|
Posted by Mike - EMAIL IGNORED on June 18, 2005, 9:18 am
If you were Registered and logged in, you could reply and use other advanced thread options
On RH, I have been capturing http packets with tethereal
and examining them with ethereal. In one obvious buffer
overflow attack I found:
Frame size = 1506
IP total length = 1492
NTLMSSP data size = 1044
The hex dump shows the NTLMSSP to be in >addition< to the
ethernet frame size, which to me, does not make sense.
The tethereal filter is:
tcp port 80
There are continuation packets, but they do not contain
the correct information.
Thanks for your help,
Mike.
| 
XML site map