Re: New scanner?

On Thu, 2002-11-21 at 04:29, Jeremy wrote:
> Hello all,

I've been seeing many variations on this scheme (but not this exact one) over the last month or so. Most that I have investigated by looking at the argus logs are clearly FxScanner (probe to tcp 57 - gives it away). This tool is really a delivery vehicle for what ever exploits you want to code into it. I.e it is easily extend and there are now many variants floating around.

Our record so far is 40,000 IIS exploits in an hour from one host delivered to web servers on campus. I can't remember if it checks to make sure it is IIS first or not.

-- 
Russell Fulton, Computer and Network Security Officer
The University of Auckland,  New Zealand

"It aint necessarily so"  - Gershwin


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: 
http://aris.securityfocus.com