|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /eRp/%2eEnV
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /eRp/%2eEnV UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/eRp/%2eEnV
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/eRp/%2eEnV
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /eRp/%2eEnV HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /eRp/%2eEnV HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-
Requête brute (extrait)
GET /eRp/%2eEnV HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Client-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "a0773e74fa74d197b9ebc7bae61bb3e211da4d03",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 373,
"payload_entropy": 5.159380704601103,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "ab907ea3696690bc12bcaa3839308bf7f25bf5bc",
"event_fingerprint": "b2bf2c9e833f86a4342c8a5ca143193b3ae0591d",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "c5b68e3ad4c37ffad2909c85a850ff3a",
"path_pattern_hash": "4ba2631e3f5cabb1ec57f417ca53bd23"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/eRp\/%2eEnV HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-",
"method": "GET",
"path": "\/eRp\/%2eEnV",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/eRp\/%2eEnV HTTP\/1.1",
"request_sample": "GET \/eRp\/%2eEnV HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-",
"payload_snippet": "GET \/eRp\/%2eEnV HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-",
"evidence": {
"method": "GET",
"path": "\/eRp\/%2eEnV",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/eRp\/%2eEnV HTTP\/1.1",
"request_sample": "GET \/eRp\/%2eEnV HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-",
"payload_snippet": "GET \/eRp\/%2eEnV HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2720ebf49ce34c8537742afd51784dac5450da51",
"protocol_details": {
"http_method": "GET",
"http_path": "\/eRp\/%2eEnV",
"request_line": "GET \/eRp\/%2eEnV HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/eRp\/%2eEnV HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/eRp\/%2eEnV",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/eRp\/%2eEnV",
"request_line": "GET \/eRp\/%2eEnV HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/eRp\/%2eEnV",
"evidence_snippet": "GET \/eRp\/%2eEnV HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /smtp/sendgrid%2eyaml
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /smtp/sendgrid%2eyaml UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/smtp/sendgrid%2eyaml
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/smtp/sendgrid%2eyaml
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /smtp/sendgrid%2eyaml HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /smtp/sendgrid%2eyaml HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Lan
Requête brute (extrait)
GET /smtp/sendgrid%2eyaml HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 Tr
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "883649a92f29a1edee2358095002a57b6725c30a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 383,
"payload_entropy": 5.185475267148815,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "9c99806245427386a537c5e80f2f5eee54a09af4",
"event_fingerprint": "82e7f5189bc6119dc21215709644bc06b0c6e6ef",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "762dddb1ea04508760db17626fe6ff5e",
"path_pattern_hash": "00b609e2631d5e51acd76b1447204c7a"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/smtp\/sendgrid%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"method": "GET",
"path": "\/smtp\/sendgrid%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/smtp\/sendgrid%2eyaml HTTP\/1.1",
"request_sample": "GET \/smtp\/sendgrid%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/smtp\/sendgrid%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"evidence": {
"method": "GET",
"path": "\/smtp\/sendgrid%2eyaml",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/smtp\/sendgrid%2eyaml HTTP\/1.1",
"request_sample": "GET \/smtp\/sendgrid%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTr",
"payload_snippet": "GET \/smtp\/sendgrid%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5f630b4282974d710e573f49fb2fb9911122b591",
"protocol_details": {
"http_method": "GET",
"http_path": "\/smtp\/sendgrid%2eyaml",
"request_line": "GET \/smtp\/sendgrid%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/smtp\/sendgrid%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/smtp\/sendgrid%2eyaml",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/smtp\/sendgrid%2eyaml",
"request_line": "GET \/smtp\/sendgrid%2eyaml HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/smtp\/sendgrid%2eyaml",
"evidence_snippet": "GET \/smtp\/sendgrid%2eyaml HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Lan",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /config/json/settings%2ebak
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /config/json/settings%2ebak UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950521:leak-8
Cible HTTP
GET
/config/json/settings%2ebak
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/config/json/settings%2ebak
Pourquoi cette classification : Sonde fichier sensible / config · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 6 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /config/json/settings%2ebak HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /config/json/settings%2ebak HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Acce
Requête brute (extrait)
GET /config/json/settings%2ebak HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "04bd0636003a6e4db98da06aab0ba65a88ae4cae",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 389,
"payload_entropy": 5.19351227023704,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "d5b698cced24c547296ded2764b4bd40e5ff7163",
"event_fingerprint": "a07376036ef2593b83a6f768a33d34b8c9e60c89",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "9dd5e10bc262259ebff04d9fe710ec30",
"path_pattern_hash": "71ffcf128e2a537c89d12b964ca087a3"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/config\/json\/settings%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"method": "GET",
"path": "\/config\/json\/settings%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/json\/settings%2ebak HTTP\/1.1",
"request_sample": "GET \/config\/json\/settings%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/config\/json\/settings%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"evidence": {
"method": "GET",
"path": "\/config\/json\/settings%2ebak",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/config\/json\/settings%2ebak HTTP\/1.1",
"request_sample": "GET \/config\/json\/settings%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0",
"payload_snippet": "GET \/config\/json\/settings%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1a373e8b6262e760ac0638fd59a93b604db6bb33",
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/json\/settings%2ebak",
"request_line": "GET \/config\/json\/settings%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/json\/settings%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/json\/settings%2ebak",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"classification_reason_label_fr": "Sonde fichier sensible \/ config \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/config\/json\/settings%2ebak",
"request_line": "GET \/config\/json\/settings%2ebak HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/config\/json\/settings%2ebak",
"evidence_snippet": "GET \/config\/json\/settings%2ebak HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAcce",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_config",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit) · → /app/mailjet%2eenv
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /app/mailjet%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
29
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
951041:dns-rebind
Cible HTTP
GET
/app/mailjet%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/app/mailjet%2eenv
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /app/mailjet%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
dns-rebind
scanner-ua
Payload (extrait)
