|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /config/yarn%2ejs
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /config/yarn%2ejs UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/config/yarn%2ejs
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/config/yarn%2ejs
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/yarn%2ejs HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /config/yarn%2ejs HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Languag
Requête brute (extrait)
GET /config/yarn%2ejs HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-C
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "482e78dd4113cb065c9b10ffebe12384ce931ee8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 379,
"payload_entropy": 5.179868018279593,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "949d093be1453007e88875b7e2d34903504a842c",
"event_fingerprint": "9348050fadcdb3ee72a4fefa9d64de3828ccbe9b",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "0af6ebbf48d5b1cc1e2d54b4d42fa43c",
"path_pattern_hash": "912dcdd9ad4efaa9ecc1ab33c8517470"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/config\/yarn%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"method": "GET",
"path": "\/config\/yarn%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/yarn%2ejs HTTP\/1.1",
"request_sample": "GET \/config\/yarn%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/config\/yarn%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"evidence": {
"method": "GET",
"path": "\/config\/yarn%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/yarn%2ejs HTTP\/1.1",
"request_sample": "GET \/config\/yarn%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/config\/yarn%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4b8e23f7cadf9d3a477c6b6444b0c92eb159bc1e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/yarn%2ejs",
"request_line": "GET \/config\/yarn%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/yarn%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/yarn%2ejs",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/yarn%2ejs",
"request_line": "GET \/config\/yarn%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/yarn%2ejs",
"evidence_snippet": "GET \/config\/yarn%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /nacos/actuator/env
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /nacos/actuator/env UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/nacos/actuator/env
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/nacos/actuator/env
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /nacos/actuator/env HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /nacos/actuator/env HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langu
Requête brute (extrait)
GET /nacos/actuator/env HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "ec2ea08fc6b0c3b997c0b573ecd1a453e31fa52c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 381,
"payload_entropy": 5.146492163497357,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "1a4e5c26a8267bfab9166559ac6383405834b15a",
"event_fingerprint": "1b55d96d7f1daf7d21b766a9103485fa1958680d",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "f3e91b5846859ef705fae1d034480b8f",
"path_pattern_hash": "831151a593dd06112ef02d96455fadcb"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/nacos\/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"method": "GET",
"path": "\/nacos\/actuator\/env",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/nacos\/actuator\/env HTTP\/1.1",
"request_sample": "GET \/nacos\/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/nacos\/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"evidence": {
"method": "GET",
"path": "\/nacos\/actuator\/env",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/nacos\/actuator\/env HTTP\/1.1",
"request_sample": "GET \/nacos\/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/nacos\/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "280829b9692bbce36bcb5dc5c88b240978d61473",
"protocol_details": {
"http_method": "GET",
"http_path": "\/nacos\/actuator\/env",
"request_line": "GET \/nacos\/actuator\/env HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/nacos\/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/nacos\/actuator\/env",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/nacos\/actuator\/env",
"request_line": "GET \/nacos\/actuator\/env HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/nacos\/actuator\/env",
"evidence_snippet": "GET \/nacos\/actuator\/env HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /%2epnpmfile%2emjs
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /%2epnpmfile%2emjs UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/%2epnpmfile%2emjs
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/%2epnpmfile%2emjs
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /%2epnpmfile%2emjs HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /%2epnpmfile%2emjs HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langua
Requête brute (extrait)
GET /%2epnpmfile%2emjs HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "2e2f8bb25900847beebd0ef0fe565002c558c5d0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 380,
"payload_entropy": 5.190703105917158,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "33fd968c8850066da795ff4e2e07345a4c393a27",
"event_fingerprint": "b5c09aec8f49b55c853af6bd4df26d95f1d33f3b",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "f24818db38302214185181f92baad4ae",
"path_pattern_hash": "6fc44411a2e316ea0c7a37ea9dc129f2"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/%2epnpmfile%2emjs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"method": "GET",
"path": "\/%2epnpmfile%2emjs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2epnpmfile%2emjs HTTP\/1.1",
"request_sample": "GET \/%2epnpmfile%2emjs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/%2epnpmfile%2emjs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"evidence": {
"method": "GET",
"path": "\/%2epnpmfile%2emjs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2epnpmfile%2emjs HTTP\/1.1",
"request_sample": "GET \/%2epnpmfile%2emjs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/%2epnpmfile%2emjs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3096b87d0ff8fcbf047c67b3917808d323212b38",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2epnpmfile%2emjs",
"request_line": "GET \/%2epnpmfile%2emjs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%2epnpmfile%2emjs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2epnpmfile%2emjs",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2epnpmfile%2emjs",
"request_line": "GET \/%2epnpmfile%2emjs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2epnpmfile%2emjs",
"evidence_snippet": "GET \/%2epnpmfile%2emjs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /laravel/core/%2eenv
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /laravel/core/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/laravel/core/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/laravel/core/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /laravel/core/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /laravel/core/%2eenv HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /laravel/core/%2eenv HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "e2798085e1327d1f407f27bda688e81930a09fee",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.156148944809286,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "ab907ea3696690bc12bcaa3839308bf7f25bf5bc",
"event_fingerprint": "68f652ce26a0b07690dd75d27baf5e46d54a108a",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "93868dd7af1f1ce14682f6ff794467f9",
"path_pattern_hash": "7744d672dace02a5b7aacaf84bc665cf"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/laravel\/core\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/laravel\/core\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/laravel\/core\/%2eenv HTTP\/1.1",
"request_sample": "GET \/laravel\/core\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/laravel\/core\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/laravel\/core\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/laravel\/core\/%2eenv HTTP\/1.1",
"request_sample": "GET \/laravel\/core\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/laravel\/core\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df750ed8648a22f3b4b4465a26def0d2553e0024",
"protocol_details": {
"http_method": "GET",
"http_path": "\/laravel\/core\/%2eenv",
"request_line": "GET \/laravel\/core\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/laravel\/core\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/laravel\/core\/%2eenv",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/laravel\/core\/%2eenv",
"request_line": "GET \/laravel\/core\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/laravel\/core\/%2eenv",
"evidence_snippet": "GET \/laravel\/core\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /admin/json/info%2eenv
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /admin/json/info%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/admin/json/info%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/admin/json/info%2eenv
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
ET Magento admin
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin/json/info%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /admin/json/info%2eenv HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /admin/json/info%2eenv HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "2c200c18b079050977439fbbff1203f76faf4808",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.19351753835773,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "602aa207e7c272a0d646ac7ca988f949b5697db5",
"event_fingerprint": "5ab21db4e13dd428e8b55922b1f5b9059cd90ffb",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"ET Magento admin",
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "2cad598c9e2869f7990599e9bab1fc65",
"path_pattern_hash": "0a6f31c73b1d11b9c314c22fec940f43"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/admin\/json\/info%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/admin\/json\/info%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/json\/info%2eenv HTTP\/1.1",
"request_sample": "GET \/admin\/json\/info%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/admin\/json\/info%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/admin\/json\/info%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/json\/info%2eenv HTTP\/1.1",
"request_sample": "GET \/admin\/json\/info%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/admin\/json\/info%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1337a0a0cd672f219ee2d65d3cdcef22173d1bdd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/json\/info%2eenv",
"request_line": "GET \/admin\/json\/info%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/admin\/json\/info%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/json\/info%2eenv",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/json\/info%2eenv",
"request_line": "GET \/admin\/json\/info%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/json\/info%2eenv",
"evidence_snippet": "GET \/admin\/json\/info%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_admin",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /app%2eyml
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /app%2eyml UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/app%2eyml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/app%2eyml
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /app%2eyml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /app%2eyml HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-U
Requête brute (extrait)
GET /app%2eyml HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Client-I
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "7fd40712b6d4b6671b5637e84d1c18cd87ab3eb8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 372,
"payload_entropy": 5.165541673134145,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "33fd968c8850066da795ff4e2e07345a4c393a27",
"event_fingerprint": "e6314897e073ace9b64abf793449b5ff4dd41ad0",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "3e62ae6ed73f484e67915ed33987fbbb",
"path_pattern_hash": "edd4f728cef5a94532bc7d7e61da7021"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/app%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"method": "GET",
"path": "\/app%2eyml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/app%2eyml HTTP\/1.1",
"request_sample": "GET \/app%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-I",
"payload_snippet": "GET \/app%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"evidence": {
"method": "GET",
"path": "\/app%2eyml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/app%2eyml HTTP\/1.1",
"request_sample": "GET \/app%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-I",
"payload_snippet": "GET \/app%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "39741d6a0e5b5ceee0b206da6e36006e775224c6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app%2eyml",
"request_line": "GET \/app%2eyml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app%2eyml",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/app%2eyml",
"request_line": "GET \/app%2eyml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app%2eyml",
"evidence_snippet": "GET \/app%2eyml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-U",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /Backend/%2eenv
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /Backend/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/Backend/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/Backend/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /Backend/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /Backend/%2eenv HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language:
Requête brute (extrait)
GET /Backend/%2eenv HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cli
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "d2a486e012859d90edf043305df961da7674107b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 377,
"payload_entropy": 5.165675582418302,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "ab907ea3696690bc12bcaa3839308bf7f25bf5bc",
"event_fingerprint": "efae264bca38d539d698496b2b85088ac2d750cf",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "5bb387c885dad4d5c3922fdb73896c6e",
"path_pattern_hash": "4a007ddb127292471c65516a244f00e8"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/Backend\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"method": "GET",
"path": "\/Backend\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/Backend\/%2eenv HTTP\/1.1",
"request_sample": "GET \/Backend\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/Backend\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"evidence": {
"method": "GET",
"path": "\/Backend\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/Backend\/%2eenv HTTP\/1.1",
"request_sample": "GET \/Backend\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/Backend\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c8014a99bca833c37cec8e07ea9b3cbf19b6951a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Backend\/%2eenv",
"request_line": "GET \/Backend\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Backend\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Backend\/%2eenv",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/Backend\/%2eenv",
"request_line": "GET \/Backend\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Backend\/%2eenv",
"evidence_snippet": "GET \/Backend\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /__debug__/doc/tags/*
