[133439] in North American Network Operators' Group
Re: Mastercard problems
daemon@ATHENA.MIT.EDU (John Adams)
Thu Dec 9 13:16:27 2010
In-Reply-To: <1291884582.9824.5.camel@petrie.dereferenced.org>
Date: Thu, 9 Dec 2010 10:16:23 -0800
From: John Adams <jna@retina.net>
To: William Pitcock <nenolod@systeminplace.net>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Uh, no.
Source code from LOIC:
byte[] buf;
if (random =3D=3D true)
{
buf =3D System.Text.Encoding.ASCII.GetBytes(String.Format("GET
{0}{1} HTTP/1.1{2}Host: {3}{2}{2}{2}", Subsite, new
Functions().RandomString(), Environment.NewLine, Host));
}
else
{
buf =3D System.Text.Encoding.ASCII.GetBytes(String.Format("GET {0}
HTTP/1.1{1}Host: {2}{1}{1}{1}", Subsite, Environment.NewLine, Host));
}
On Thu, Dec 9, 2010 at 12:49 AM, William Pitcock
<nenolod@systeminplace.net> wrote:
> On Thu, 2010-12-09 at 18:34 +1100, Ben McGinnes wrote:
>> On 9/12/10 8:04 AM, Christopher Morrow wrote:
>> > On Wed, Dec 8, 2010 at 3:06 PM, Philip Dorr <tagno25@gmail.com> wrote:
>> >> The problem is that they were also slashdotted. =A0The logs would als=
o have a
>> >> large number of unrelated.
>> >
>> > pro-tip: the tool has a pretty easy to spot signature.
>>
>> What is that signature?
>>
>
> The tool makes HTTP/1.0 requests, most browsers make HTTP/1.1 requests.
>
> William
>
>
>
