Détails IP 94.154.43.12

Synthèse exécutive

Profil de menace

Score de risque 80/100 Élevé

Première observation 29/06/2026 16:35 UTC

Dernière observation 18/07/2026 00:43 UTC

Événements (période) 53

MITRE ATT&CK principal TA0001 48 occurrences

Activité suspecte · risque 40/100

Pourquoi listée

Synthèse décisionnelle honeypot — seuil de listing maintenu à 1 événement qualifié.

Type « web_probe » (signaux protocolaires) · confiance 77%

Confiance 77 % — Score WAF 8

Comparaison ASN / FAI

ASN 219502 · 94.154.43.0/24 · RIPENCC — 8 pair(s) ASN/FAI listé(s) — activité locale élevée vs pairs · 53 événements sur la période pour cette IP.

94.154.43.243 Sonde HTTP 18/07/2026 01:54 UTC
94.154.43.73 Sonde port 18/07/2026 01:09 UTC
94.154.43.96 Sonde HTTP smuggling 18/07/2026 01:02 UTC
94.154.43.140 jenkins probe 18/07/2026 00:38 UTC
94.154.43.64 Injection de commande 18/07/2026 00:10 UTC
94.154.43.31 Sonde port 17/07/2026 23:58 UTC
94.154.43.66 Agent personnel 17/07/2026 23:31 UTC
94.154.43.230 Injection de commande 17/07/2026 21:22 UTC

IPs apparentées

Même FAI Storm Industries LLC — corrélation indicative.

94.154.43.243 Sonde HTTP
94.154.43.73 Sonde port
94.154.43.96 Sonde HTTP smuggling
94.154.43.140 jenkins probe
94.154.43.64 Injection de commande

Filtres

Les dates De/À priment sur la période. Affinez protocole, port, service et classification.

proto=Tous service=Tous port=Tous type=Tous sév.=Toutes

Période

Protocole

Port (dst)