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /__debug__/doc/tags/* UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/__debug__/doc/tags/*
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/__debug__/doc/tags/*
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /__debug__/doc/tags/* HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /__debug__/doc/tags/* HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lan
Requête brute (extrait)
GET /__debug__/doc/tags/* HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tr
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "2082be141988237fd9a13a7d3079ec551ab9e72a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 383,
"payload_entropy": 5.190378892190584,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "9c99806245427386a537c5e80f2f5eee54a09af4",
"event_fingerprint": "be91e69211e6678388e903ecf20d09374dd2ffd7",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "4b06c00338e275e6f4d299284f78c521",
"path_pattern_hash": "41b6e933fc9d1fe65ca06cf7e5aa132f"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/__debug__\/doc\/tags\/* HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"method": "GET",
"path": "\/__debug__\/doc\/tags\/*",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/__debug__\/doc\/tags\/* HTTP\/1.1",
"request_sample": "GET \/__debug__\/doc\/tags\/* HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/__debug__\/doc\/tags\/* HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"evidence": {
"method": "GET",
"path": "\/__debug__\/doc\/tags\/*",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/__debug__\/doc\/tags\/* HTTP\/1.1",
"request_sample": "GET \/__debug__\/doc\/tags\/* HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/__debug__\/doc\/tags\/* HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "15af3e13b3930ab296bdc17635299897f79f1949",
"protocol_details": {
"http_method": "GET",
"http_path": "\/__debug__\/doc\/tags\/*",
"request_line": "GET \/__debug__\/doc\/tags\/* HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/__debug__\/doc\/tags\/* HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/__debug__\/doc\/tags\/*",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/__debug__\/doc\/tags\/*",
"request_line": "GET \/__debug__\/doc\/tags\/* HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/__debug__\/doc\/tags\/*",
"evidence_snippet": "GET \/__debug__\/doc\/tags\/* HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /%2eenv%2email_settings%2elocal
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /%2eenv%2email_settings%2elocal UA curl/8.7.1
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950514:leak-1
951041:dns-rebind
Cible HTTP
GET
/%2eenv%2email_settings%2elocal
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/%2eenv%2email_settings%2elocal
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /%2eenv%2email_settings%2elocal HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /%2eenv%2email_settings%2elocal HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Requête brute (extrait)
GET /%2eenv%2email_settings%2elocal HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "3ee96a1c5e5269681d1b5d8057dae2a7362b98b9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 393,
"payload_entropy": 5.188315127856623,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "f5c1487f8c1f0b743ab9d15832d4d6f725da10ba",
"event_fingerprint": "d16bce93892e667cc703aa3cd9379bc2d6918072",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "795b1b9bf007e9cee48068be4796c2f0",
"path_pattern_hash": "42256af4fa0befd821d81ff650c9a598"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/%2eenv%2email_settings%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n",
"method": "GET",
"path": "\/%2eenv%2email_settings%2elocal",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2eenv%2email_settings%2elocal HTTP\/1.1",
"request_sample": "GET \/%2eenv%2email_settings%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127",
"payload_snippet": "GET \/%2eenv%2email_settings%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/%2eenv%2email_settings%2elocal",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2eenv%2email_settings%2elocal HTTP\/1.1",
"request_sample": "GET \/%2eenv%2email_settings%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127",
"payload_snippet": "GET \/%2eenv%2email_settings%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "34d3003202ca1e915cf8d9505d9ac6dcd0d787e8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eenv%2email_settings%2elocal",
"request_line": "GET \/%2eenv%2email_settings%2elocal HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%2eenv%2email_settings%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eenv%2email_settings%2elocal",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eenv%2email_settings%2elocal",
"request_line": "GET \/%2eenv%2email_settings%2elocal HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eenv%2email_settings%2elocal",
"evidence_snippet": "GET \/%2eenv%2email_settings%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /appsettings%2eQA%2ejson
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /appsettings%2eQA%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/appsettings%2eQA%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/appsettings%2eQA%2ejson
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /appsettings%2eQA%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /appsettings%2eQA%2ejson HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-
Requête brute (extrait)
GET /appsettings%2eQA%2ejson HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "4042971b245755affb953f6124111143f1bf48bd",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.178451399337956,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "33fd968c8850066da795ff4e2e07345a4c393a27",
"event_fingerprint": "813b364c35d460233e4d84143b24135bf159cb05",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "ef56cf2d534be844a156ffd45b75daf2",
"path_pattern_hash": "d25e2d841051986e34c184daf1d039a0"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/appsettings%2eQA%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"method": "GET",
"path": "\/appsettings%2eQA%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/appsettings%2eQA%2ejson HTTP\/1.1",
"request_sample": "GET \/appsettings%2eQA%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/appsettings%2eQA%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/appsettings%2eQA%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/appsettings%2eQA%2ejson HTTP\/1.1",
"request_sample": "GET \/appsettings%2eQA%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/appsettings%2eQA%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d1b50686ff3bbb95e3b7a8429aab34465bcb90aa",
"protocol_details": {
"http_method": "GET",
"http_path": "\/appsettings%2eQA%2ejson",
"request_line": "GET \/appsettings%2eQA%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/appsettings%2eQA%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/appsettings%2eQA%2ejson",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/appsettings%2eQA%2ejson",
"request_line": "GET \/appsettings%2eQA%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/appsettings%2eQA%2ejson",
"evidence_snippet": "GET \/appsettings%2eQA%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /public/stripe%2ejs
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /public/stripe%2ejs UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/public/stripe%2ejs
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/public/stripe%2ejs
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /public/stripe%2ejs HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /public/stripe%2ejs HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langu
Requête brute (extrait)
GET /public/stripe%2ejs HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "e02b18fc4d8dc6320955adf3ab30f259251bb225",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 381,
"payload_entropy": 5.1752819006503215,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "9c99806245427386a537c5e80f2f5eee54a09af4",
"event_fingerprint": "783acca43579a0aa2203c7fd4d8376c5ffe4e15a",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "dc2caf0cb8498442de2ef2bcc4f075a3",
"path_pattern_hash": "5f5e4496a0ce90020c173e3912aa4895"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/public\/stripe%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"method": "GET",
"path": "\/public\/stripe%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/public\/stripe%2ejs HTTP\/1.1",
"request_sample": "GET \/public\/stripe%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/public\/stripe%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"evidence": {
"method": "GET",
"path": "\/public\/stripe%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/public\/stripe%2ejs HTTP\/1.1",
"request_sample": "GET \/public\/stripe%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/public\/stripe%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d8b038e05ae2975217ea6107468aacf5b9d81125",
"protocol_details": {
"http_method": "GET",
"http_path": "\/public\/stripe%2ejs",
"request_line": "GET \/public\/stripe%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/public\/stripe%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/stripe%2ejs",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/public\/stripe%2ejs",
"request_line": "GET \/public\/stripe%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/public\/stripe%2ejs",
"evidence_snippet": "GET \/public\/stripe%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /admin%2ephp%2etmp
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /admin%2ephp%2etmp UA curl/8.7.1
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950521:leak-8
951041:dns-rebind
Cible HTTP
GET
/admin%2ephp%2etmp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/admin%2ephp%2etmp
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin%2ephp%2etmp HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /admin%2ephp%2etmp HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langua
Requête brute (extrait)
GET /admin%2ephp%2etmp HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "73dbff67ee9c6929687195fdb770fae6b083da00",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 380,
"payload_entropy": 5.180404393891107,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "5ea9f7818f66497c39bac404111e86174006f000",
"event_fingerprint": "3118cbcfbee874adddf04f98b6212585c6dd2496",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0340",
"pat-0341",
"pat-0606"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "7e6267abccacc8336a42e71d72ed0777",
"path_pattern_hash": "dfe6638b44988d89f0ec762a5a096cd7"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/admin%2ephp%2etmp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"method": "GET",
"path": "\/admin%2ephp%2etmp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin%2ephp%2etmp HTTP\/1.1",
"request_sample": "GET \/admin%2ephp%2etmp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/admin%2ephp%2etmp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"evidence": {
"method": "GET",
"path": "\/admin%2ephp%2etmp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin%2ephp%2etmp HTTP\/1.1",
"request_sample": "GET \/admin%2ephp%2etmp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/admin%2ephp%2etmp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b43de49da9cf5c4f39bc7b98cab643c876eb6b42",
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin%2ephp%2etmp",
"request_line": "GET \/admin%2ephp%2etmp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/admin%2ephp%2etmp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin%2ephp%2etmp",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin%2ephp%2etmp",
"request_line": "GET \/admin%2ephp%2etmp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin%2ephp%2etmp",
"evidence_snippet": "GET \/admin%2ephp%2etmp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_admin_panel_probe",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /_profiler/phpinfo
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /_profiler/phpinfo UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/_profiler/phpinfo
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/_profiler/phpinfo
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
ET Symfony profiler
Ligne de requête
GET /_profiler/phpinfo HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /_profiler/phpinfo HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langua
Requête brute (extrait)
GET /_profiler/phpinfo HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "a9d058157429bdfd367c3f5224f928db846fcc32",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 380,
"payload_entropy": 5.178077605208566,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "1a4e5c26a8267bfab9166559ac6383405834b15a",
"event_fingerprint": "e0cf0dd644be8072d3351ae231581a1d4ee9386e",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0855"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"ET Symfony profiler"
],
"pattern_ids": [
"pat-0340",
"pat-0855"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "01c085414e6d3fdcf0ba06eb02bc9d66",
"path_pattern_hash": "4cc1bb080a3d1dd43db64b10896db709"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/_profiler\/phpinfo HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"method": "GET",
"path": "\/_profiler\/phpinfo",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/_profiler\/phpinfo HTTP\/1.1",
"request_sample": "GET \/_profiler\/phpinfo HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/_profiler\/phpinfo HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"evidence": {
"method": "GET",
"path": "\/_profiler\/phpinfo",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/_profiler\/phpinfo HTTP\/1.1",
"request_sample": "GET \/_profiler\/phpinfo HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/_profiler\/phpinfo HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5c5e7fa8b4d0b26801d92d24bdab922be09ba6c6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/_profiler\/phpinfo",
"request_line": "GET \/_profiler\/phpinfo HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/_profiler\/phpinfo HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_profiler\/phpinfo",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/_profiler\/phpinfo",
"request_line": "GET \/_profiler\/phpinfo HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/_profiler\/phpinfo",
"evidence_snippet": "GET \/_profiler\/phpinfo HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /mailer/mail_credentials%2ejson
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /mailer/mail_credentials%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/mailer/mail_credentials%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/mailer/mail_credentials%2ejson
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /mailer/mail_credentials%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /mailer/mail_credentials%2ejson HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Requête brute (extrait)
GET /mailer/mail_credentials%2ejson HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "9185e49c8f38992e69cdf1c90aee90d6ec0dd558",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 393,
"payload_entropy": 5.192236058992094,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "9c99806245427386a537c5e80f2f5eee54a09af4",
"event_fingerprint": "324bc3675309a413356f64ab533cc2c2d8a6a1bc",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "0e8e651e187d421cd4926ce72f5e9003",