GET /app/mailjet%2eenv HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Langua
Requête brute (extrait)
GET /app/mailjet%2eenv HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "fcabf15acac49209f9d5b9901cee0de71f0d8e91",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 380,
"payload_entropy": 5.17792744020065,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "9c99806245427386a537c5e80f2f5eee54a09af4",
"event_fingerprint": "eeeac1ae0c54c9e9abdc5b009f8c895951bc5fe3",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "88da79a08ce4ca965152fe43b2975d61",
"path_pattern_hash": "71c04910ff5aeeeaaa2d1d400846da3b"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/app\/mailjet%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"method": "GET",
"path": "\/app\/mailjet%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/app\/mailjet%2eenv HTTP\/1.1",
"request_sample": "GET \/app\/mailjet%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/app\/mailjet%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"evidence": {
"method": "GET",
"path": "\/app\/mailjet%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/app\/mailjet%2eenv HTTP\/1.1",
"request_sample": "GET \/app\/mailjet%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-",
"payload_snippet": "GET \/app\/mailjet%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3749fe8bc5c9b59164ce6e4f3cd442021aa8b32d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/mailjet%2eenv",
"request_line": "GET \/app\/mailjet%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/app\/mailjet%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/mailjet%2eenv",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/app\/mailjet%2eenv",
"request_line": "GET \/app\/mailjet%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/app\/mailjet%2eenv",
"evidence_snippet": "GET \/app\/mailjet%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Langua",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /plugins/%2eenv
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /plugins/%2eenv UA curl/8.7.1
Émulateur
HTTP
WAF
37
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950468:nosqli-3
950514:leak-1
Cible HTTP
GET
/plugins/%2eenv
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/plugins/%2eenv
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /plugins/%2eenv HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
nosqli-3
leak-1
dns-rebind
scanner-ua
Payload (extrait)
GET /plugins/%2eenv HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language:
Requête brute (extrait)
GET /plugins/%2eenv HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Cli
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "d98b2d22c40992ffce83dd96d470546c0ee49cc1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 377,
"payload_entropy": 5.156944938520112,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 19,
"anomaly_count": 1,
"campaign_key": "ab907ea3696690bc12bcaa3839308bf7f25bf5bc",
"event_fingerprint": "a81c38fa4bbd05ba05ced4f88d83cb405908c76e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "8e4206a3fef43608578654309b224751",
"path_pattern_hash": "7b2a6b56e58c02e6b853ca112682b72d"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/plugins\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"method": "GET",
"path": "\/plugins\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/plugins\/%2eenv HTTP\/1.1",
"request_sample": "GET \/plugins\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/plugins\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"evidence": {
"method": "GET",
"path": "\/plugins\/%2eenv",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"nosqli-3",
"leak-1",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/plugins\/%2eenv HTTP\/1.1",
"request_sample": "GET \/plugins\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Cli",
"payload_snippet": "GET \/plugins\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "aa48013cc0d0eebbb92ba5293dca872a9084a903",
"protocol_details": {
"http_method": "GET",
"http_path": "\/plugins\/%2eenv",
"request_line": "GET \/plugins\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/plugins\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/plugins\/%2eenv",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/plugins\/%2eenv",
"request_line": "GET \/plugins\/%2eenv HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/plugins\/%2eenv",
"evidence_snippet": "GET \/plugins\/%2eenv HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language:",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950514:leak-1",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Sonde fichier configuration
config file probe · via HTTP:876 · (tentative d'exploit) · → /%2eenv%2eold
|
Élevée
|
Élevé · 79
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /%2eenv%2eold UA curl/8.7.1
Émulateur
HTTP
WAF
39
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950514:leak-1
950521:leak-8
Cible HTTP
GET
/%2eenv%2eold
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/%2eenv%2eold
Pourquoi cette classification : Sonde fichier sensible: fichier configuration · Règle WAF « rce-0 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 6 tag(s) WAF
Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /%2eenv%2eold HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
leak-1
leak-8
dns-rebind
scanner-ua
Payload (extrait)
GET /%2eenv%2eold HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: e
Requête brute (extrait)
GET /%2eenv%2eold HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Clien
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "09dc94882ff60a8444cfdbe8edcb0f423cfca755",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 375,
"payload_entropy": 5.151408400257566,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 21,
"anomaly_count": 1,
"campaign_key": "8597b5c75629358f77dea46aa1c3e8c0231f1613",
"event_fingerprint": "4436ec3c9fc766b99d795d5c514f5ee8480d55ec",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "f918c5970b5ba738ea98c43b5291d867",
"path_pattern_hash": "67dfc11076789a6bcb1ad241d8eceda4"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/%2eenv%2eold HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"method": "GET",
"path": "\/%2eenv%2eold",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-1",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2eenv%2eold HTTP\/1.1",
"request_sample": "GET \/%2eenv%2eold HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/%2eenv%2eold HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"evidence": {
"method": "GET",
"path": "\/%2eenv%2eold",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"950521:leak-8",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"leak-1",
"leak-8",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/%2eenv%2eold HTTP\/1.1",
"request_sample": "GET \/%2eenv%2eold HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Clien",
"payload_snippet": "GET \/%2eenv%2eold HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "54e068730935c08889adba25f8a55aba0b6ff102",
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eenv%2eold",
"request_line": "GET \/%2eenv%2eold HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/%2eenv%2eold HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eenv%2eold",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: fichier configuration \u00b7 R\u00e8gle WAF \u00ab rce-0 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/%2eenv%2eold",
"request_line": "GET \/%2eenv%2eold HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/%2eenv%2eold",
"evidence_snippet": "GET \/%2eenv%2eold HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: e",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950514:leak-1",
"950521:leak-8",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_backup_file_scan",
"http_backup_path",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_env",
"http_sensitive_path",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true,
"behavior_alert_count": 1,
"behavior_priority": 72
}
|
|
|
TCP |
8887 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8887 · (reconnaissance) · → /wp-json/gravitysmtp/v1/tests/mock-data
|
Élevée
|
Élevé · 74
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