Service

Classification

Sévérité min

Sévérité max

Réinitialiser

Chronologie des événements

53 événement(s) — page 1/2

Horodatage	Proto	Port	Service	Classification	Sévérité	Risque
18/07/2026 00:43:54 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → google.com:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT google.com:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_web_probe Cible HTTP CONNECT google.com:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible google.com:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT google.com:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT google.com:443 HTTP/1.1 Host: google.com:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "731cb21f265085a6b18bd0764ebdc58a3741e235", "http_target_hash": "731cb21f265085a6b18bd0764ebdc58a3741e235", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.792042740719609, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac7819a224b92f727dd77221e321741368d90167", "event_fingerprint": "151de406df7fef935fa20cc7cdfcb196a1cdb53a", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "498628f306be68e6d61e8fd2343a300c", "path_pattern_hash": "bb701e2040fc41cbc99c6a152ab6aa6e" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "google.com:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT google.com:443 HTTP\/1.1", "request_sample": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "google.com:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT google.com:443 HTTP\/1.1", "request_sample": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9dd45bb6a6d3ff4b1d32dfaa6940439edcfb7c0f", "protocol_details": { "http_method": "CONNECT", "http_path": "google.com:443", "request_line": "CONNECT google.com:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com:443", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "google.com:443", "request_line": "CONNECT google.com:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com:443", "evidence_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_web_probe" ] }
17/07/2026 22:11:16 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
17/07/2026 15:57:57 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
17/07/2026 15:33:38 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
16/07/2026 22:56:57 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
16/07/2026 20:02:22 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
16/07/2026 18:29:25 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
16/07/2026 15:25:08 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
15/07/2026 23:31:05 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
15/07/2026 20:57:28 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
15/07/2026 01:13:58 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → google.com:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT google.com:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_web_probe Cible HTTP CONNECT google.com:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible google.com:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT google.com:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT google.com:443 HTTP/1.1 Host: google.com:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "731cb21f265085a6b18bd0764ebdc58a3741e235", "http_target_hash": "731cb21f265085a6b18bd0764ebdc58a3741e235", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.792042740719609, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac7819a224b92f727dd77221e321741368d90167", "event_fingerprint": "151de406df7fef935fa20cc7cdfcb196a1cdb53a", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "498628f306be68e6d61e8fd2343a300c", "path_pattern_hash": "bb701e2040fc41cbc99c6a152ab6aa6e" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "google.com:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT google.com:443 HTTP\/1.1", "request_sample": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "google.com:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT google.com:443 HTTP\/1.1", "request_sample": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9dd45bb6a6d3ff4b1d32dfaa6940439edcfb7c0f", "protocol_details": { "http_method": "CONNECT", "http_path": "google.com:443", "request_line": "CONNECT google.com:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com:443", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "google.com:443", "request_line": "CONNECT google.com:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com:443", "evidence_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_web_probe" ] }
15/07/2026 00:04:49 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → google.com:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT google.com:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_web_probe Cible HTTP CONNECT google.com:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible google.com:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT google.com:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT google.com:443 HTTP/1.1 Host: google.com:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "731cb21f265085a6b18bd0764ebdc58a3741e235", "http_target_hash": "731cb21f265085a6b18bd0764ebdc58a3741e235", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.792042740719609, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac7819a224b92f727dd77221e321741368d90167", "event_fingerprint": "151de406df7fef935fa20cc7cdfcb196a1cdb53a", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "498628f306be68e6d61e8fd2343a300c", "path_pattern_hash": "bb701e2040fc41cbc99c6a152ab6aa6e" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "google.com:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT google.com:443 HTTP\/1.1", "request_sample": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "google.com:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT google.com:443 HTTP\/1.1", "request_sample": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9dd45bb6a6d3ff4b1d32dfaa6940439edcfb7c0f", "protocol_details": { "http_method": "CONNECT", "http_path": "google.com:443", "request_line": "CONNECT google.com:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com:443", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "google.com:443", "request_line": "CONNECT google.com:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com:443", "evidence_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_web_probe" ] }
14/07/2026 19:49:04 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
14/07/2026 15:43:17 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
14/07/2026 15:01:14 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
14/07/2026 11:38:10 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
14/07/2026 07:15:07 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
14/07/2026 03:57:01 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
