|
|
TCP |
8001 · HTTP ALT 8001
|
http-alt-8001
|
Sonde HTTP 8001
http-alt-8001 · via HTTP ALT 8001:8001 · (sonde / probe)
|
Élevée
|
Faible · 24
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0007
Découverte
Accès
Protocole
Émulateur
HTTP-ALT-8001
WAF
—
Recommandation
Surveiller
Tags
tls_clienthello
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
8001
Chemin / cible
—
Service
HTTP ALT 8001
Payload
��E��$���^tj�¬��� 煮Qj]�$)Z ���ɚȯG3�|[��#����\��W;~ ^�b >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 �
Pourquoi cette classification : Type « Sonde HTTP 8001 » (signaux protocolaires) · confiance 0%
Confiance classification
8%
Corrélation +8
Risque capteur
Faible
· 24
Confiance : Confiance 0 % — 1 signal(aux) capteur
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
��E��$���^tj�¬��� 煮Qj]�$)Z ���ɚȯG3�|[��#����\��W;~ ^�b >�,�0 �̨̩̪�+�/ ��$�( k�#�' g�
� 9� � 3 �
Requête brute (extrait)
��E��$���^tj�¬��� 煮Qj]�$)Z ���ɚȯG3�|[��#����\��W;~ ^�b >�,�0 �̨̩̪�+�/ ��$�( k�#�' g� � 9� � 3 � � = < 5 / � u # * ( + - 3 &
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"bytes_in":517,"payload_entropy":3.9912068535555636,"port_category":"registered","org":"MEVSPACE sp. z o.o.","service":"http-alt-8001","app_proto":"http-alt-8001","asn":201814,"country":"PL","dst_port":8001,"risk_waf":8,"risk_classification":24,"risk_behavior":0,"risk_geo":0,"risk_protocol":30,"risk_novelty":0,"risk_boost":0,"risk_granularity":0.8,"risk_breakdown":{"waf":8,"classification":24,"behavior":0,"geo":0,"protocol":30,"novelty":0},"risk_score":24,"tag_count":1,"anomaly_count":0,"campaign_key":"1dbdb69a52e7776d53f028e7f558920346c692dd","event_fingerprint":"049aef23df13456d89de208b1ad1953cb38ace86","classification_reason":"Type \u00ab http-alt-8001 \u00bb (signaux protocolaires) \u00b7 confiance 0%","confidence":0.08,"classification_confidence":0.08,"precision_score":0,"precision_signals":[],"kb_rule_ids":[],"confidence_breakdown":{"waf":8,"classification":24,"behavior":0,"geo":0,"protocol":30,"novelty":0,"risk_score":24,"correlation_boost":8},"named_classification_skipped":false,"service_name":"http-alt-8001","risk_confidence_factor":0,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"PL","asn":201814,"org":"MEVSPACE sp. z o.o.","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"359fc2b23…
|
|
|
TCP |
8001 · HTTP
|
http
|
Traversal LFI
lfi path traversal · via HTTP:8001 · (tentative d'exploit) · → /socket.io/
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
Accès
Exécution
Protocole
GET /socket.io/ UA ucp-sweep/1.0
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950316:lfi-14
950325:rce-0
950468:nosqli-3
net_web_probe
Cible HTTP
GET
/socket.io/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
8001
Chemin / cible
/socket.io/
Pourquoi cette classification : Type « Traversal LFI » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 52
Confiance : Confiance 59 % — 3 tag(s) WAF
Protocole émulé
1
Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
Accès initial
Exécution
Ligne de requête
GET /socket.io/?EIO=4&transport=polling HTTP/1.1
User-Agent
ucp-sweep/1.0
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /socket.io/?EIO=4&transport=polling HTTP/1.1
Host: 62.3.50.33:8001
User-Agent: ucp-sweep/1.0
Accept: */*
Accept-Encoding
Requête brute (extrait)
GET /socket.io/?EIO=4&transport=polling HTTP/1.1 Host: 62.3.50.33:8001 User-Agent: ucp-sweep/1.0 Accept: */* Accept-Encoding: identity Connection: close
Meta JSON brut
{"protocol_emulated":true,"emulator_response":"485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b","emulator_response_len":82,"http_header_count":5,"http_query_params":2,"http_path_depth":1,"http_path_ext":"io","http_ua_hash":"23a91b0cefe8a5db01f7da784eae2a8964abac09","http_host_hash":"29d114ae8a3567c5f1863f5bd79c5d398a432fe8","http_target_hash":"ba365d9e41f33be82a6dad98f49d28428b893380","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":161,"payload_entropy":5.081360320268164,"port_category":"registered","org":"MEVSPACE sp. z o.o.","service":"http","app_proto":"http","asn":201814,"country":"PL","dst_port":8001,"risk_waf":92,"risk_classification":78,"risk_behavior":0,"risk_geo":0,"risk_protocol":33,"risk_novelty":15,"risk_boost":0,"risk_granularity":1.9,"risk_breakdown":{"waf":92,"classification":78,"behavior":0,"geo":0,"protocol":33,"novelty":15},"risk_score":52,"tag_count":4,"anomaly_count":0,"campaign_key":"fc8617782b22132f23889221bfe77271f46942f1","event_fingerprint":"83bf2c8d826fdcb0ce2ce3d4399c3b5c64239fb1","classification_reason":"Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%","confidence":0.59,"classification_confidence":0.59,"precision_score":70,"precision_signals":["CRS-930100-sub"],"kb_rule_ids":["CRS-930100-sub"],"confidence_breakdown":{"waf":92,"classification"…
|