c2 failed login correlation to an origination IP/host ?

From: Simo Sentissi (msentissi_at_rightnow.com)
Date: 06/22/05 

Date: Wed, 22 Jun 2005 11:35:07 -0600

hey there

I wanted to know how people correlate a failed login attempt from within sql
logs or c2 logs and the origination address. I am thinking maybe people
looks at the events logs, but do those say what are the connections from
wich the failed loging started ??

I am in a dillema !

Relevant Pages

  • c2 failed login correlation to an origination IP/host ?
    ... I wanted to know how people correlate a failed login attempt from within sql ... logs or c2 logs and the origination address. ...
    (microsoft.public.windows.server.security)
  • Auth.log
    ... My daily cron jobs recently ... did a thorough check and determined that the failed login attempt ... all logs, especially security related logs... ... Gerhardt Information Technologies ...
    (freebsd-questions)
  • RE: c2 failed login correlation to an origination IP/host ?
    ... "Simo Sentissi" wrote: ... > I wanted to know how people correlate a failed login attempt from within sql ... > logs or c2 logs and the origination address. ...
    (microsoft.public.windows.server.security)
  • RE: c2 failed login correlation to an origination IP/host ?
    ... "Simo Sentissi" wrote: ... > I wanted to know how people correlate a failed login attempt from within sql ... > logs or c2 logs and the origination address. ...
    (microsoft.public.sqlserver.security)
  • Re: testing vulnerable web application.
    ... You should be able to just open up your logs and look for things that are out of the ordinary. ... Keep your database and all but double check it to make sure there really aren't accounts and what not that should not be there. ... We assumed the attacker was using some sort of SQL injection to alter the DB records or possibly he can craft a SQL query in a way that will create an admin account to use to simply log in and alter the records and then delete his username...NO rogue admin accounts have ever been found. ... You have an option to go with a managed service or an enterprise software. ...
    (Pen-Test)