MITRE
TA0043
TA0043
Protocole
GET /wp-json/gravitysmtp/v1/tests/mock-data UA curl/8.7.1
Émulateur
HTTP
WAF
40
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950402:ssrf-2
950468:nosqli-3
Cible HTTP
GET
/wp-json/gravitysmtp/v1/tests/mock-data
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8887
Chemin / cible
/wp-json/gravitysmtp/v1/tests/mock-data
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 50%
Confiance classification
56%
Corrélation +6
Risque capteur
Élevé
· 74
Confiance : Confiance 50 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
lfi-14
rce-0
ssrf-2
nosqli-3
cms-3
dns-rebind
scanner-ua
Payload (extrait)
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1
Host: 62.3.50.33:8887
User-Agent: curl/8.7.1
A
Requête brute (extrait)
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1 Host: 62.3.50.33:8887 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originat
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 1,
"http_path_depth": 5,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "66ba040b379f2194a9abf6dcf13a7242c304068a",
"http_target_hash": "0e39cf789b77e87610b2bcc4ef3f5049d93e9b1d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 428,
"payload_entropy": 5.253161020361876,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 8887,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 74,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "06b19db9e948aa3020a9731dd18eb4b0284583a2",
"event_fingerprint": "6fce314947fe649a3275990194293093397a11ce",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.56,
"classification_confidence": 0.56,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 74,
"correlation_boost": 6
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "4ef74b20fe9a1cc7f226348bb5373b9b",
"path_pattern_hash": "9e982a0040e4931e276697495003d69e"
},
"target_context": {
"dst_port": 8887,
"service": "http",
"service_name": "http",
"risk_score": 74
},
"payload_preview": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:8887\r\nUser-Agent: curl\/8.7.1\r\nA",
"method": "GET",
"path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"query_string": "page=gravitysmtp-settings",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"request_sample": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:8887\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originat",
"payload_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:8887\r\nUser-Agent: curl\/8.7.1\r\nA",
"evidence": {
"method": "GET",
"path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"query_string": "page=gravitysmtp-settings",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"request_sample": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:8887\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originat",
"payload_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:8887\r\nUser-Agent: curl\/8.7.1\r\nA",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "4316bea605bf9ef1a7c635202d536ff416b58417",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8887,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:8887\r\nUser-Agent: curl\/8.7.1\r\nA",
"attack_vector": "port scan syn \u00b7 via HTTP:8887 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"target_port_label": "8887 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 74\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0043 \u2014 confiance 56 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 56,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 74,
"correlation_boost": 6
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 74,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8887,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8887,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8887 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"evidence_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:8887\r\nUser-Agent: curl\/8.7.1\r\nA",
"target_port_label": "8887 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 56 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +6 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8887"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
5357,
8879,
8887,
11300
],
"behavior_alerts": [
"port_scan_campaign"
],
"correlation_confidence_boost": 6,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_wp_json",
"http_ua_suspicious",
"http_wp_scan",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8887 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8887 · (reconnaissance)
|
Élevée
|
Élevé · 79
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Campagne multi-ports
Protocole
GET / UA curl/8.7.1
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950734:sap-sapcontrol-path
951041:dns-rebind
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8887
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Corrélation +6
Risque capteur
Élevé
· 79
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
sap-sapcontrol-path
dns-rebind
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8887
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-US,en;q=0
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8887 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Client-IP: 127.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "66ba040b379f2194a9abf6dcf13a7242c304068a",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 364,
"payload_entropy": 5.120576187571252,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 8887,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 79,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "43414986e31b27e83b2e8489c8460d42e2d3d261",
"event_fingerprint": "7ddf8c64495eee0d36a4cb196081e425c3236caa",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79,
"correlation_boost": 6
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "64cb57303b81d39e3489497ae7a3b086",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8887,
"service": "http",
"service_name": "http",
"risk_score": 79
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8887\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"method": "GET",
"path": "\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"sap-sapcontrol-path",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8887\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.0",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8887\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"sap-sapcontrol-path",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8887\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.0",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8887\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5a6fb382b7bd578a8d49ea9eb20941881ac2dac9",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8887,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8887\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"attack_vector": "port scan syn \u00b7 via HTTP:8887 \u00b7 (reconnaissance)",
"target_port_label": "8887 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 79\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 campagne multi-ports",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 79,
"correlation_boost": 6
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 79,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8887,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": [
"campagne_ports"
],
"correlation_flags_labels_fr": [
"Campagne multi-ports"
],
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Corr\u00e9lation +6",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8887,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8887 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8887\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"target_port_label": "8887 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +6 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": "Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte",
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8887"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"port_scan_campaign": true,
"port_scan_distinct_ports": 4,
"port_scan_ports_sample": [
5357,
8879,
8887,
11300
],
"behavior_alerts": [
"port_scan_campaign"
],
"correlation_confidence_boost": 6,
