2003902

	HTTP POST sam file
advICE :Intrusions : 2003902

FAQ

Oh my gosh, I'm being HACKED!!!

How do I report the hacker to my ISP?

I'm seeing lots of attacks, is this normal?

Summary
Suspicious file access attempt.
Details
Attempt to use a Web form to access the SAM (Security Accounts Manager) file, which contains the encrypted user account information, including passwords.

more information

More information on the SAM file: This section explains more about the importance of the SAM file.
CIAC: H-45 Windows NT SAM permission Vulnerability: Bulletin by the DoE CIAC about this problem.
Security Watch: It's about time to get cracking on Windows NT password security: Describes how administrators can "crack" their own SAM files in order to find weak passwords. This also gives a good description of how easy it is to crack such passwords.
l0phtcrack: Cracks NT passwords and provides tools for extracting the SAM file either locally or remotely.
Recommendations on protecting the SAM file.

parametric information

URL The URL being accessed.

field The name of the suspicious field.

value The value of the suspicious field.

 
Version appeared: 2.0

HTTP POST sam file