I am analysing an old attack and I got a scenario which does not really make sense to me.
The attacker connects to the ftp service and runs a bunch "FTP RNFR ././ attempt". This is caught by snort as alert with sid 1:1622 I do not understand why attacker does that. His next step is PWD followed by CWD (snort sid 1:1672)
I do not understand the steps and the purpose of them by the attacker, what he was looking for.