|
|
TCP |
4028 · HTTP
|
http
|
Sonde HTTP smuggling
http smuggling probe · via HTTP:4028 · (tentative d'exploit)
|
Faible
|
Moyen · 52
|
|
Étape
Tentative d'exploit
Chaîne
Exploitation
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
Corrélations
Multi-protocole corrélé (5 min)
MITRE
TA0001
Accès
Exécution
Protocole
POST /
Émulateur
HTTP
WAF
3
Recommandation
Investiguer
Tags
950734:sap-sapcontrol-path
http_no_ua
Cible HTTP
POST
/
TLS SNI
—
Capteur
paris-1
|
Méthode
POST
Port
4028
Chemin / cible
/
Pourquoi cette classification : Tags WAF: sap-sapcontrol-path · confiance 95%
Confiance classification
100%
Corrélation +8
Risque capteur
Moyen
· 52
Confiance : Confiance 95 % — Motif catalogue confirmé · 1 tag(s) WAF
Signaux
pat-0842
Technique MITRE
TA0001
Tactiques MITRE
Accès initial
Exécution
Motifs de détection (base)
CRS 921130 duplicate CL
Ligne de requête
POST / HTTP/1.1
User-Agent
—
Règles WAF
sap-sapcontrol-path
Payload (extrait)
POST / HTTP/1.1
Host: probe
Content-Type: application/json
Content-Length: 22
Connection: close
{"command": "version"}
Meta JSON brut
{"http_header_count":4,"http_query_params":0,"http_path_depth":0,"http_path_ext":null,"http_ua_hash":null,"http_host_hash":"a949c530710f9fca76b45776267c68967fa891e7","http_target_hash":"42099b4af021e53fd8fd4e056c2568d7c2e3ffa8","http_referer_hash":null,"http_method":"POST","http_ua_is_cli":false,"http_ua_is_browser":false,"bytes_in":125,"payload_entropy":4.808835202600902,"port_category":"registered","org":"Jsc timeweb","service":"http","app_proto":"http","asn":9123,"country":"RU","dst_port":4028,"risk_waf":20,"risk_classification":85,"risk_behavior":0,"risk_geo":0,"risk_protocol":35,"risk_novelty":15,"risk_boost":0,"risk_granularity":5.3,"risk_breakdown":{"waf":20,"classification":85,"behavior":0,"geo":0,"protocol":35,"novelty":15},"risk_score":52,"tag_count":2,"anomaly_count":0,"campaign_key":"c090e1d0e01ea7e85bfbb159ddeda6c6f1cd8a97","event_fingerprint":"a78fc3807cef01c2f4411523a04edff8cf77cead","classification_reason":"Tags WAF: sap-sapcontrol-path \u00b7 confiance 95%","confidence":1,"classification_confidence":1,"precision_score":84,"precision_signals":["pat-0842"],"kb_rule_ids":["pat-0842"],"matched_patterns":["pat-0842"],"matched_pattern_names":["CRS 921130 duplicate CL"],"pattern_ids":["pat-0842"],"confidence_breakdown":{"waf":20,"classification":85,"behavior":0,"geo":0,"protocol":35,"novelty":15,"risk_score":52,"correlation_boost":8},"named_classification_skipped":false,"service_name":"http","risk_confidence_factor":95,"city":null,"is_datacenter":false,"is_tor_hint"…
|
|
|
TCP |
4028
|
—
|
Sonde port 4028
Sonde port · port 4028 · (sonde / probe)
|
Faible
|
Moyen · 44
|
|
Étape
Sonde / probe
Chaîne
Découverte
Persona
mail.sensor-1.internal
Rôle capteur
Renseignement menaces
MITRE
TA0007
Découverte
Accès
Protocole
WAF
—
Recommandation
Surveiller
Tags
—
Cible HTTP
—
TLS SNI
—
Capteur
paris-1
|
Méthode
—
Port
4028
Chemin / cible
—
Payload
{"command": "version"}
Pourquoi cette classification : Type « Sonde port » (signaux protocolaires) · confiance 50%
Confiance classification
50%
Confiance modérée — signal unique
Risque capteur
Moyen
· 44
Confiance : Confiance modérée (50 %) — signal principal unique
Signaux
Fp Port Probe Noise
Single Port
Technique MITRE
TA0007
Tactiques MITRE
Découverte
Accès initial
User-Agent
—
Règles WAF
—
Payload (extrait)
{"command": "version"}
Meta JSON brut
{"bytes_in":24,"payload_entropy":4.001629167387823,"port_category":"registered","org":"Jsc timeweb","service":null,"app_proto":null,"asn":9123,"country":"RU","dst_port":4028,"risk_waf":8,"risk_classification":48,"risk_behavior":0,"risk_geo":0,"risk_protocol":0,"risk_novelty":0,"risk_boost":0,"risk_granularity":4.6,"risk_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0},"risk_score":44,"tag_count":0,"anomaly_count":0,"campaign_key":"90e3104215326a32d1b6d5d91538590f58c20473","event_fingerprint":"d8b4ba43ddf421e923f31e8a52496f0dc31926c0","classification_confidence":0.5,"confidence":0.5,"precision_signals":["INT-FP-port-probe-noise","INT-single-port"],"classification_reason":"Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%","confidence_breakdown":{"waf":8,"classification":48,"behavior":0,"geo":0,"protocol":0,"novelty":0,"risk_score":44},"risk_confidence_factor":50,"city":null,"is_datacenter":false,"is_tor_hint":false,"geo":{"country":"RU","asn":9123,"org":"Jsc timeweb","is_datacenter":false,"is_tor_hint":false},"fingerprint":{"payload_hash":"56bbbb308cdf5862a43ed2014568a264","path_pattern_hash":"49ebffbc8eed300cf9429db1ba4cf66d"},"target_context":{"dst_port":4028,"risk_score":44},"payload_preview":"{\"command\": \"version\"}\r\n","request_sample":"{\"command\": \"version\"}\r\n","payload_snippet":"{\"command\": \"version\"}","evidence":{"request_sample":"{\"command\": \"version\"}\r\n","payload_snippet":"{\"command\"…
|