"path_pattern_hash": "6d4e6d5f19384879c613629efb51fb66"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/mailer\/mail_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\n",
"method": "GET",
"path": "\/mailer\/mail_credentials%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/mailer\/mail_credentials%2ejson HTTP\/1.1",
"request_sample": "GET \/mailer\/mail_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127",
"payload_snippet": "GET \/mailer\/mail_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"evidence": {
"method": "GET",
"path": "\/mailer\/mail_credentials%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/mailer\/mail_credentials%2ejson HTTP\/1.1",
"request_sample": "GET \/mailer\/mail_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127",
"payload_snippet": "GET \/mailer\/mail_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "22c4ec5f4ad3685911da3954bf1988555c49e9e6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/mailer\/mail_credentials%2ejson",
"request_line": "GET \/mailer\/mail_credentials%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/mailer\/mail_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mailer\/mail_credentials%2ejson",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/mailer\/mail_credentials%2ejson",
"request_line": "GET \/mailer\/mail_credentials%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/mailer\/mail_credentials%2ejson",
"evidence_snippet": "GET \/mailer\/mail_credentials%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /api/%2eenv%2edist
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /api/%2eenv%2edist UA curl/8.7.1
Émulateur
HTTP
WAF
41
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/api/%2eenv%2edist
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/api/%2eenv%2edist
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/%2eenv%2edist HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/%2eenv%2edist HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langua
Requête brute (extrait)
GET /api/%2eenv%2edist HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "c89e58eb36d253f58143f915773ba911228872d7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 380,
"payload_entropy": 5.1611860546574055,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 21,
"anomaly_count": 1,
"campaign_key": "646c52e1335c18b9b08483fc9608cf60cf9cd5ac",
"event_fingerprint": "a9106970ed23a03d30e165e8fb53a115aedcd0cf",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "c4fecb1e108c6cfb8380aeef437d4184",
"path_pattern_hash": "712d03d6c38e2dea2a74fd1affdbc0bc"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/api\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"method": "GET",
"path": "\/api\/%2eenv%2edist",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/%2eenv%2edist HTTP\/1.1",
"request_sample": "GET \/api\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/api\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"evidence": {
"method": "GET",
"path": "\/api\/%2eenv%2edist",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/%2eenv%2edist HTTP\/1.1",
"request_sample": "GET \/api\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/api\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1acc78b6b3a02ee9b478f6fb3a4a24e59fbc9c57",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/%2eenv%2edist",
"request_line": "GET \/api\/%2eenv%2edist HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/%2eenv%2edist",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/%2eenv%2edist",
"request_line": "GET \/api\/%2eenv%2edist HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/%2eenv%2edist",
"evidence_snippet": "GET \/api\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:876 · (tentative d'exploit) · → /hc/restricted
|
Élevée
|
Élevé · 75
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /hc/restricted UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950402:ssrf-2
950468:nosqli-3
Cible HTTP
GET
/hc/restricted
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/hc/restricted
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Élevé
· 75
Confiance : Confiance 59 % — 6 tag(s) WAF
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /hc/restricted HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
lfi-14
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /hc/restricted HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language:
Requête brute (extrait)
GET /hc/restricted HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Clie
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "b351dca8078e120f15848e521ad0dccdc31f17a5",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 376,
"payload_entropy": 5.137169950237358,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 75,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "f799e008bd5c65cb351f491c3892d51bcd889b2e",
"event_fingerprint": "11413e76a16451565dccf0657e3e5b4638a5c583",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 75
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "519c65817109cd46e75842b0ecf0dfa3",
"path_pattern_hash": "2b614daa3e4f69173836e9001fad0fb0"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "GET \/hc\/restricted HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: ",
"method": "GET",
"path": "\/hc\/restricted",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/hc\/restricted HTTP\/1.1",
"request_sample": "GET \/hc\/restricted HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clie",
"payload_snippet": "GET \/hc\/restricted HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"evidence": {
"method": "GET",
"path": "\/hc\/restricted",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/hc\/restricted HTTP\/1.1",
"request_sample": "GET \/hc\/restricted HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clie",
"payload_snippet": "GET \/hc\/restricted HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "27377840e307c1065e517dba575712748e0fbca7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/hc\/restricted",
"request_line": "GET \/hc\/restricted HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/hc\/restricted HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"attack_vector": "lfi path traversal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/hc\/restricted",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 75
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/hc\/restricted",
"request_line": "GET \/hc\/restricted HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/hc\/restricted",
"evidence_snippet": "GET \/hc\/restricted HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /admin/
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /admin/ UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/admin/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/admin/
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
ET Magento admin
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin/ HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /admin/ HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-US,e
Requête brute (extrait)
GET /admin/ HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Client-IP:
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "07354ca2969df78aa67794847e5e59bed611673a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 369,
"payload_entropy": 5.140475286895177,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "602aa207e7c272a0d646ac7ca988f949b5697db5",
"event_fingerprint": "1d59de1637cb2ef56fe210ea1f39590bd3a157c4",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"ET Magento admin",
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "b88123ee1e82e1b551a858f5e34565b2",
"path_pattern_hash": "79952c96c295dee2566cc94fcddfbd57"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,e",
"method": "GET",
"path": "\/admin\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/ HTTP\/1.1",
"request_sample": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: ",
"payload_snippet": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,e",
"evidence": {
"method": "GET",
"path": "\/admin\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/ HTTP\/1.1",
"request_sample": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: ",
"payload_snippet": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,e",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0b0dae51060679a6bb0a2cd89704e4e229bd7884",
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/",
"request_line": "GET \/admin\/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,e",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/",
"request_line": "GET \/admin\/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/admin\/",
"evidence_snippet": "GET \/admin\/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,e",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_admin",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /config/config/debug%2ebak
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /config/config/debug%2ebak UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950521:leak-8
Cible HTTP
GET
/config/config/debug%2ebak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/config/config/debug%2ebak
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/config/debug%2ebak HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /config/config/debug%2ebak HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accep
Requête brute (extrait)
GET /config/config/debug%2ebak HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "4c415703e81c8a9aa95241ff9d761e8adc5f03c4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 388,
"payload_entropy": 5.193818862115429,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 21,
"anomaly_count": 1,
"campaign_key": "b9596c0c754b41653eb9e7075b9e68634c4de66a",
"event_fingerprint": "3c1fe879e23379fccf1ee853f3ef21f039f82b7f",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "d3d8957ff38a2b809358615ac8151803",
"path_pattern_hash": "55580d882620d81732199fc110685afd"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/config\/config\/debug%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"method": "GET",
"path": "\/config\/config\/debug%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/config\/debug%2ebak HTTP\/1.1",
"request_sample": "GET \/config\/config\/debug%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/config\/config\/debug%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/config\/config\/debug%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/config\/debug%2ebak HTTP\/1.1",
"request_sample": "GET \/config\/config\/debug%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/config\/config\/debug%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f8cdabfc075f15cde2a163c95e281aed73a4512c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/config\/debug%2ebak",
"request_line": "GET \/config\/config\/debug%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/config\/debug%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/config\/debug%2ebak",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/config\/debug%2ebak",
"request_line": "GET \/config\/config\/debug%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/config\/debug%2ebak",
"evidence_snippet": "GET \/config\/config\/debug%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /sendgrid/ses%2ejson
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /sendgrid/ses%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/sendgrid/ses%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/sendgrid/ses%2ejson
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /sendgrid/ses%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /sendgrid/ses%2ejson HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /sendgrid/ses%2ejson HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "73db6c05b8999937c7a911e9fb6d1deff8c70d8c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.160616946531655,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "9c99806245427386a537c5e80f2f5eee54a09af4",
"event_fingerprint": "ac6d2faddd37c896ecbfce755c42cd17d2126e0d",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "36a0f88a1d30d77266cc05e0bb072890",
"path_pattern_hash": "0ac05d6b5e8a4fa543c9030850770ee4"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/sendgrid\/ses%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/sendgrid\/ses%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/sendgrid\/ses%2ejson HTTP\/1.1",
"request_sample": "GET \/sendgrid\/ses%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/sendgrid\/ses%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/sendgrid\/ses%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/sendgrid\/ses%2ejson HTTP\/1.1",
"request_sample": "GET \/sendgrid\/ses%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/sendgrid\/ses%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b3f3e8287e25738a6a3a62e6c749b3ae9d606005",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid\/ses%2ejson",
"request_line": "GET \/sendgrid\/ses%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sendgrid\/ses%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid\/ses%2ejson",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sendgrid\/ses%2ejson",
"request_line": "GET \/sendgrid\/ses%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sendgrid\/ses%2ejson",
"evidence_snippet": "GET \/sendgrid\/ses%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /config/public/log%2eenv
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /config/public/log%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/config/public/log%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/config/public/log%2eenv
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/public/log%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /config/public/log%2eenv HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-
Requête brute (extrait)
GET /config/public/log%2eenv HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "eefdf2600b69570a219b599219eea2a5e32c95ed",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.186305112755607,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "949d093be1453007e88875b7e2d34903504a842c",
"event_fingerprint": "bc67c72c33debe69afb69ee55d294e5c51f563f7",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "4c70f83e21ec5e08100835a6e36d611a",
"path_pattern_hash": "195c724d575453e5bccdfce2a42babe7"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/config\/public\/log%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"method": "GET",
"path": "\/config\/public\/log%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/public\/log%2eenv HTTP\/1.1",
"request_sample": "GET \/config\/public\/log%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/config\/public\/log%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/config\/public\/log%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/public\/log%2eenv HTTP\/1.1",
"request_sample": "GET \/config\/public\/log%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/config\/public\/log%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3ee111b5e56d8b5b008b367cab2d81a147836f0c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/public\/log%2eenv",
"request_line": "GET \/config\/public\/log%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/public\/log%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/public\/log%2eenv",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/public\/log%2eenv",
"request_line": "GET \/config\/public\/log%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/public\/log%2eenv",
"evidence_snippet": "GET \/config\/public\/log%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /backend/config/common%2ejs
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /backend/config/common%2ejs UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/backend/config/common%2ejs
