Méthode
GET
Port
9999
Chemin / cible
/.git/config
Confiance classification
100%
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) snap Chromium/75.0.3770.142 Chrome/75.0.3770.142 Safari/537.36
Règles WAF
950326:rce-0
950468:nosqli-3
950470:nosqli-3
950513:leak-0
Payload (extrait)
GET /.git/config HTTP/1.1
Host: 62.3.50.33:9999
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Ge
Meta JSON brut
{
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "git\/config",
"http_ua_hash": "cc917cf6074a981fb70c378babfd8df895e5c3b7",
"http_host_hash": "83a22baaf629d53e39c79d30e6b18dca9da1a92c",
"http_target_hash": "e2f253eab0d0cf5422d24d22ae2a4954398768df",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": true,
"bytes_in": 264,
"payload_entropy": 5.443767615413623,
"port_category": "registered",
"org": "Google LLC",
"service": "http",
"app_proto": "http",
"asn": 396982,
"country": "ID",
"dst_port": 9999,
"risk_waf": 100,
"risk_classification": 100,
"risk_behavior": 0,
"risk_geo": 40,
"risk_protocol": 35,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.2,
"risk_breakdown": {
"waf": 100,
"classification": 100,
"behavior": 0,
"geo": 40,
"protocol": 35,
"novelty": 25
},
"risk_score": 69,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "130ec4fe5352aeb697a27315e4481cd2073b4dfd",
"event_fingerprint": "64426a1f19604f511bedbcc7450698bb229cc083",
"city": null,
"is_datacenter": true,
"is_tor_hint": false,
"geo": {
"country": "ID",
"asn": 396982,
"org": "Google LLC",
"is_datacenter": true,
"is_tor_hint": false
},
"fingerprint": {
"http_ua_hash": "95ddbe0b148dd48d21844dff1d496cdc",
"payload_hash": "7e8be281be605c163a8f23ece4fdd13b",
"path_pattern_hash": "3ec26e4f0817b37785cd5e68fed88892"
},
"target_context": {
"dst_port": 9999,
"service": "http"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"threat_family": [
"unknown"
],
"confidence": 1,
"classification_confidence": 1,
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"payload_preview": "GET \/.git\/config HTTP\/1.1\r\nHost: 62.3.50.33:9999\r\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Ge",
"event_signature": "944019a229bdd1a6f3a6eb4cda9b661d3823dce9",
"ban_policy": "advisory_investigate",
"tags_list": [
"950326:rce-0",
"950468:nosqli-3",
"950470:nosqli-3",
"950513:leak-0",
"http_git_exposure",
"http_probe_git",
"http_sensitive_path"
],
"asn_dc_heuristic": true
}
|