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5357 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5357 · (reconnaissance) · → /wp-json/gravitysmtp/v1/tests/mock-data
|
Élevée
|
Élevé · 75
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /wp-json/gravitysmtp/v1/tests/mock-data UA curl/8.7.1
Émulateur
HTTP
WAF
40
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950402:ssrf-2
950468:nosqli-3
Cible HTTP
GET
/wp-json/gravitysmtp/v1/tests/mock-data
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5357
Chemin / cible
/wp-json/gravitysmtp/v1/tests/mock-data
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Élevé
· 75
Confiance : Confiance 50 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
lfi-14
rce-0
ssrf-2
nosqli-3
cms-3
dns-rebind
scanner-ua
Payload (extrait)
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1
Host: 62.3.50.33:5357
User-Agent: curl/8.7.1
A
Requête brute (extrait)
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1 Host: 62.3.50.33:5357 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originat
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 1,
"http_path_depth": 5,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "e42510f4f5c75f2667a51c32bc000c1378cd772e",
"http_target_hash": "0e39cf789b77e87610b2bcc4ef3f5049d93e9b1d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 428,
"payload_entropy": 5.253161020361876,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 5357,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 7,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 75,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "50699a1995fad7615dff2853866a4dfdc715af3e",
"event_fingerprint": "8089495f0c2bd9f07723d8783e70d05ccac9457b",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 75
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "adf0b4c079424571565a16cd7b4c575c",
"path_pattern_hash": "9e982a0040e4931e276697495003d69e"
},
"target_context": {
"dst_port": 5357,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:5357\r\nUser-Agent: curl\/8.7.1\r\nA",
"method": "GET",
"path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"query_string": "page=gravitysmtp-settings",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"request_sample": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:5357\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originat",
"payload_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:5357\r\nUser-Agent: curl\/8.7.1\r\nA",
"evidence": {
"method": "GET",
"path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"query_string": "page=gravitysmtp-settings",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"request_sample": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:5357\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originat",
"payload_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:5357\r\nUser-Agent: curl\/8.7.1\r\nA",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "957c04e7434822070472f6589f5300ee45bf11a3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 5357,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:5357\r\nUser-Agent: curl\/8.7.1\r\nA",
"attack_vector": "port scan syn \u00b7 via HTTP:5357 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"target_port_label": "5357 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0043 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 75
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5357,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 5357,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5357 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"evidence_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:5357\r\nUser-Agent: curl\/8.7.1\r\nA",
"target_port_label": "5357 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5357"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_wp_json",
"http_ua_suspicious",
"http_wp_scan",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
5357 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:5357 · (reconnaissance)
|
Élevée
|
Élevé · 80
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Protocole
GET / UA curl/8.7.1
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950734:sap-sapcontrol-path
951041:dns-rebind
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
5357
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 80
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
sap-sapcontrol-path
dns-rebind
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:5357
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-US,en;q=0
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:5357 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Client-IP: 127.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "e42510f4f5c75f2667a51c32bc000c1378cd772e",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 364,
"payload_entropy": 5.120576187571252,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 5357,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 7,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 80,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "9b755f3719b2dc545c15668c01e17e543acd7353",
"event_fingerprint": "f046ead9096209fb5913552179543a8864482295",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "7d896574d2269c5553912c321bdb1233",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 5357,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5357\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"method": "GET",
"path": "\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"sap-sapcontrol-path",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5357\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.0",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5357\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"sap-sapcontrol-path",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5357\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.0",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5357\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a9f0be1e01a45bb7bf7008283273a83eaec6faee",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 5357,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5357\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"attack_vector": "port scan syn \u00b7 via HTTP:5357 \u00b7 (reconnaissance)",
"target_port_label": "5357 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 80
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 5357,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 5357,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:5357 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:5357\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"target_port_label": "5357 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "5357"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8879 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8879 · (reconnaissance) · → /wp-json/gravitysmtp/v1/tests/mock-data
|
Élevée
|
Élevé · 73
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0043
TA0043
Protocole
GET /wp-json/gravitysmtp/v1/tests/mock-data UA curl/8.7.1
Émulateur
HTTP
WAF
40
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950402:ssrf-2
950468:nosqli-3
Cible HTTP
GET
/wp-json/gravitysmtp/v1/tests/mock-data
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8879
Chemin / cible
/wp-json/gravitysmtp/v1/tests/mock-data
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Élevé
· 73
Confiance : Confiance 50 % — 7 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Technique MITRE
TA0043
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
lfi-14
rce-0
ssrf-2
nosqli-3
cms-3
dns-rebind
scanner-ua
Payload (extrait)
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1
Host: 62.3.50.33:8879
User-Agent: curl/8.7.1
A
Requête brute (extrait)
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1 Host: 62.3.50.33:8879 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originat
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 1,
"http_path_depth": 5,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "8768ef01ac68dbdc8fc9e5a2c654baed13fa565b",
"http_target_hash": "0e39cf789b77e87610b2bcc4ef3f5049d93e9b1d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 428,