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/backend/config/common%2ejs
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /backend/config/common%2ejs HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /backend/config/common%2ejs HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Acce
Requête brute (extrait)
GET /backend/config/common%2ejs HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "d3c675df7cf4b62220f9e5d1ea15df59b736c9ca",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 389,
"payload_entropy": 5.210687486211114,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "9c99806245427386a537c5e80f2f5eee54a09af4",
"event_fingerprint": "ed34cc538516d8893c4b51abb01f1d2f4c6a56ed",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "7d691d0aec8c4a1312f67c19026db24a",
"path_pattern_hash": "c27126375a04a7d406db783b210a53f0"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/backend\/config\/common%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"method": "GET",
"path": "\/backend\/config\/common%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backend\/config\/common%2ejs HTTP\/1.1",
"request_sample": "GET \/backend\/config\/common%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/backend\/config\/common%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"evidence": {
"method": "GET",
"path": "\/backend\/config\/common%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/backend\/config\/common%2ejs HTTP\/1.1",
"request_sample": "GET \/backend\/config\/common%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/backend\/config\/common%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3130d8b51513353721a6e57be21e078afb4e8800",
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/config\/common%2ejs",
"request_line": "GET \/backend\/config\/common%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/backend\/config\/common%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/config\/common%2ejs",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/backend\/config\/common%2ejs",
"request_line": "GET \/backend\/config\/common%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/backend\/config\/common%2ejs",
"evidence_snippet": "GET \/backend\/config\/common%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /tools/aws%2ejson
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /tools/aws%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/tools/aws%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/tools/aws%2ejson
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /tools/aws%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /tools/aws%2ejson HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Languag
Requête brute (extrait)
GET /tools/aws%2ejson HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-C
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "fdba6de4a0f3619137c64ca1d75b0b5bd9118d99",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 379,
"payload_entropy": 5.167387503336046,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "9c99806245427386a537c5e80f2f5eee54a09af4",
"event_fingerprint": "f9d14747ac5e82713df67030496c56be39ef0f44",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "68393b6e1a6da00b1b705c6e0341ca92",
"path_pattern_hash": "8ac5ad615766e8754888002929431662"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/tools\/aws%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"method": "GET",
"path": "\/tools\/aws%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/tools\/aws%2ejson HTTP\/1.1",
"request_sample": "GET \/tools\/aws%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/tools\/aws%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"evidence": {
"method": "GET",
"path": "\/tools\/aws%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/tools\/aws%2ejson HTTP\/1.1",
"request_sample": "GET \/tools\/aws%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/tools\/aws%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9bdd8bca244670b7e5570ec998894bb58ab9aee8",
"protocol_details": {
"http_method": "GET",
"http_path": "\/tools\/aws%2ejson",
"request_line": "GET \/tools\/aws%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/tools\/aws%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tools\/aws%2ejson",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/tools\/aws%2ejson",
"request_line": "GET \/tools\/aws%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tools\/aws%2ejson",
"evidence_snippet": "GET \/tools\/aws%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /user/%2eenv%2edist
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /user/%2eenv%2edist UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/user/%2eenv%2edist
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/user/%2eenv%2edist
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /user/%2eenv%2edist HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /user/%2eenv%2edist HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langu
Requête brute (extrait)
GET /user/%2eenv%2edist HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "4a0261ec3858b3ad3927dfe2243243b3dd2dcad4",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 381,
"payload_entropy": 5.158430569448236,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "d554fd324f483a16373e489448a00a70e55e484c",
"event_fingerprint": "274e82362cb25973433d5ecdb028cbc01d9e7dd4",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "eab52d592383ded34011c3bc61f8bddd",
"path_pattern_hash": "f8aa70cf573e76d944e6c0e754ae1599"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/user\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"method": "GET",
"path": "\/user\/%2eenv%2edist",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/user\/%2eenv%2edist HTTP\/1.1",
"request_sample": "GET \/user\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/user\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"evidence": {
"method": "GET",
"path": "\/user\/%2eenv%2edist",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/user\/%2eenv%2edist HTTP\/1.1",
"request_sample": "GET \/user\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/user\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6d7df463fa12a27397f217e1b6d0ba3bc515de26",
"protocol_details": {
"http_method": "GET",
"http_path": "\/user\/%2eenv%2edist",
"request_line": "GET \/user\/%2eenv%2edist HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/user\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/user\/%2eenv%2edist",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/user\/%2eenv%2edist",
"request_line": "GET \/user\/%2eenv%2edist HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/user\/%2eenv%2edist",
"evidence_snippet": "GET \/user\/%2eenv%2edist HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_drupal",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /js-plugin/%2eenv
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /js-plugin/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/js-plugin/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/js-plugin/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /js-plugin/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /js-plugin/%2eenv HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Languag
Requête brute (extrait)
GET /js-plugin/%2eenv HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-C
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "2ae51b57f6e5c6a2c9771196da627014430e7902",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 379,
"payload_entropy": 5.167224299224359,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "ab907ea3696690bc12bcaa3839308bf7f25bf5bc",
"event_fingerprint": "c719f1d03a512fc30f31ace7772d5153502cc794",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "4d7d0a6c78d323015b6fab3abf9f102c",
"path_pattern_hash": "eb83ef298a9f7af1ae891a6e77cea20b"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/js-plugin\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"method": "GET",
"path": "\/js-plugin\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/js-plugin\/%2eenv HTTP\/1.1",
"request_sample": "GET \/js-plugin\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/js-plugin\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"evidence": {
"method": "GET",
"path": "\/js-plugin\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/js-plugin\/%2eenv HTTP\/1.1",
"request_sample": "GET \/js-plugin\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/js-plugin\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "65aba6a07810b26bbcfc61c33b2fc9aa00af586e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/js-plugin\/%2eenv",
"request_line": "GET \/js-plugin\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/js-plugin\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/js-plugin\/%2eenv",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/js-plugin\/%2eenv",
"request_line": "GET \/js-plugin\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/js-plugin\/%2eenv",
"evidence_snippet": "GET \/js-plugin\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /xampp/phpinfo%2ephp
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /xampp/phpinfo%2ephp UA curl/8.7.1
Émulateur
HTTP
WAF
35
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950614:phpinfo
Cible HTTP
GET
/xampp/phpinfo%2ephp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/xampp/phpinfo%2ephp
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /xampp/phpinfo%2ephp HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
phpinfo
dns-rebind
scanner-ua
Payload (extrait)
GET /xampp/phpinfo%2ephp HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /xampp/phpinfo%2ephp HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "ed405c569d4a4df63d8ae89d81203481598afa37",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.20505126264936,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "e89b1b1516c1e324396c0e964c90f5cc17d597d3",
"event_fingerprint": "4cb663a0190effdb6e87c181ebd3f59dd84864f5",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "e677ab0877de80cdaab88c5cdba9175f",
"path_pattern_hash": "36a6149e7f15604a1dc8b303d3b31e78"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/xampp\/phpinfo%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/xampp\/phpinfo%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950614:phpinfo",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"phpinfo",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/xampp\/phpinfo%2ephp HTTP\/1.1",
"request_sample": "GET \/xampp\/phpinfo%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/xampp\/phpinfo%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/xampp\/phpinfo%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950614:phpinfo",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"phpinfo",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/xampp\/phpinfo%2ephp HTTP\/1.1",
"request_sample": "GET \/xampp\/phpinfo%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/xampp\/phpinfo%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "afa83f641f80f2c607ea10844195cf4f863dae5f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/xampp\/phpinfo%2ephp",
"request_line": "GET \/xampp\/phpinfo%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/xampp\/phpinfo%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/xampp\/phpinfo%2ephp",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/xampp\/phpinfo%2ephp",
"request_line": "GET \/xampp\/phpinfo%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/xampp\/phpinfo%2ephp",
"evidence_snippet": "GET \/xampp\/phpinfo%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950614:phpinfo",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /config/gitlab%2ejs
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /config/gitlab%2ejs UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/config/gitlab%2ejs
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/config/gitlab%2ejs
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/gitlab%2ejs HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /config/gitlab%2ejs HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langu
Requête brute (extrait)
GET /config/gitlab%2ejs HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "488a0bcde566df01d275c0c23aebae727480e51a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 381,
"payload_entropy": 5.184151778856942,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "949d093be1453007e88875b7e2d34903504a842c",
"event_fingerprint": "ec87476bd4dbd7e1970cbc624f406643cbeee974",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "a97c85ccc82ffd71d855fa05daa57ba4",
"path_pattern_hash": "10e76776703bfa24c591d3d36823e4e5"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/config\/gitlab%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"method": "GET",
"path": "\/config\/gitlab%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/gitlab%2ejs HTTP\/1.1",
"request_sample": "GET \/config\/gitlab%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/config\/gitlab%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"evidence": {
"method": "GET",
"path": "\/config\/gitlab%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/gitlab%2ejs HTTP\/1.1",
"request_sample": "GET \/config\/gitlab%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/config\/gitlab%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5805f8f879272bce1dbe33c1703bbd70c63cc6ad",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/gitlab%2ejs",
"request_line": "GET \/config\/gitlab%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/gitlab%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/gitlab%2ejs",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/gitlab%2ejs",
"request_line": "GET \/config\/gitlab%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/gitlab%2ejs",
"evidence_snippet": "GET \/config\/gitlab%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /helper/config%2eenv
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /helper/config%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/helper/config%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/helper/config%2eenv
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /helper/config%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /helper/config%2eenv HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /helper/config%2eenv HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "38216f2a941cacb1cda45faeeb163d97eec4b114",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.171972473454903,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "9c99806245427386a537c5e80f2f5eee54a09af4",
"event_fingerprint": "84fb517427c152072764b01a1a44aba9fb6a83d9",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "011ee09130052813c92498b72ced7ad4",
"path_pattern_hash": "14a9543cd1ca3191a2496baaa3798f7c"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/helper\/config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/helper\/config%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/helper\/config%2eenv HTTP\/1.1",
"request_sample": "GET \/helper\/config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/helper\/config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/helper\/config%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/helper\/config%2eenv HTTP\/1.1",
"request_sample": "GET \/helper\/config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/helper\/config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5bf6e83c57062fe442696621d79513087caac9e6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/helper\/config%2eenv",
