|
|
TCP |
14000 · HTTP
|
http
|
SSRF
ssrf attack · via HTTP:14000 · (tentative d'exploit) · → /favicon.ico
|
Élevée
|
Moyen · 59
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET /favicon.ico UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
19
Recommandation
Investiguer
Tags
950326:rce-0
950406:ssrf-3
950470:nosqli-3
Cible HTTP
GET
/favicon.ico
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
14000
Chemin / cible
/favicon.ico
Pourquoi cette classification : Règle WAF « ssrf-3 » · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 59
Confiance : Confiance 50 % — 3 tag(s) WAF
Signaux
Upstream
Waf Score
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET /favicon.ico HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Règles WAF
rce-0
ssrf-3
nosqli-3
Payload (extrait)
GET /favicon.ico HTTP/1.1
Host: 62.3.50.33
Connection: keep-alive
sec-ch-ua: "Google Chrome";v="153", "Not-A.Brand";v="8", "C
Requête brute (extrait)
GET /favicon.ico HTTP/1.1 Host: 62.3.50.33 Connection: keep-alive sec-ch-ua: "Google Chrome";v="153", "Not-A.Brand";v="8", "Chromium";v="153" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Linux" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (X11;
Meta JSON brut
{"http_header_count":16,"http_query_params":0,"http_path_depth":1,"http_path_ext":"ico","http_ua_hash":"67f382af9edcaa19996b2e6abc08acd4900d82cd","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"a40fba6620dee3abd15532f18848dacb6bb80f01","http_referer_hash":"cf80a204aa7ba177028259b891bdc97b919262f5","http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":656,"payload_entropy":5.501751902179843,"port_category":"registered","org":"DigitalOcean, LLC","service":"http","app_proto":"http","asn":14061,"country":"NL","dst_port":14000,"risk_waf":84,"risk_classification":84,"risk_behavior":0,"risk_geo":40,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.1,"risk_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":40,"protocol":25,"novelty":15},"risk_score":59,"tag_count":3,"anomaly_count":0,"campaign_key":"253b492412fa3e842bd3b9b1fe2191b4859d8701","event_fingerprint":"e56b74b5a95114d1a53d8dc18c3692d2423612f5","classification_reason":"R\u00e8gle WAF \u00ab ssrf-3 \u00bb \u00b7 confiance 50%","confidence":0.5,"classification_confidence":0.5,"precision_score":55,"precision_signals":["INT-upstream","INT-waf-score"],"kb_rule_ids":["INT-upstream","INT-waf-score"],"confidence_breakdown":{"waf":84,"classification":84,"behavior":0,"geo":40,"protocol":25,"novelty":15,"risk_score":59},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":50,"city":null,"is_datacenter":true,"is_tor_hi…
|
|
|
TCP |
14000 · HTTP
|
http
|
Tentative d'exploit
exploit attempt · via HTTP:14000 · (tentative d'exploit)
|
Élevée
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0001
TA0001
TA0002
Protocole
GET / UA Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like…
Émulateur
HTTP
WAF
16
Recommandation
Investiguer
Tags
950326:rce-0
950470:nosqli-3
950734:sap-sapcontrol-path
Cible HTTP
GET
/
TLS SNI
—
Capteur
paris-1
|
Méthode
GET
Port
14000
Chemin / cible
/
Pourquoi cette classification : Tentative d'exploit (tag rce-0) · confiance 62%
Confiance classification
62%
Risque capteur
Moyen
· 52
Confiance : Confiance 62 % — 3 tag(s) WAF
Signaux
MITRE-T1190
Technique MITRE
TA0001
Tactiques MITRE
TA0001
TA0002
Ligne de requête
GET / HTTP/1.1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
Règles WAF
rce-0
nosqli-3
sap-sapcontrol-path
Payload (extrait)
GET / HTTP/1.1
Host: 62.3.50.33
Connection: keep-alive
sec-ch-ua: "Google Chrome";v="153", "Not-A.Brand";v="8", "Chromium";v=
Requête brute (extrait)
GET / HTTP/1.1 Host: 62.3.50.33 Connection: keep-alive sec-ch-ua: "Google Chrome";v="153", "Not-A.Brand";v="8", "Chromium";v="153" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Linux" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (X11; Linux x86_
Meta JSON brut
{"http_header_count":15,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":"67f382af9edcaa19996b2e6abc08acd4900d82cd","http_host_hash":"0991dad1e85d945fa26d249d6238901b89cb8349","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"GET","http_ua_is_cli":false,"http_ua_is_browser":true,"bytes_in":610,"payload_entropy":5.4978330728957,"port_category":"registered","org":"DigitalOcean, LLC","service":"http","app_proto":"http","asn":14061,"country":"NL","dst_port":14000,"risk_waf":72,"risk_classification":72,"risk_behavior":0,"risk_geo":40,"risk_protocol":25,"risk_novelty":15,"risk_boost":0,"risk_granularity":4.1,"risk_breakdown":{"waf":72,"classification":72,"behavior":0,"geo":40,"protocol":25,"novelty":15},"risk_score":52,"tag_count":3,"anomaly_count":0,"campaign_key":"23f264e6b288a396001fa6bb0240b7ab27877f8a","event_fingerprint":"8d2176c8d3c95ed6bfb930c2fc0d7d27e41fc5bb","classification_reason":"Tentative d'exploit (tag rce-0) \u00b7 confiance 62%","confidence":0.62,"classification_confidence":0.62,"precision_score":73,"precision_signals":["MITRE-T1190"],"kb_rule_ids":["MITRE-T1190"],"confidence_breakdown":{"waf":72,"classification":72,"behavior":0,"geo":40,"protocol":25,"novelty":15,"risk_score":52},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":62,"city":null,"is_datacenter":true,"is_tor_hint":false,"geo":{"country":"NL","asn":14061,"org":"DigitalOcean, LLC","is_dat…
|