Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Scanning for Trixbox vulnerabilities SANS ISC InfoSec Forums

Participate: Learn more about our honeypot network
https://isc.sans.edu/honeypot.html

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Scanning for Trixbox vulnerabilities

A reader writes in:

HTTP scans have started to include a TRIXBOX (trixbox.org) vulnerability.  Tribox is a modified implementation of the asterisk product focused at commercial enterprises.  It combines asterisk with some Cisco monitoring features.  It appears attackers are focusing on the cisco DOMIT RSS feature.

xx.xx.xxx.xxx - - [31/Jan/2009:00:58:15 -1000] "GET /cisco/services/rss/DOMIT/

domit_rss/domitBanner.gif HTTP/1.1" 404 26 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)"
 Chris

140 Posts
Feb 1st 2009
Thread locked Subscribe Feb 1st 2009
1 decade ago

Sign Up for Free or Log In to start participating in the conversation!