"request_line": "GET \/helper\/config%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/helper\/config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/helper\/config%2eenv",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/helper\/config%2eenv",
"request_line": "GET \/helper\/config%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/helper\/config%2eenv",
"evidence_snippet": "GET \/helper\/config%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /sms-service/%2eenv%2eproduction%2elocal
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /sms-service/%2eenv%2eproduction%2elocal UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/sms-service/%2eenv%2eproduction%2elocal
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/sms-service/%2eenv%2eproduction%2elocal
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /sms-service/%2eenv%2eproduction%2elocal HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /sms-service/%2eenv%2eproduction%2elocal HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encodin
Requête brute (extrait)
GET /sms-service/%2eenv%2eproduction%2elocal HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Clien
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "70d2a746e49960502935d846f767c0382c5823a7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 402,
"payload_entropy": 5.189897630962058,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "ab907ea3696690bc12bcaa3839308bf7f25bf5bc",
"event_fingerprint": "d902a17c76f679b97e0c35696b1f4921409e29db",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "0fd63dd04b4066168146e1ae29e61780",
"path_pattern_hash": "b6a898037cfa9efd28346e4b4f486b5e"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/sms-service\/%2eenv%2eproduction%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encodin",
"method": "GET",
"path": "\/sms-service\/%2eenv%2eproduction%2elocal",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/sms-service\/%2eenv%2eproduction%2elocal HTTP\/1.1",
"request_sample": "GET \/sms-service\/%2eenv%2eproduction%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Clien",
"payload_snippet": "GET \/sms-service\/%2eenv%2eproduction%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encodin",
"evidence": {
"method": "GET",
"path": "\/sms-service\/%2eenv%2eproduction%2elocal",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/sms-service\/%2eenv%2eproduction%2elocal HTTP\/1.1",
"request_sample": "GET \/sms-service\/%2eenv%2eproduction%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Clien",
"payload_snippet": "GET \/sms-service\/%2eenv%2eproduction%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encodin",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "abd5aab0f85c3841af595ef1bd375c6e164847c5",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sms-service\/%2eenv%2eproduction%2elocal",
"request_line": "GET \/sms-service\/%2eenv%2eproduction%2elocal HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sms-service\/%2eenv%2eproduction%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encodin",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sms-service\/%2eenv%2eproduction%2elocal",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sms-service\/%2eenv%2eproduction%2elocal",
"request_line": "GET \/sms-service\/%2eenv%2eproduction%2elocal HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sms-service\/%2eenv%2eproduction%2elocal",
"evidence_snippet": "GET \/sms-service\/%2eenv%2eproduction%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encodin",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /next-app/src/%2eenv
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /next-app/src/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/next-app/src/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/next-app/src/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 941150
SSRF Localhost SSRF
Ligne de requête
GET /next-app/src/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /next-app/src/%2eenv HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /next-app/src/%2eenv HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "0fc793fbed82098b7481afe3e58fd96ef769436f",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.1642298639622,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "ab907ea3696690bc12bcaa3839308bf7f25bf5bc",
"event_fingerprint": "7d7ceebe821fa4895db478a5711fbc18e6d84283",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0286",
"pat-0340"
],
"matched_pattern_names": [
"CRS 941150",
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0286",
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "6ce8aff9354cb110a168cebaa9191381",
"path_pattern_hash": "ea471eb1eb7d1e655bfd2bd37762bbc1"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/next-app\/src\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/next-app\/src\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/next-app\/src\/%2eenv HTTP\/1.1",
"request_sample": "GET \/next-app\/src\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/next-app\/src\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/next-app\/src\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/next-app\/src\/%2eenv HTTP\/1.1",
"request_sample": "GET \/next-app\/src\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/next-app\/src\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1b55f922e85aafac56824d9f572595c15679d64e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/next-app\/src\/%2eenv",
"request_line": "GET \/next-app\/src\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/next-app\/src\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/next-app\/src\/%2eenv",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/next-app\/src\/%2eenv",
"request_line": "GET \/next-app\/src\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/next-app\/src\/%2eenv",
"evidence_snippet": "GET \/next-app\/src\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /about%2ephp%2ebak
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /about%2ephp%2ebak UA curl/8.7.1
Émulateur
HTTP
WAF
31
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950521:leak-8
951041:dns-rebind
Cible HTTP
GET
/about%2ephp%2ebak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/about%2ephp%2ebak
Pourquoi cette classification : Sonde fichier sensible / config · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /about%2ephp%2ebak HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /about%2ephp%2ebak HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langua
Requête brute (extrait)
GET /about%2ephp%2ebak HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "877ed21df82c3a77ea1b0f139bc30e86c152e36e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 380,
"payload_entropy": 5.1873762663123,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "e6301aa94220971199c42e3bb7991728896af3eb",
"event_fingerprint": "62125ad6b9907dcf63971e565722ac689d484e30",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "98b9eb0e1d571c8df5bae6f690d878d6",
"path_pattern_hash": "a686ffbef2bc0ccb39af0c022365947b"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/about%2ephp%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"method": "GET",
"path": "\/about%2ephp%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/about%2ephp%2ebak HTTP\/1.1",
"request_sample": "GET \/about%2ephp%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/about%2ephp%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"evidence": {
"method": "GET",
"path": "\/about%2ephp%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/about%2ephp%2ebak HTTP\/1.1",
"request_sample": "GET \/about%2ephp%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/about%2ephp%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cc76bbe06a46b0759979a8041e0d34f48433da19",
"protocol_details": {
"http_method": "GET",
"http_path": "\/about%2ephp%2ebak",
"request_line": "GET \/about%2ephp%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/about%2ephp%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/about%2ephp%2ebak",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/about%2ephp%2ebak",
"request_line": "GET \/about%2ephp%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/about%2ephp%2ebak",
"evidence_snippet": "GET \/about%2ephp%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /wp-content/fullwebsite%2esql
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /wp-content/fullwebsite%2esql UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/wp-content/fullwebsite%2esql
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/wp-content/fullwebsite%2esql
Pourquoi cette classification : Sonde fichier sensible / config · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /wp-content/fullwebsite%2esql HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /wp-content/fullwebsite%2esql HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Ac
Requête brute (extrait)
GET /wp-content/fullwebsite%2esql HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "f35d2cb842a5c19a0436eef68d155e3f32d5af62",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 391,
"payload_entropy": 5.184261505023768,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "1a4c472539389ffd7519f3f0dbd8e53971a3e69f",
"event_fingerprint": "d9ea5f128e9d9779b15e741f528d30a81892d0ae",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "f71ec374b215818bee2f2d15148374ec",
"path_pattern_hash": "ca897eff271e887a9e5aae9a91363258"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/wp-content\/fullwebsite%2esql HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"method": "GET",
"path": "\/wp-content\/fullwebsite%2esql",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-content\/fullwebsite%2esql HTTP\/1.1",
"request_sample": "GET \/wp-content\/fullwebsite%2esql HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0",
"payload_snippet": "GET \/wp-content\/fullwebsite%2esql HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"evidence": {
"method": "GET",
"path": "\/wp-content\/fullwebsite%2esql",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-content\/fullwebsite%2esql HTTP\/1.1",
"request_sample": "GET \/wp-content\/fullwebsite%2esql HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0",
"payload_snippet": "GET \/wp-content\/fullwebsite%2esql HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "f5eb419725590aed984b7541cc565c04ca9b1743",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-content\/fullwebsite%2esql",
"request_line": "GET \/wp-content\/fullwebsite%2esql HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-content\/fullwebsite%2esql HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-content\/fullwebsite%2esql",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-content\/fullwebsite%2esql",
"request_line": "GET \/wp-content\/fullwebsite%2esql HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-content\/fullwebsite%2esql",
"evidence_snippet": "GET \/wp-content\/fullwebsite%2esql HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /config/mailer/mailgun%2ejson
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /config/mailer/mailgun%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/config/mailer/mailgun%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/config/mailer/mailgun%2ejson
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/mailer/mailgun%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /config/mailer/mailgun%2ejson HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Ac
Requête brute (extrait)
GET /config/mailer/mailgun%2ejson HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "f2beae75e0948de15bf94e16953766c3451fb79a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 391,
"payload_entropy": 5.196540411994049,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "949d093be1453007e88875b7e2d34903504a842c",
"event_fingerprint": "a8f8bc4b26dc70df46c6f2bac3281b2fa89153bc",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "6713e8f5061fee7cb66884b679439643",
"path_pattern_hash": "b407ed1e31b8c10e63bc59b6d5bb3fc1"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/config\/mailer\/mailgun%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"method": "GET",
"path": "\/config\/mailer\/mailgun%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/mailer\/mailgun%2ejson HTTP\/1.1",
"request_sample": "GET \/config\/mailer\/mailgun%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0",
"payload_snippet": "GET \/config\/mailer\/mailgun%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"evidence": {
"method": "GET",
"path": "\/config\/mailer\/mailgun%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/mailer\/mailgun%2ejson HTTP\/1.1",
"request_sample": "GET \/config\/mailer\/mailgun%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0",
"payload_snippet": "GET \/config\/mailer\/mailgun%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "878fc8333261ec10963a21bc5405462ca8943a3c",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/mailer\/mailgun%2ejson",
"request_line": "GET \/config\/mailer\/mailgun%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/mailer\/mailgun%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/mailer\/mailgun%2ejson",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/mailer\/mailgun%2ejson",
"request_line": "GET \/config\/mailer\/mailgun%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/mailer\/mailgun%2ejson",
"evidence_snippet": "GET \/config\/mailer\/mailgun%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAc",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /api/mail/smtp%2eenv
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /api/mail/smtp%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/mail/smtp%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/api/mail/smtp%2eenv
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 6 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/mail/smtp%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/mail/smtp%2eenv HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lang
Requête brute (extrait)
GET /api/mail/smtp%2eenv HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tru
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "568d268afcbb0658d7782708e0622b66bb417b22",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 382,
"payload_entropy": 5.1822251555945815,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "65e15cf199476069c5c2b5fef6a245433ff1944e",
"event_fingerprint": "5aa094f5f75213cae0e9f13067b876918d075f5b",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "15a10d452196f84129bd145c46aff443",
"path_pattern_hash": "8028451b3d8d3d054c07bd0aae4b6c3e"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/api\/mail\/smtp%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"method": "GET",
"path": "\/api\/mail\/smtp%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/mail\/smtp%2eenv HTTP\/1.1",
"request_sample": "GET \/api\/mail\/smtp%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/api\/mail\/smtp%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"evidence": {
"method": "GET",
"path": "\/api\/mail\/smtp%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/mail\/smtp%2eenv HTTP\/1.1",
"request_sample": "GET \/api\/mail\/smtp%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTru",
"payload_snippet": "GET \/api\/mail\/smtp%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9212eb52b11c42bda729e3b30c778f782321fe43",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/mail\/smtp%2eenv",
"request_line": "GET \/api\/mail\/smtp%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/mail\/smtp%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/mail\/smtp%2eenv",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/mail\/smtp%2eenv",
