7A 7275 7079 6F72 6472 6467 7274 6879 7878 7465
6B6F 6C77 6B69 616C 756D 7776 6D74 7577 6474 7375
6D6E 7862 6C6E 736E 6466 7A6F 6C62 726B 6878 7461
6C6A 7065 6671 6F78 706E 6C6A 6D7A 6664 7A64 7862
6977 656C 7268 7066 636B 6463 6D65 7976 6D71 7668
6263 7A75 6E6B 7A6A 7361 6678 7866 6575 6779 6870
6A63 7770 7478 7871 7A61 7666 6563 6B64 7771 7A74
776B 796F 786D 7A6D 6D64 7372 646B 6C66 6568 7A6E
796F 6A6E 6979 6276 6D78 6975 6468 7164 7179 7765
6976 7565 7263 6A65 616C 7072 7278 6664 6668 7A72
6C73 776C 7A6B 7069 646F 7676 646B 796F 7873 676B
7975 6F6C 626F 6E62 6675 6C6A 716A 6C79 7767 6466
626D 6C61 6B62 706C 6174 6472 6B61 766C 6D65 6C78
7867 636C 6969 7A61 6474 6966 6B72 7261 7563 7975
6773 6E68 7362 6868 7166 736E 786D 7667 6675 7474
7672 6576 6A69 686A 766F 6A77 6570 7876 7867 6774
6471 7869 7865 6769 7A66 7276 756D 7670 6963 747A
6F61 7170 736F 6A62 6B66 7470 7966 6C72 6E64 726C
6568 6D76 6C76 7266 7975 6B6C 6970 7673 7A78 7461
6D78 7A6B 6465 7975 6173 636A 746F 6265 6E74 7776
626D 6161 6861 6870 6F69 706D 636E 6F67 6267 7467
6273 6B68 6462 6D77 6669 6861 7A6A 706B 697A 7561
7473 6E6A 6167 6265 6174 6F74 6764 7868 7572 7871
6C66 6E69 6B6E 747A 7672 786E 6C7A 7570 7271 7069
6C67 7563 7969 7A70 6279 6B77 6769 6264 6F61 7974
706A 6567 6F71 6674 736A 6163 6271 7A62 7264 7A61
6679 6366 7074 6861 7966 7574 6F6A 6A74 7069 7565
7267 6D70 676C 6376 686A 7A71 636C 7161 746B 706E
6163 7874 7666 6B78 6D6E 6F61 7872 6972 6265 7778
Payload (ASCII):
GET /index.html%3fnn
omwiopseik=/../nobqv
uaftaetgwzycvxudjxdc
xwrnqiftibyhcdpjjnvq
rtvnkvqkifzbziogfvfz
avakxuvpwiiwbwbdfneg
vzthwzaeqbpomdndprjj
nzcavkqjgnmdrmzlwaep
fzsttjveztdbiajuppaw
wwfxtyfzzarcykzcbkqr
hosmaijygacyrhcgkdql
mmonlrztxkumijshjzzw
hnibthkzxqaevkfhgkth
rvefcgyvjynuthpeccec
eruppkyeaffigfnhtxke
nfxkrhdzkcsctxnxwdvf
xrocdqihfnnwcjzgdbdo
pikxumnsvkjfbgszjtdi
tqxosukunefvdscfeuga
ojrqujyuuztdhwczfnjg
shwuoxrkqkegsqbswnox
mroqoasudqxvidnxucbw
vsrevsnuhfhgkrnkoqlv
rwedwdvqbzwusgdrmkjp
lpvgmuupismupvgfxhsh
kcfsxzbjgbuecddcwwyh
rmhujiwllnndyzplwble
tfznejgtpeulhtrygbfk
jhpqcfwvuooolclahknz
pxddwqhhlvmtwrxprmcn
fvwavobarfmiudmhysat
llwjlpsmunokaxjsnozv
hpfiajzdhfetymtnewcb
fhxwdootclxqevzztwds
xzjwbdixhpohyjgubgge
jinjvwkupmrcaccspcqq
pwrigttcqkgoioziuvax
lxnfaykebyhublduvnhy
mlyuengcfuovoehdkbmr
udodvbhzzyoaxkruhsqd
ckinsxgwplwyspkqdoew
kpamtsyzybbbsplmrayb
pfptdlhxyqllezfynpvb
efdlbmpcxxxilbodpghi
mzrupyordrdgrthyxxte
kolwkialumwvmtuwdtsu
mnxblnsndfzolbrkhxta
ljpefqoxpnljmzfdzdxb
iwelrhpfckdcmeyvmqvh
bczunkzjsafxxfeugyhp
jcwptxxqzavfeckdwqzt
wkyoxmzmmdsrdklfehzn
yojniybvmxiudhqdqywe
ivuercjealprrxfdfhzr
lswlzkpidovvdkyoxsgk
yuolbonbfuljqjlywgdf
bmlakbplatdrkavlmelx
xgcliizadtifkrraucyu
gsnhsbhhqfsnxmvgfutt
vrevjihjvojwepxvxggt
dqxixegizfrvumvpictz
oaqpsojbkftpyflrndrl
ehmvlvrfyuklipvszxta
mxzkdeyuascjtobentwv
bmaahahpoipmcnogbgtg
bskhdbmwfihazjpkizua
tsnjagbeatotgdxhurxq
lfnikntzvrxnlzuprqpi
lgucyizpbykwgibdoayt
pjegoqftsjacbqzbrdza
fycfpthayfutojjtpiue
rgmpglcvhjzqclqatkpn
acxtvfkxmnoaxrirbewx

CID:45923 [**] IDS297/web-misc_http-directory-traversal1 [**]
2001-10-12 19:12:48 202.119.199.39:1357 -> xxx.xxx.xxx.xxx:80
TCP TTL:35 TOS:0x0 ID:29612 IPLen: DgmLen:246 HLen:5 CSumIP:0x704C
***AP*** Seq:0x3EADD01D Ack:0x3049A264 Win:0x4470 CSumTCP:0x9723
Payload (Hex):
6875 6779 6473 756B 6E6B 747A 7679 7A69 7374 7670
6161 626C 686D 6A69 2F2E 2E2F 2E2F 6366 646F 6373
2F2E 2F20 4854 5450 2F31 2E30 0D0A 5573 6572 2D41
6765 6E74 3A20 4D6F 7A69 6C6C 612F 352E 3020 5B65
6E5D 2028 5769 6E39 353B 2055 290D 0A43 6F6F 6B69
653A 206C 616E 673D 656E 673B 2065 7870 6972 6573
3D53 756E 2C20 3133 2D4F 6374 2D30 3220 3031 3A31
323A 3539 2047 4D54 0D0A 5265 6665 7265 723A 2068
7474 703A 2F2F 7777 772E 6E65 7472 6F6E 696E 2E6F
7267 2F0D 0A43 6F6E 6E65 6374 696F 6E3A 2063 6C6F
7365 0D0A 0D0A
Payload (ASCII):
hugydsuknktzvyzistvp
aablhmji/.././cfdocs
/./ HTTP/1.0..User-A
gent: Mozilla/5.0 [e
n] (Win95; U)..Cooki
e: lang=eng; expires
=Sun, 13-Oct-02 01:1
2:59 GMT..Referer: h
ttp://www.netronin.o
rg/..Connection: clo
se....


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com