"payload_entropy": 5.256070161711961,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 8879,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 73,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "a5004fac7abb1cf102393caf26663c1cf6e475e3",
"event_fingerprint": "bc7fb61c615c93c34fe1550c21df298f16332f7f",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 73
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "5d652b213fa950ff048247ae8696ac7e",
"path_pattern_hash": "9e982a0040e4931e276697495003d69e"
},
"target_context": {
"dst_port": 8879,
"service": "http",
"service_name": "http",
"risk_score": 73
},
"payload_preview": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nUser-Agent: curl\/8.7.1\r\nA",
"method": "GET",
"path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"query_string": "page=gravitysmtp-settings",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"request_sample": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originat",
"payload_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nUser-Agent: curl\/8.7.1\r\nA",
"evidence": {
"method": "GET",
"path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"query_string": "page=gravitysmtp-settings",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"request_sample": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originat",
"payload_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nUser-Agent: curl\/8.7.1\r\nA",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre": "TA0043",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "25e33e95b677abfea7f73a71ba1a0376f4a67141",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8879,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nUser-Agent: curl\/8.7.1\r\nA",
"attack_vector": "port scan syn \u00b7 via HTTP:8879 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"target_port_label": "8879 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 73\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0043 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 73
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 73,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8879,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0043",
"mitre_technique": "TA0043",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8879,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8879 \u00b7 (reconnaissance) \u00b7 \u2192 \/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"evidence_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nUser-Agent: curl\/8.7.1\r\nA",
"target_port_label": "8879 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8879"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_wp_json",
"http_ua_suspicious",
"http_wp_scan",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
8879 · HTTP
|
http
|
Scan de ports
port scan syn · via HTTP:8879 · (reconnaissance)
|
Élevée
|
Élevé · 78
|
|
Étape
Reconnaissance
Chaîne
Reconnaissance
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Protocole
GET / UA curl/8.7.1
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950734:sap-sapcontrol-path
951041:dns-rebind
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8879
Chemin / cible
/
Pourquoi cette classification : Type « port_scan_syn » (signaux protocolaires) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 78
Confiance : Confiance 100 % — 5 tag(s) WAF
Signaux
MITRE-T1046
SIGMA-net-port-scan
Beh Multi Port 60S
Tactiques MITRE
TA0043
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
sap-sapcontrol-path
dns-rebind
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8879
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-US,en;q=0
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8879 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Client-IP: 127.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "8768ef01ac68dbdc8fc9e5a2c654baed13fa565b",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 364,
"payload_entropy": 5.123996826301572,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 8879,
"risk_waf": 100,
"risk_classification": 64,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 78,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "4981ea1635702a20be72625a4933a6210b0c447a",
"event_fingerprint": "b1790210295aeff26b00e4cc0d2ff5320a59c7b3",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 231,
"precision_signals": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"kb_rule_ids": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 78
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "7ad137287915493b0de68ea7f2475a94",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8879,
"service": "http",
"service_name": "http",
"risk_score": 78
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"method": "GET",
"path": "\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"sap-sapcontrol-path",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.0",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"sap-sapcontrol-path",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.0",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%"
},
"attack_stage": "recon",
"mitre_tactics": [
"TA0043"
],
"mitre_techniques": [
"T1046"
],
"mitre": "T1046",
"threat_family": [
"scanner"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "b5e8b97ad12ba867e22f16812b1127397e1397d4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8879,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"attack_vector": "port scan syn \u00b7 via HTTP:8879 \u00b7 (reconnaissance)",
"target_port_label": "8879 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"classification_reason_label_fr": "Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 78\/100 (\u00c9lev\u00e9) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 64,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 78
},
"attack_stage": "recon",
"attack_stage_label": "Reconnaissance",
"attack_chain_stage": "reconnaissance",
"attack_chain_stage_label_fr": "Reconnaissance",
"risk_score": 78,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8879,
"protocol_emulated": null,
"tags_summary": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"INT-beh-multi-port-60s"
],
"tags_summary_labels_fr": [
"MITRE-T1046",
"SIGMA-net-port-scan",
"Beh Multi Port 60S"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1046",
"mitre_technique": "T1046",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 8879,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "port scan syn \u00b7 via HTTP:8879 \u00b7 (reconnaissance)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8879\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"target_port_label": "8879 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": true,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "reconnaissance",
"label_fr": "Reconnaissance",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8879"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "reconnaissance",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
11300 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:11300 · (tentative d'exploit) · → /wp-json/gravitysmtp/v1/tests/mock-data
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /wp-json/gravitysmtp/v1/tests/mock-data UA curl/8.7.1
Émulateur
HTTP
WAF
40
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950402:ssrf-2
950468:nosqli-3
Cible HTTP
GET
/wp-json/gravitysmtp/v1/tests/mock-data
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
11300
Chemin / cible
/wp-json/gravitysmtp/v1/tests/mock-data
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Élevé
· 77
Confiance : Confiance 50 % — 7 tag(s) WAF
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
lfi-14
rce-0
ssrf-2
nosqli-3
cms-3
dns-rebind
scanner-ua
Payload (extrait)
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1
Host: 62.3.50.33:11300
User-Agent: curl/8.7.1
Requête brute (extrait)
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1 Host: 62.3.50.33:11300 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Origina
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 1,
"http_path_depth": 5,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "01451af38469460a53dc2ed2efeee2cc613c8f6e",