"request_line": "GET \/api\/mail\/smtp%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/mail\/smtp%2eenv",
"evidence_snippet": "GET \/api\/mail\/smtp%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lang",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /api/email/sendgrid%2eyaml
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /api/email/sendgrid%2eyaml UA curl/8.7.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/email/sendgrid%2eyaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/api/email/sendgrid%2eyaml
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 6 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/email/sendgrid%2eyaml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/email/sendgrid%2eyaml HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accep
Requête brute (extrait)
GET /api/email/sendgrid%2eyaml HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "f50e0431e49af5ce06d60ade653daffbbf4c9572",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 388,
"payload_entropy": 5.186944893237739,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "65e15cf199476069c5c2b5fef6a245433ff1944e",
"event_fingerprint": "79cba77ede11e798ec3bbd3f61f5425a270265ac",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "3e7a1e4a48b931a2b896f3969ec21dd8",
"path_pattern_hash": "be2bdc9c27776ecfe43254d40e36b9e0"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/api\/email\/sendgrid%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"method": "GET",
"path": "\/api\/email\/sendgrid%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/email\/sendgrid%2eyaml HTTP\/1.1",
"request_sample": "GET \/api\/email\/sendgrid%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/api\/email\/sendgrid%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"evidence": {
"method": "GET",
"path": "\/api\/email\/sendgrid%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/email\/sendgrid%2eyaml HTTP\/1.1",
"request_sample": "GET \/api\/email\/sendgrid%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.",
"payload_snippet": "GET \/api\/email\/sendgrid%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d0e6fb89c80ff21573d7466aebae7b9e8fe4eefb",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/email\/sendgrid%2eyaml",
"request_line": "GET \/api\/email\/sendgrid%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/email\/sendgrid%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/email\/sendgrid%2eyaml",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/email\/sendgrid%2eyaml",
"request_line": "GET \/api\/email\/sendgrid%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/email\/sendgrid%2eyaml",
"evidence_snippet": "GET \/api\/email\/sendgrid%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccep",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /core/config/info%2eenv
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /core/config/info%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/core/config/info%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/core/config/info%2eenv
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /core/config/info%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /core/config/info%2eenv HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-L
Requête brute (extrait)
GET /core/config/info%2eenv HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "7c4a56a4bec53c41699578ffec655a455b1b5432",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 385,
"payload_entropy": 5.167034600367577,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "ca930fc58692fb3ffacbcc351b4dab875d6597ac",
"event_fingerprint": "f290e21dc13e7f75cc9ead93c0a3b3c29996c055",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "28d446d96ccd2443bdb708ad81525cfb",
"path_pattern_hash": "31ef996c53c70e3adc501623bff7c44b"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/core\/config\/info%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"method": "GET",
"path": "\/core\/config\/info%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/core\/config\/info%2eenv HTTP\/1.1",
"request_sample": "GET \/core\/config\/info%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/core\/config\/info%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"evidence": {
"method": "GET",
"path": "\/core\/config\/info%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/core\/config\/info%2eenv HTTP\/1.1",
"request_sample": "GET \/core\/config\/info%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/core\/config\/info%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5a68e8088d16f404898fd9ba0b041e3d456e3cac",
"protocol_details": {
"http_method": "GET",
"http_path": "\/core\/config\/info%2eenv",
"request_line": "GET \/core\/config\/info%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/core\/config\/info%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/core\/config\/info%2eenv",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/core\/config\/info%2eenv",
"request_line": "GET \/core\/config\/info%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/core\/config\/info%2eenv",
"evidence_snippet": "GET \/core\/config\/info%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_core",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:876 · (tentative d'exploit) · → /api/db/settings%2ephp
|
Élevée
|
Élevé · 75
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /api/db/settings%2ephp UA curl/8.7.1
Émulateur
HTTP
WAF
41
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950402:ssrf-2
950468:nosqli-3
Cible HTTP
GET
/api/db/settings%2ephp
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/api/db/settings%2ephp
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Élevé
· 75
Confiance : Confiance 59 % — 7 tag(s) WAF
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/db/settings%2ephp HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
lfi-14
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/db/settings%2ephp HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /api/db/settings%2ephp HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "547343b7b1f12039e32cb82de611e43508f9cfc9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.179975977104582,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 75,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "bc8988602562413b2268a3fed915f3c8639de57e",
"event_fingerprint": "3ba277b17c7b666fe1120919a3cb701851cae625",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 75
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "338a54f8f3df41fc72cb877ec1770ff8",
"path_pattern_hash": "8bad60a2efc08fbaa77daee73cc0c0ec"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "GET \/api\/db\/settings%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/api\/db\/settings%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/db\/settings%2ephp HTTP\/1.1",
"request_sample": "GET \/api\/db\/settings%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/api\/db\/settings%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/api\/db\/settings%2ephp",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/db\/settings%2ephp HTTP\/1.1",
"request_sample": "GET \/api\/db\/settings%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/api\/db\/settings%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "507c1302d9b1a4ff0ac7ca2a3b91eb83c007d37f",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/db\/settings%2ephp",
"request_line": "GET \/api\/db\/settings%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/db\/settings%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "lfi path traversal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/db\/settings%2ephp",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 75
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/db\/settings%2ephp",
"request_line": "GET \/api\/db\/settings%2ephp HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/db\/settings%2ephp",
"evidence_snippet": "GET \/api\/db\/settings%2ephp HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /old/%2eenv%2ebak
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /old/%2eenv%2ebak UA curl/8.7.1
Émulateur
HTTP
WAF
45
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/old/%2eenv%2ebak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/old/%2eenv%2ebak
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 7 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /old/%2eenv%2ebak HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /old/%2eenv%2ebak HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Languag
Requête brute (extrait)
GET /old/%2eenv%2ebak HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-C
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "dfcbce979723c5842fb5da4a61fa5944544ccf83",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 379,
"payload_entropy": 5.176863419842215,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 22,
"anomaly_count": 1,
"campaign_key": "3ca75c963903733a0d7dff9e62c5a5d33ce46e37",
"event_fingerprint": "71ac28ef4781c2291a821af15917adda9e075f0c",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "4ad9daad110ff7ce061775a4e75b2b87",
"path_pattern_hash": "263d2420a1ed2fd20edaf03f0167d46a"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/old\/%2eenv%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"method": "GET",
"path": "\/old\/%2eenv%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/old\/%2eenv%2ebak HTTP\/1.1",
"request_sample": "GET \/old\/%2eenv%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/old\/%2eenv%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"evidence": {
"method": "GET",
"path": "\/old\/%2eenv%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/old\/%2eenv%2ebak HTTP\/1.1",
"request_sample": "GET \/old\/%2eenv%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-C",
"payload_snippet": "GET \/old\/%2eenv%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1bef2284c5b3519819cbe9a70118215453579383",
"protocol_details": {
"http_method": "GET",
"http_path": "\/old\/%2eenv%2ebak",
"request_line": "GET \/old\/%2eenv%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/old\/%2eenv%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/old\/%2eenv%2ebak",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/old\/%2eenv%2ebak",
"request_line": "GET \/old\/%2eenv%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/old\/%2eenv%2ebak",
"evidence_snippet": "GET \/old\/%2eenv%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Languag",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_old",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
joomla scanner
joomla scanner · via HTTP:876 · (sonde / probe) · → /administrator/tmp/
|
Élevée
|
Élevé · 71
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /administrator/tmp/ UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/administrator/tmp/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/administrator/tmp/
Pourquoi cette classification : Type « joomla_scanner » (signaux protocolaires) · confiance 56%
Confiance classification
56%
Risque capteur
Élevé
· 71
Confiance : Confiance 56 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
pat-0853
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSRF Localhost SSRF
ET Joomla admin
ES admin GET
Probe /administrator/
ActiveMQ console
Ligne de requête
GET /administrator/tmp/ HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /administrator/tmp/ HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langu
Requête brute (extrait)
GET /administrator/tmp/ HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "675830692c27bba947867ebfcd625c8f61428bfa",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 381,
"payload_entropy": 5.158301522044939,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 71,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "c5db8f5969395ffedab1ea4344a2f876896977a7",
"event_fingerprint": "f398271e0c617bac1563d05d1064988941ce515f",
"classification_reason": "Type \u00ab joomla_scanner \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"confidence": 0.56,
"classification_confidence": 0.56,
"precision_score": 66,
"precision_signals": [
"pat-0853"
],
"kb_rule_ids": [
"pat-0853"
],
"matched_patterns": [
"pat-0340",
"pat-0853",
"pat-0341",
"pat-0238",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"ET Joomla admin",
"ES admin GET",
"Probe \/administrator\/",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0340",
"pat-0853",
"pat-0341",
"pat-0238",
"pat-0606"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 71
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 56,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "087701cb146b3d14f1138a451ac32bdb",
"path_pattern_hash": "d327e6d6bef969a777de93fef0de6547"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "GET \/administrator\/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"method": "GET",
"path": "\/administrator\/tmp\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/administrator\/tmp\/ HTTP\/1.1",
"request_sample": "GET \/administrator\/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/administrator\/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"evidence": {
"method": "GET",
"path": "\/administrator\/tmp\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/administrator\/tmp\/ HTTP\/1.1",
"request_sample": "GET \/administrator\/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/administrator\/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"classification_reason": "Type \u00ab joomla_scanner \u00bb (signaux protocolaires) \u00b7 confiance 56%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"cms_scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "33bcb6fa1c8b521b93da40eac76c199136ffbf67",
"protocol_details": {
"http_method": "GET",
"http_path": "\/administrator\/tmp\/",
"request_line": "GET \/administrator\/tmp\/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/administrator\/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"attack_vector": "joomla scanner \u00b7 via HTTP:876 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/administrator\/tmp\/",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab joomla_scanner \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"classification_reason_label_fr": "Type \u00ab joomla_scanner \u00bb (signaux protocolaires) \u00b7 confiance 56%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0007 \u2014 confiance 56 % \u2014 via HTTP",
"confidence_pct": 56,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 71
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"pat-0853"
],
"tags_summary_labels_fr": [
"pat-0853"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/administrator\/tmp\/",
"request_line": "GET \/administrator\/tmp\/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "joomla scanner \u00b7 via HTTP:876 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/administrator\/tmp\/",
"evidence_snippet": "GET \/administrator\/tmp\/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 56 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_joomla",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /sql/log%2esql
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /sql/log%2esql UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/sql/log%2esql
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/sql/log%2esql
Pourquoi cette classification : Sonde fichier sensible / config · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /sql/log%2esql HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /sql/log%2esql HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language:
Requête brute (extrait)
GET /sql/log%2esql HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Clie
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "fdda8e50822b523c81301ac6adcd70fb50c12e3d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 376,