14/07/2026 02:32:50 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
13/07/2026 22:19:53 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
13/07/2026 20:25:00 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
13/07/2026 15:38:40 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
13/07/2026 14:25:35 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 72 }
13/07/2026 10:37:53 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
13/07/2026 06:09:37 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
13/07/2026 03:57:37 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
13/07/2026 02:34:45 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
12/07/2026 22:22:26 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
12/07/2026 20:27:25 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
12/07/2026 17:00:29 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
12/07/2026 13:57:09 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
12/07/2026 09:34:51 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
12/07/2026 07:56:28 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
12/07/2026 05:17:23 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
12/07/2026 00:54:39 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
11/07/2026 22:19:30 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
11/07/2026 18:47:09 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
11/07/2026 15:52:55 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
11/07/2026 11:42:35 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ], "behavior_alert_count": 1, "behavior_priority": 72 }
11/07/2026 10:23:10 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
11/07/2026 07:51:27 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
11/07/2026 02:19:11 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427601325452111, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "2d6520059fd0be40bfd57f6a9514e200", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "b13b388ebe679c99407f0c8426373aa8dbe27ec9", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
10/07/2026 23:24:47 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
10/07/2026 16:24:21 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1369 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1605, "payload_entropy": 5.427247157410774, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "4d382aa41f131387d74539de19657938", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "ad7e98bb7c879fac20f402ac07dc6b6adaad975a", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1369\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
05/07/2026 11:48:22 UTC	TCP	3128 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:3128 · (sonde / probe) · → google.com:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT google.com:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_web_probe Cible HTTP CONNECT google.com:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 3128 Chemin / cible google.com:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT google.com:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT google.com:443 HTTP/1.1 Host: google.com:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 82, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "731cb21f265085a6b18bd0764ebdc58a3741e235", "http_target_hash": "731cb21f265085a6b18bd0764ebdc58a3741e235", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.792042740719609, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 3128, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 5.9, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "2bc7ae0bcc4ae14f1e133c1121a155b76b1471f2", "event_fingerprint": "9aaf67c5fc605c558781c85c8e98230e0b9dd2d8", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "498628f306be68e6d61e8fd2343a300c", "path_pattern_hash": "bb701e2040fc41cbc99c6a152ab6aa6e" }, "service_name": "http", "target_context": { "dst_port": 3128, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "google.com:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT google.com:443 HTTP\/1.1", "request_sample": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "google.com:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT google.com:443 HTTP\/1.1", "request_sample": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "69e615a6df0730b43ca99aca7acd0d62f0485e68", "protocol_details": { "http_method": "CONNECT", "http_path": "google.com:443", "request_line": "CONNECT google.com:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com:443", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3128, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "google.com:443", "request_line": "CONNECT google.com:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 3128, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:3128 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com:443", "evidence_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "3128 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3128" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_web_probe" ] }
05/07/2026 08:28:16 UTC	TCP	8080 · HTTP	http	Sonde HTTP Sonde HTTP · via HTTP:8080 · (sonde / probe) · → google.com:443	Élevée	Moyen · 40
Étape Sonde / probe Chaîne Découverte Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0007 TA0007 TA0001 Protocole CONNECT google.com:443 UA Go-http-client/1.1 Émulateur HTTP WAF 0 Recommandation Surveiller Tags http_dangerous_method http_method_uncommon http_ua_suspicious net_web_probe Cible HTTP CONNECT google.com:443 TLS SNI — Capteur paris-1
Preuve / Evidence Méthode CONNECT Port 8080 Chemin / cible google.com:443 Service HTTP Pourquoi cette classification : Type « web_probe » (signaux protocolaires) · confiance 77% Confiance classification 77% Risque capteur Moyen · 40 Confiance : Confiance 77 % — Score WAF 8 Protocole émulé 1 Technique MITRE TA0007 Tactiques MITRE TA0007 TA0001 Ligne de requête `CONNECT google.com:443 HTTP/1.1` User-Agent Go-http-client/1.1 Règles WAF — Payload (extrait) CONNECT google.com:443 HTTP/1.1 Host: google.com:443 User-Agent: Go-http-client/1.1 Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b", "emulator_response_len": 81, "http_header_count": 2, "http_query_params": 0, "http_path_depth": 1, "http_path_ext": null, "http_ua_hash": "c3e68bb8f388240c7ecaebb8bcb80a85536526f2", "http_host_hash": "731cb21f265085a6b18bd0764ebdc58a3741e235", "http_target_hash": "731cb21f265085a6b18bd0764ebdc58a3741e235", "http_referer_hash": null, "http_method": "CONNECT", "http_ua_is_cli": true, "http_ua_is_browser": false, "bytes_in": 89, "payload_entropy": 4.792042740719609, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "NL", "dst_port": 8080, "risk_waf": 8, "risk_classification": 38, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 15, "risk_boost": 0, "risk_granularity": 4.6, "risk_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15 }, "risk_score": 