"http_target_hash": "0e39cf789b77e87610b2bcc4ef3f5049d93e9b1d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 429,
"payload_entropy": 5.23199901879077,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 11300,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 77,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "1472f088e29a8f345cec3f523b2545151aef7d2c",
"event_fingerprint": "3d5a800f230d3574d17bd7182b70025943e55ed9",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 77
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "d18b2a462a1132385a137b23d6f875e6",
"path_pattern_hash": "9e982a0040e4931e276697495003d69e"
},
"target_context": {
"dst_port": 11300,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: curl\/8.7.1\r\n",
"method": "GET",
"path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"query_string": "page=gravitysmtp-settings",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"request_sample": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Origina",
"payload_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: curl\/8.7.1",
"evidence": {
"method": "GET",
"path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"query_string": "page=gravitysmtp-settings",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"request_sample": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Origina",
"payload_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: curl\/8.7.1",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "fad986cef563209dd4292209819cb4602f5013e3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 11300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: curl\/8.7.1",
"attack_vector": "lfi path traversal \u00b7 via HTTP:11300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"target_port_label": "11300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 11300,
"protocol_emulated": null,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 11300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:11300 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"evidence_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: curl\/8.7.1",
"target_port_label": "11300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "11300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_wp_json",
"http_ua_suspicious",
"http_wp_scan",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
11300 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:11300 · (tentative d'exploit)
|
Élevée
|
Élevé · 77
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA curl/8.7.1
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950734:sap-sapcontrol-path
951041:dns-rebind
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
11300
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 77
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
sap-sapcontrol-path
dns-rebind
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:11300
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-US,en;q=
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:11300 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Client-IP: 127.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "01451af38469460a53dc2ed2efeee2cc613c8f6e",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 365,
"payload_entropy": 5.095779077818559,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 11300,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 5.6,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 77,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "b655d22d53d869b0076112b12ffa5aa71828137f",
"event_fingerprint": "caff36fa5992ee216103565cbf99f423f84db622",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 77
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "6a91a5a899d19d8d1704cf9b12ffb2a0",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 11300,
"service": "http",
"service_name": "http",
"risk_score": 77
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=",
"method": "GET",
"path": "\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"sap-sapcontrol-path",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"sap-sapcontrol-path",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2a85ada7673027e496ac2b1b5c12453051223ee0",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 11300,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=",
"attack_vector": "ssrf internal \u00b7 via HTTP:11300 \u00b7 (tentative d'exploit)",
"target_port_label": "11300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 77\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 77
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 77,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 11300,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 11300,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:11300 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:11300\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=",
"target_port_label": "11300 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "11300"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2051 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:2051 · (tentative d'exploit) · → /wp-json/gravitysmtp/v1/tests/mock-data
|
Élevée
|
Élevé · 75
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /wp-json/gravitysmtp/v1/tests/mock-data UA curl/8.7.1
Émulateur
HTTP
WAF
40
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950402:ssrf-2
950468:nosqli-3
Cible HTTP
GET
/wp-json/gravitysmtp/v1/tests/mock-data
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2051
Chemin / cible
/wp-json/gravitysmtp/v1/tests/mock-data
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Élevé
· 75
Confiance : Confiance 50 % — 7 tag(s) WAF
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
lfi-14
rce-0
ssrf-2
nosqli-3
cms-3
dns-rebind
scanner-ua
Payload (extrait)
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1
Host: 62.3.50.33:2051
User-Agent: curl/8.7.1
A
Requête brute (extrait)
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1 Host: 62.3.50.33:2051 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originat
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 1,
"http_path_depth": 5,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "ea2461d2a1df1f7ccdcf0873bc1d867a49a286e5",
"http_target_hash": "0e39cf789b77e87610b2bcc4ef3f5049d93e9b1d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 428,
"payload_entropy": 5.2397625779322095,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 2051,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 75,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "53c52ad4fc40224112f726483c8ed85476db6d75",
"event_fingerprint": "241e9c35433cd44f0593a38c58725ef9117730d5",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 75
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "c2bc99442086ea1af5c27bd58ccfa584",
"path_pattern_hash": "9e982a0040e4931e276697495003d69e"
},
"target_context": {
"dst_port": 2051,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:2051\r\nUser-Agent: curl\/8.7.1\r\nA",
"method": "GET",
"path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"query_string": "page=gravitysmtp-settings",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"request_sample": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:2051\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originat",
"payload_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:2051\r\nUser-Agent: curl\/8.7.1\r\nA",
"evidence": {
"method": "GET",
"path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"query_string": "page=gravitysmtp-settings",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"request_sample": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:2051\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originat",
"payload_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:2051\r\nUser-Agent: curl\/8.7.1\r\nA",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2ae35f1c3e5ad4da751f3540c90bd6c9129bca75",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2051,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:2051\r\nUser-Agent: curl\/8.7.1\r\nA",
"attack_vector": "lfi path traversal \u00b7 via HTTP:2051 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"target_port_label": "2051 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 75