"payload_entropy": 5.161661649795659,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "f888685507cee897dcf81309412828ad963a5be1",
"event_fingerprint": "8bfc17dcc4e787ff7139aa99ce148e48940684b6",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "e4b44d097bafa9abeb58d8c1e48dc76a",
"path_pattern_hash": "5c7ecc930543dee5fcde6e629b2067b2"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/sql\/log%2esql HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: ",
"method": "GET",
"path": "\/sql\/log%2esql",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/sql\/log%2esql HTTP\/1.1",
"request_sample": "GET \/sql\/log%2esql HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clie",
"payload_snippet": "GET \/sql\/log%2esql HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"evidence": {
"method": "GET",
"path": "\/sql\/log%2esql",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/sql\/log%2esql HTTP\/1.1",
"request_sample": "GET \/sql\/log%2esql HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clie",
"payload_snippet": "GET \/sql\/log%2esql HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4397a2fbe83fc6441dc5176b588f8d9d6a925088",
"protocol_details": {
"http_method": "GET",
"http_path": "\/sql\/log%2esql",
"request_line": "GET \/sql\/log%2esql HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sql\/log%2esql HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sql\/log%2esql",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/sql\/log%2esql",
"request_line": "GET \/sql\/log%2esql HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/sql\/log%2esql",
"evidence_snippet": "GET \/sql\/log%2esql HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_sql",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /samples/%2egit/config
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /samples/%2egit/config UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950513:leak-0
Cible HTTP
GET
/samples/%2egit/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/samples/%2egit/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /samples/%2egit/config HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-0
dns-rebind
scanner-ua
Payload (extrait)
GET /samples/%2egit/config HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /samples/%2egit/config HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "ff43e37b6bc5435dd4dbf8bce10a7971eae6ee4a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.1780742056390165,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "c4feb444a3efdd822dc14dd04ceaafaba72b6ca6",
"event_fingerprint": "a76e92b2b7c5fd4d7321312e780fc01770013b6e",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "11d86697068320069c622c0e7c087258",
"path_pattern_hash": "ae546280e887c4720cd441d74e3bdc73"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/samples\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/samples\/%2egit\/config",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950513:leak-0",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-0",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/samples\/%2egit\/config HTTP\/1.1",
"request_sample": "GET \/samples\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/samples\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/samples\/%2egit\/config",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950513:leak-0",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-0",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/samples\/%2egit\/config HTTP\/1.1",
"request_sample": "GET \/samples\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/samples\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "56c5c1baabe068f7daf79a8fc570938394a13655",
"protocol_details": {
"http_method": "GET",
"http_path": "\/samples\/%2egit\/config",
"request_line": "GET \/samples\/%2egit\/config HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/samples\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/samples\/%2egit\/config",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/samples\/%2egit\/config",
"request_line": "GET \/samples\/%2egit\/config HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/samples\/%2egit\/config",
"evidence_snippet": "GET \/samples\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950513:leak-0",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_git_exposure",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /srv/%2essh/client%2epem
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /srv/%2essh/client%2epem UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/srv/%2essh/client%2epem
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/srv/%2essh/client%2epem
Pourquoi cette classification : Sonde fichier sensible / config · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /srv/%2essh/client%2epem HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /srv/%2essh/client%2epem HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-
Requête brute (extrait)
GET /srv/%2essh/client%2epem HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "b9ab8c920f74602e6816136980d7f7d16452f7e0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.189120880607845,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "2c747d1fcc80feb65ccf97f723568a5de35b09c7",
"event_fingerprint": "f89c8224bf82b2a50686545ed7960d693aaea4cb",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "6d27cde0f46c88e9836ccdf4c3f681b5",
"path_pattern_hash": "f6fb1aa9960d3b4f6e998ec7225beb8a"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/srv\/%2essh\/client%2epem HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"method": "GET",
"path": "\/srv\/%2essh\/client%2epem",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/srv\/%2essh\/client%2epem HTTP\/1.1",
"request_sample": "GET \/srv\/%2essh\/client%2epem HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/srv\/%2essh\/client%2epem HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"evidence": {
"method": "GET",
"path": "\/srv\/%2essh\/client%2epem",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/srv\/%2essh\/client%2epem HTTP\/1.1",
"request_sample": "GET \/srv\/%2essh\/client%2epem HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r",
"payload_snippet": "GET \/srv\/%2essh\/client%2epem HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "60fe3794f5ca3d9ce2bf95822933e0e4fca1beb4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/srv\/%2essh\/client%2epem",
"request_line": "GET \/srv\/%2essh\/client%2epem HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/srv\/%2essh\/client%2epem HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/srv\/%2essh\/client%2epem",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/srv\/%2essh\/client%2epem",
"request_line": "GET \/srv\/%2essh\/client%2epem HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/srv\/%2essh\/client%2epem",
"evidence_snippet": "GET \/srv\/%2essh\/client%2epem HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /config/github%2ejs
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /config/github%2ejs UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/config/github%2ejs
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/config/github%2ejs
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/github%2ejs HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /config/github%2ejs HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langu
Requête brute (extrait)
GET /config/github%2ejs HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "31235cdefba37bd63304f07a58e1650fc39ad55e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 381,
"payload_entropy": 5.195022407334832,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "949d093be1453007e88875b7e2d34903504a842c",
"event_fingerprint": "a3aea3ec47b5d2a68a0424cc6d80eb4d58b8b403",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "dce42014bf5254c0e9df2a1f6709ac22",
"path_pattern_hash": "1007b45428837e14faf9ef7ca667d281"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/config\/github%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"method": "GET",
"path": "\/config\/github%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/github%2ejs HTTP\/1.1",
"request_sample": "GET \/config\/github%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/config\/github%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"evidence": {
"method": "GET",
"path": "\/config\/github%2ejs",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/github%2ejs HTTP\/1.1",
"request_sample": "GET \/config\/github%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/config\/github%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3b5e741632d9a48254e188e2e73d7bf5f2bef475",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/github%2ejs",
"request_line": "GET \/config\/github%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/github%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/github%2ejs",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/github%2ejs",
"request_line": "GET \/config\/github%2ejs HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/github%2ejs",
"evidence_snippet": "GET \/config\/github%2ejs HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /cms/%2eenv%2elocal
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /cms/%2eenv%2elocal UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/cms/%2eenv%2elocal
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/cms/%2eenv%2elocal
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /cms/%2eenv%2elocal HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /cms/%2eenv%2elocal HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langu
Requête brute (extrait)
GET /cms/%2eenv%2elocal HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "768d5b2efb05623af43a9c09cc0d8ffa1222d37e",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 381,
"payload_entropy": 5.1725845927107805,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "ab907ea3696690bc12bcaa3839308bf7f25bf5bc",
"event_fingerprint": "f6f2948bb8b227573f8640fe00d79eaf65bca74d",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "e4225fb17bc855fc8a04304f5f1f0c24",
"path_pattern_hash": "ffe7e3ec3c7cd50b99e1ae135a3b4c50"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/cms\/%2eenv%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"method": "GET",
"path": "\/cms\/%2eenv%2elocal",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/cms\/%2eenv%2elocal HTTP\/1.1",
"request_sample": "GET \/cms\/%2eenv%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/cms\/%2eenv%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"evidence": {
"method": "GET",
"path": "\/cms\/%2eenv%2elocal",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/cms\/%2eenv%2elocal HTTP\/1.1",
"request_sample": "GET \/cms\/%2eenv%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue",
"payload_snippet": "GET \/cms\/%2eenv%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ae4682d892ff28c5dffc85befa27e03edf5bb665",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cms\/%2eenv%2elocal",
"request_line": "GET \/cms\/%2eenv%2elocal HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cms\/%2eenv%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cms\/%2eenv%2elocal",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/cms\/%2eenv%2elocal",
"request_line": "GET \/cms\/%2eenv%2elocal HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cms\/%2eenv%2elocal",
"evidence_snippet": "GET \/cms\/%2eenv%2elocal HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langu",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
admin panel scan
admin panel scan · via HTTP:876 · (sonde / probe) · → /admin/tmp/debug%2elog
|
Élevée
|
Élevé · 71
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /admin/tmp/debug%2elog UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/admin/tmp/debug%2elog
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/admin/tmp/debug%2elog
Pourquoi cette classification : Sonde fichier sensible / config · confiance 56%
Confiance classification
56%
Risque capteur
Élevé
· 71
Confiance : Confiance 56 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
pat-0854
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
SSRF Localhost SSRF
ET Magento admin
ES admin GET
ActiveMQ console
Ligne de requête
GET /admin/tmp/debug%2elog HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /admin/tmp/debug%2elog HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /admin/tmp/debug%2elog HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "75a8f3fbd9003970a6f79c27838babe7253feeb6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.185430339258397,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 71,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "d8408d533a8cf50eaee99503110067ef43f3167c",
"event_fingerprint": "a0d8630c30584e85ea6b894086045dfee2786965",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 56%",
"confidence": 0.56,
"classification_confidence": 0.56,
"precision_score": 66,
"precision_signals": [
"pat-0854"
],
"kb_rule_ids": [
"pat-0854"
],
"matched_patterns": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"matched_pattern_names": [
"SSRF Localhost SSRF",
"ET Magento admin",
"ES admin GET",
"ActiveMQ console"
],
"pattern_ids": [
"pat-0340",
"pat-0854",
"pat-0341",
"pat-0606"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 71
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 56,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "fc00abc4cb9a5af16ec1edc3baf004a3",
"path_pattern_hash": "42141cfe0e38e26639faf83976edb4b9"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 71
},
"payload_preview": "GET \/admin\/tmp\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/admin\/tmp\/debug%2elog",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/tmp\/debug%2elog HTTP\/1.1",
"request_sample": "GET \/admin\/tmp\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/admin\/tmp\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/admin\/tmp\/debug%2elog",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/admin\/tmp\/debug%2elog HTTP\/1.1",
"request_sample": "GET \/admin\/tmp\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/admin\/tmp\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 56%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8ec4f661459605d34a1c0eee75aa69b56842bd2d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/tmp\/debug%2elog",
"request_line": "GET \/admin\/tmp\/debug%2elog HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/admin\/tmp\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "admin panel scan \u00b7 via HTTP:876 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/admin\/tmp\/debug%2elog",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 56%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 56%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 71\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0007 \u2014 confiance 56 % \u2014 via HTTP",
"confidence_pct": 56,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 71
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 71,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"pat-0854"
],
"tags_summary_labels_fr": [
"pat-0854"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/admin\/tmp\/debug%2elog",
"request_line": "GET \/admin\/tmp\/debug%2elog HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "admin panel scan \u00b7 via HTTP:876 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/admin\/tmp\/debug%2elog",
"evidence_snippet": "GET \/admin\/tmp\/debug%2elog HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 56 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 56 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_admin_panel_probe",
"http_admin_panel_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_admin",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /api/env/readme%2eenv
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /api/env/readme%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
33
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/env/readme%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/api/env/readme%2eenv
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 6 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /api/env/readme%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
k8s-api
dns-rebind
scanner-ua
Payload (extrait)
GET /api/env/readme%2eenv HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lan
Requête brute (extrait)
GET /api/env/readme%2eenv HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tr
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "6959e7f777f1c1c329ed0ea534af4a5b1e22a6e9",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 383,
"payload_entropy": 5.167279863198587,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 18,
"anomaly_count": 1,
"campaign_key": "65e15cf199476069c5c2b5fef6a245433ff1944e",
"event_fingerprint": "fc1e9e80e912365b34df1b303ef7887aef547c87",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "06808a29bee86db56e4e561c250a8c71",
"path_pattern_hash": "755d21769521dba80302df10e8160920"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/api\/env\/readme%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"method": "GET",
"path": "\/api\/env\/readme%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/env\/readme%2eenv HTTP\/1.1",
"request_sample": "GET \/api\/env\/readme%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/api\/env\/readme%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"evidence": {
"method": "GET",
"path": "\/api\/env\/readme%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"k8s-api",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/api\/env\/readme%2eenv HTTP\/1.1",
"request_sample": "GET \/api\/env\/readme%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/api\/env\/readme%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2f43aadda8fd3881d31e3e2546b3e2b246a01aa0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/env\/readme%2eenv",
"request_line": "GET \/api\/env\/readme%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/env\/readme%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/env\/readme%2eenv",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/env\/readme%2eenv",
"request_line": "GET \/api\/env\/readme%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/env\/readme%2eenv",
"evidence_snippet": "GET \/api\/env\/readme%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950600:k8s-api",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_api",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /helm/values-rds%2eyaml
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /helm/values-rds%2eyaml UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/helm/values-rds%2eyaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/helm/values-rds%2eyaml
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /helm/values-rds%2eyaml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /helm/values-rds%2eyaml HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-L
Requête brute (extrait)
GET /helm/values-rds%2eyaml HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "d402699b7fcbcd768743a74fee61e1c7b3a77766",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 385,
"payload_entropy": 5.205383054747351,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "0fb20ef4a5f0fa5ac3ab52dca429b49d1116abca",
"event_fingerprint": "ee1d85310acd7c16dec6a0bd432cd04029b395d9",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "23d3cd0100c023ce1aa0f12edf424755",
"path_pattern_hash": "b3c24af33e37d5829c1a62da273e267c"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/helm\/values-rds%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"method": "GET",
"path": "\/helm\/values-rds%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/helm\/values-rds%2eyaml HTTP\/1.1",
"request_sample": "GET \/helm\/values-rds%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/helm\/values-rds%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"evidence": {
"method": "GET",
"path": "\/helm\/values-rds%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/helm\/values-rds%2eyaml HTTP\/1.1",
"request_sample": "GET \/helm\/values-rds%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\n",
"payload_snippet": "GET \/helm\/values-rds%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ad6977cb02c780c36e556380c7a1fc54109bc94",
"protocol_details": {
"http_method": "GET",
"http_path": "\/helm\/values-rds%2eyaml",
"request_line": "GET \/helm\/values-rds%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/helm\/values-rds%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/helm\/values-rds%2eyaml",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/helm\/values-rds%2eyaml",
"request_line": "GET \/helm\/values-rds%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/helm\/values-rds%2eyaml",
"evidence_snippet": "GET \/helm\/values-rds%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-L",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_helm_probe",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /*%2eenv%2elive
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /*%2eenv%2elive UA curl/8.7.1
Émulateur
HTTP
WAF
23
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
951041:dns-rebind
scanner-ua
Cible HTTP
GET
/*%2eenv%2elive
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/*%2eenv%2elive
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 4 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /*%2eenv%2elive HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
dns-rebind
scanner-ua
Payload (extrait)
GET /*%2eenv%2elive HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language:
Requête brute (extrait)
GET /*%2eenv%2elive HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cli
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "3c695c6a7965f03130b66d4a4b2e1c9507f39103",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 377,
"payload_entropy": 5.158031374677397,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "33fd968c8850066da795ff4e2e07345a4c393a27",
"event_fingerprint": "ad5abced5530eca589a6010a7a85aa673bb8b34c",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "6842ef491f5497b9ced421485f77b694",
"path_pattern_hash": "cb28d52f71e8e79d883989956ec18a60"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/*%2eenv%2elive HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"method": "GET",
"path": "\/*%2eenv%2elive",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/*%2eenv%2elive HTTP\/1.1",
"request_sample": "GET \/*%2eenv%2elive HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/*%2eenv%2elive HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"evidence": {
"method": "GET",
"path": "\/*%2eenv%2elive",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/*%2eenv%2elive HTTP\/1.1",
"request_sample": "GET \/*%2eenv%2elive HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/*%2eenv%2elive HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "566a77d603f9f58068b78cb664bd0fa64d154bdc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/*%2eenv%2elive",
"request_line": "GET \/*%2eenv%2elive HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/*%2eenv%2elive HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/*%2eenv%2elive",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/*%2eenv%2elive",
"request_line": "GET \/*%2eenv%2elive HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/*%2eenv%2elive",
"evidence_snippet": "GET \/*%2eenv%2elive HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /configuration/%2egit/config
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /configuration/%2egit/config UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950513:leak-0
Cible HTTP
GET
/configuration/%2egit/config
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/configuration/%2egit/config
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /configuration/%2egit/config HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-0
dns-rebind
scanner-ua
Payload (extrait)
GET /configuration/%2egit/config HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Acc
Requête brute (extrait)
GET /configuration/%2egit/config HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "717066ec3d0d2f2f3f9f08e3337514eace9a0bd2",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 390,
"payload_entropy": 5.163914588226091,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "c4feb444a3efdd822dc14dd04ceaafaba72b6ca6",
"event_fingerprint": "5fb6ce739dcee562cccb7227da66dffb44aa108b",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "f89d06eac91933c8d9f43c1f7376cc20",
"path_pattern_hash": "94b5ef63645dbb5fe6748c6e743eaffe"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/configuration\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"method": "GET",
"path": "\/configuration\/%2egit\/config",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950513:leak-0",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-0",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/configuration\/%2egit\/config HTTP\/1.1",
"request_sample": "GET \/configuration\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.",
"payload_snippet": "GET \/configuration\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"evidence": {
"method": "GET",
"path": "\/configuration\/%2egit\/config",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950513:leak-0",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-0",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/configuration\/%2egit\/config HTTP\/1.1",
"request_sample": "GET \/configuration\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.",
"payload_snippet": "GET \/configuration\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "41311fdd10da53385a70e49c10f2fd148a2fed41",
"protocol_details": {
"http_method": "GET",
"http_path": "\/configuration\/%2egit\/config",
"request_line": "GET \/configuration\/%2egit\/config HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/configuration\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configuration\/%2egit\/config",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/configuration\/%2egit\/config",
"request_line": "GET \/configuration\/%2egit\/config HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/configuration\/%2egit\/config",
"evidence_snippet": "GET \/configuration\/%2egit\/config HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcc",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950513:leak-0",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_git_exposure",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /root/aws%2ejson
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /root/aws%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/root/aws%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/root/aws%2ejson
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /root/aws%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /root/aws%2ejson HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language
Requête brute (extrait)
GET /root/aws%2ejson HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cl
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "f8d52e4c5d8e717b4a2eeccaf22bf46c7f98b487",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 378,
"payload_entropy": 5.162083297643444,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "9c99806245427386a537c5e80f2f5eee54a09af4",
"event_fingerprint": "ae6b93dada052645dc8908b8ed64e96a482e6716",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "fbddd79ac51d3582db3d46e0157c8e3c",
"path_pattern_hash": "844bee8a178dc7852430621fe2ac02c1"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/root\/aws%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"method": "GET",
"path": "\/root\/aws%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/root\/aws%2ejson HTTP\/1.1",
"request_sample": "GET \/root\/aws%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/root\/aws%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"evidence": {
"method": "GET",
"path": "\/root\/aws%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/root\/aws%2ejson HTTP\/1.1",
"request_sample": "GET \/root\/aws%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cl",
"payload_snippet": "GET \/root\/aws%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3f6700247547e3c47e67895cbcf64c4e2d4ed027",
"protocol_details": {
"http_method": "GET",
"http_path": "\/root\/aws%2ejson",
"request_line": "GET \/root\/aws%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/root\/aws%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/root\/aws%2ejson",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/root\/aws%2ejson",
"request_line": "GET \/root\/aws%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/root\/aws%2ejson",
"evidence_snippet": "GET \/root\/aws%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /masking/config%2ejson
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /masking/config%2ejson UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/masking/config%2ejson
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/masking/config%2ejson
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /masking/config%2ejson HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /masking/config%2ejson HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-La
Requête brute (extrait)
GET /masking/config%2ejson HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 T
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "8df73220ab9c57c0467087a96f8175765013fc30",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 384,
"payload_entropy": 5.1918526091990325,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 17,
"anomaly_count": 1,
"campaign_key": "1a4e5c26a8267bfab9166559ac6383405834b15a",
"event_fingerprint": "1b017d52b38ab0ca6afdb1456f4864f4847ad30b",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "67af44f30d041b40eb6e0bf3c5f9b38d",
"path_pattern_hash": "fcb1448506c7d704bfedfff241f5c6bd"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/masking\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"method": "GET",
"path": "\/masking\/config%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/masking\/config%2ejson HTTP\/1.1",
"request_sample": "GET \/masking\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/masking\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"evidence": {
"method": "GET",
"path": "\/masking\/config%2ejson",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/masking\/config%2ejson HTTP\/1.1",
"request_sample": "GET \/masking\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nT",
"payload_snippet": "GET \/masking\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ad2d9715043381385ace521d98c0f32d4a9998fc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/masking\/config%2ejson",
"request_line": "GET \/masking\/config%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/masking\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/masking\/config%2ejson",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/masking\/config%2ejson",
"request_line": "GET \/masking\/config%2ejson HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/masking\/config%2ejson",
"evidence_snippet": "GET \/masking\/config%2ejson HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-La",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|