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2051,
"protocol_emulated": null,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2051,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:2051 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"evidence_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:2051\r\nUser-Agent: curl\/8.7.1\r\nA",
"target_port_label": "2051 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2051"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_wp_json",
"http_ua_suspicious",
"http_wp_scan",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
2051 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:2051 · (tentative d'exploit)
|
Élevée
|
Élevé · 75
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA curl/8.7.1
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950734:sap-sapcontrol-path
951041:dns-rebind
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
2051
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 75
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
sap-sapcontrol-path
dns-rebind
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:2051
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-US,en;q=0
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:2051 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Client-IP: 127.0
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "ea2461d2a1df1f7ccdcf0873bc1d867a49a286e5",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 364,
"payload_entropy": 5.105002193856215,
"port_category": "registered",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 2051,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 3.8,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 75,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "acf5ff8e31293200d2201d701a8c235ffea45bbf",
"event_fingerprint": "014f9809ca4e8fd4d8003ced965587395cc84164",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 75
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "cfc0580766c97363c984484d2a479dba",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 2051,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2051\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"method": "GET",
"path": "\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"sap-sapcontrol-path",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2051\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.0",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2051\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"sap-sapcontrol-path",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2051\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.0",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2051\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "80c9aa4e7e03417c22ea3aec01116dba555d6edc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2051,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2051\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"attack_vector": "ssrf internal \u00b7 via HTTP:2051 \u00b7 (tentative d'exploit)",
"target_port_label": "2051 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 75
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 2051,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 2051,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:2051 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:2051\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0",
"target_port_label": "2051 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "2051"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:876 · (tentative d'exploit) · → /wp-json/gravitysmtp/v1/tests/mock-data
|
Élevée
|
Élevé · 75
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /wp-json/gravitysmtp/v1/tests/mock-data UA curl/8.7.1
Émulateur
HTTP
WAF
40
Recommandation
Investiguer
Tags
950316:lfi-14
950326:rce-0
950402:ssrf-2
950468:nosqli-3
Cible HTTP
GET
/wp-json/gravitysmtp/v1/tests/mock-data
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/wp-json/gravitysmtp/v1/tests/mock-data
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Élevé
· 75
Confiance : Confiance 50 % — 7 tag(s) WAF
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
lfi-14
rce-0
ssrf-2
nosqli-3
cms-3
dns-rebind
scanner-ua
Payload (extrait)
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Ac
Requête brute (extrait)
GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originati
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 1,
"http_path_depth": 5,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "0e39cf789b77e87610b2bcc4ef3f5049d93e9b1d",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 427,
"payload_entropy": 5.250984640264972,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 75,
"tag_count": 20,
"anomaly_count": 1,
"campaign_key": "088d0f5cfacc57314af533acac2d1ae5e76aea5f",
"event_fingerprint": "23cf2308ce94ad30bc34d9b7ac9236bad2787d2b",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"confidence": 0.5,
"classification_confidence": 0.5,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 75
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 50,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "0203310874ed32b5e8d422c8e8ed8f51",
"path_pattern_hash": "9e982a0040e4931e276697495003d69e"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 75
},
"payload_preview": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAc",
"method": "GET",
"path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"query_string": "page=gravitysmtp-settings",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"request_sample": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originati",
"payload_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAc",
"evidence": {
"method": "GET",
"path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"query_string": "page=gravitysmtp-settings",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"ssrf-2",
"nosqli-3",
"cms-3",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"request_sample": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originati",
"payload_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAc",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d5aca47f472f764ae9aeea9e3433c6979ddea8f3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAc",
"attack_vector": "lfi path traversal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 50%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 75\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
"confidence_pct": 50,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 75
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 75,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"request_line": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wp-json\/gravitysmtp\/v1\/tests\/mock-data",
"evidence_snippet": "GET \/wp-json\/gravitysmtp\/v1\/tests\/mock-data?page=gravitysmtp-settings HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAc",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 50 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950326:rce-0",
"950402:ssrf-2",
"950468:nosqli-3",
"950505:cms-3",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_probe_wp_json",
"http_ua_suspicious",
"http_wp_scan",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|
|
|
TCP |
876 · HTTP
|
http
|
SSRF interne
ssrf internal · via HTTP:876 · (tentative d'exploit)
|
Élevée
|
Élevé · 76
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA curl/8.7.1
Émulateur
HTTP
WAF
26
Recommandation
Investiguer
Tags
950326:rce-0
950402:ssrf-2
950734:sap-sapcontrol-path
951041:dns-rebind
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
876
Chemin / cible
/
Pourquoi cette classification : Type « ssrf_internal » (signaux protocolaires) · confiance 54%
Confiance classification
54%
Risque capteur
Élevé
· 76
Confiance : Confiance 54 % — Motif catalogue confirmé · 5 tag(s) WAF
Signaux
CRS-920350
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
SSRF Localhost SSRF
Ligne de requête
GET / HTTP/1.1
User-Agent
curl/8.7.1
Règles WAF
rce-0
ssrf-2
sap-sapcontrol-path
dns-rebind
scanner-ua
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:876
User-Agent: curl/8.7.1
Accept: */*
Accept-Encoding: gzip
Accept-Language: en-US,en;q=0.
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:876 User-Agent: curl/8.7.1 Accept: */* Accept-Encoding: gzip Accept-Language: en-US,en;q=0.9 X-Forwarded-For: 127.0.0.1 X-Real-IP: 127.0.0.1 X-Originating-IP: 127.0.0.1 X-Client-IP: 127.0.0.1 True-Client-IP: 127.0.
Meta JSON brut
{
"http_header_count": 14,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": "19d98cb8097a82cf332d2745e2b79cadcebba03e",
"http_host_hash": "a650509d85b9371dcc0f254b0efdeb32f75db486",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": true,
"http_ua_is_browser": false,
"bytes_in": 363,
"payload_entropy": 5.1182953888045954,
"port_category": "well_known",
"org": "Amazon.com, Inc.",
"service": "http",
"app_proto": "http",
"asn": 16509,
"country": "FR",
"dst_port": 876,
"risk_waf": 100,
"risk_classification": 80,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 30,
"risk_boost": 12,
"risk_granularity": 4.3,
"risk_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30
},
"risk_score": 76,
"tag_count": 16,
"anomaly_count": 1,
"campaign_key": "f505dc082540b1b9e7eb41c0e2a24c58bdb6ace1",
"event_fingerprint": "5e2d4c99284f1822453ac47bab9177c66e9654bf",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"confidence": 0.54,
"classification_confidence": 0.54,
"precision_score": 64,
"precision_signals": [
"CRS-920350"
],
"kb_rule_ids": [
"CRS-920350"
],
"matched_patterns": [
"pat-0340"
],
"matched_pattern_names": [
"SSRF Localhost SSRF"
],
"pattern_ids": [
"pat-0340"
],
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"named_classification_skipped": false,
"classification_parent": "ssrf_attack",
"service_name": "http",
"risk_confidence_factor": 54,
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "FR",
"asn": 16509,
"org": "Amazon.com, Inc.",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "8f42af6f304383bbe22bc11b9f1c9ce7",
"payload_hash": "5c40a267fe68a37f67b79252d294aa61",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 876,
"service": "http",
"service_name": "http",
"risk_score": 76
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.",
"method": "GET",
"path": "\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"sap-sapcontrol-path",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.0.",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.",
"evidence": {
"method": "GET",
"path": "\/",
"user_agent": "curl\/8.7.1",
"waf_tags": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"scanner-ua"
],
"waf_rule_names": [
"rce-0",
"ssrf-2",
"sap-sapcontrol-path",
"dns-rebind",
"scanner-ua"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.0.",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.",
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a4ccd4fd15e7cf81c1c12586aee4327d6d476cc7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.",
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit)",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"classification_reason_label_fr": "Type \u00ab ssrf_internal \u00bb (signaux protocolaires) \u00b7 confiance 54%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 76\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 54 % \u2014 via HTTP",
"confidence_pct": 54,
"confidence_breakdown": {
"waf": 100,
"classification": 80,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 30,
"risk_score": 76
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 76,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 876,
"protocol_emulated": null,
"tags_summary": [
"CRS-920350"
],
"tags_summary_labels_fr": [
"CRS-920350"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"http_user_agent": "curl\/8.7.1",
"port": 876,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "ssrf internal \u00b7 via HTTP:876 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:876\r\nUser-Agent: curl\/8.7.1\r\nAccept: *\/*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.",
"target_port_label": "876 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 54 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 54 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "876"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950402:ssrf-2",
"950734:sap-sapcontrol-path",
"951041:dns-rebind",
"anomaly:scanner-ua",
"http_cache_poison_header",
"http_cache_poison_host",
"http_dns_rebinding",
"http_header_x-client-ip",
"http_header_x-forwarded-for",
"http_header_x-host",
"http_header_x-real-ip",
"http_host_header_injection",
"http_ua_suspicious",
"http_xff_loopback",
"scanner-ua"
],
"asn_dc_heuristic": true
}
|