40, "tag_count": 4, "anomaly_count": 0, "campaign_key": "ac7819a224b92f727dd77221e321741368d90167", "event_fingerprint": "151de406df7fef935fa20cc7cdfcb196a1cdb53a", "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "NL", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "12bd583dd25b868e6423d8f04cc19fd1", "payload_hash": "498628f306be68e6d61e8fd2343a300c", "path_pattern_hash": "bb701e2040fc41cbc99c6a152ab6aa6e" }, "service_name": "http", "target_context": { "dst_port": 8080, "service": "http", "service_name": "http", "risk_score": 40 }, "payload_preview": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "method": "CONNECT", "path": "google.com:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT google.com:443 HTTP\/1.1", "request_sample": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "evidence": { "method": "CONNECT", "path": "google.com:443", "user_agent": "Go-http-client\/1.1", "request_line": "CONNECT google.com:443 HTTP\/1.1", "request_sample": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1\r\n\r\n", "payload_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%" }, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "mitre_tactics": [ "TA0007", "TA0001" ], "mitre": "TA0007", "threat_family": [ "scanner" ], "confidence": 0.77, "classification_confidence": 0.77, "recommended_client_action": "monitor", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "9dd45bb6a6d3ff4b1d32dfaa6940439edcfb7c0f", "protocol_details": { "http_method": "CONNECT", "http_path": "google.com:443", "request_line": "CONNECT google.com:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com:443", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "site_display": { "classification": null, "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100", "confidence_pct": 77, "confidence_breakdown": { "waf": 8, "classification": 38, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 15, "risk_score": 40 }, "attack_stage": "probe", "attack_stage_label": "Sonde \/ probe", "attack_chain_stage": "discovery", "attack_chain_stage_label_fr": "D\u00e9couverte", "risk_score": 40, "risk_label": "Moyen", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 8080, "protocol_emulated": true, "tags_summary": null, "tags_summary_labels_fr": null, "recommended_action": "monitor", "recommended_action_label": "Surveiller", "mitre": "TA0007", "mitre_technique": "TA0007", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "CONNECT", "http_path": "google.com:443", "request_line": "CONNECT google.com:443 HTTP\/1.1", "http_user_agent": "Go-http-client\/1.1", "port": 8080, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "Sonde HTTP \u00b7 via HTTP:8080 \u00b7 (sonde \/ probe) \u00b7 \u2192 google.com:443", "evidence_snippet": "CONNECT google.com:443 HTTP\/1.1\r\nHost: google.com:443\r\nUser-Agent: Go-http-client\/1.1", "target_port_label": "8080 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 77 % \u2014 Score WAF 8", "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": true, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": false, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "discovery", "label_fr": "D\u00e9couverte", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "8080" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "discovery", "matched_patterns": [], "ban_policy": "advisory_monitor", "tags_list": [ "http_dangerous_method", "http_method_uncommon", "http_ua_suspicious", "net_web_probe" ] }
01/07/2026 00:46:32 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1367 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1367 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1603, "payload_entropy": 5.428034833135078, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "UA", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "fa51b9854eb23705dbd32acf75a7df06", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6d99cd4766d1e8cac1e2d4a677ba811d5c8dc308", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
30/06/2026 12:13:43 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1367 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1367 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1603, "payload_entropy": 5.42038767869279, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "UA", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "e3c6251f09abddae1bcb0f13e38a032d", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f51cae630544796691f132b6dee345c15da6966b", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
30/06/2026 07:48:41 UTC	TCP	3001 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3001 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3001 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1367 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3001 User-Agent: Mozilla/5.0 Content-Length: 1367 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a7b226461746162617365223a226f6b222c2276657273696f6e223a2231302e322e30227d", "emulator_response_len": 107, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "68964bd149320edbceb0d6a222e6bc3e0bdb74e3", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1603, "payload_entropy": 5.42078803603224, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "UA", "dst_port": 3001, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 7, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "0e7d815c787558e69d99fa8e1a093a9f1914af68", "event_fingerprint": "686d57dd460008cb7a719e44e3f0ce2a85e06fef", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "fa51b9854eb23705dbd32acf75a7df06", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3001, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "6d99cd4766d1e8cac1e2d4a677ba811d5c8dc308", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3001, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3001, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3001 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3001\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3001 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3001" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }
30/06/2026 05:53:35 UTC	TCP	3000 · HTTP	http	Sonde HTTP smuggling http smuggling probe · via HTTP:3000 · (tentative d'exploit)	Élevée	Élevé · 80
Étape Tentative d'exploit Chaîne Exploitation Persona mail.sensor-1.internal Rôle capteur Renseignement menaces MITRE TA0001 TA0001 TA0002 Protocole POST / UA Mozilla/5.0 Émulateur HTTP WAF 49 Recommandation Investiguer Tags 950019:sqli-4 950319:lfi-14 950326:rce-0 950327:rce-0 Cible HTTP POST / TLS SNI — Capteur paris-1
Preuve / Evidence Méthode POST Port 3000 Chemin / cible / Service HTTP Pourquoi cette classification : Injection commande dans la requête · confiance 95% Confiance classification 95% Risque capteur Élevé · 80 Confiance : Confiance 95 % — Motif catalogue confirmé · 8 tag(s) WAF Protocole émulé 1 Signaux pat-0842 Technique MITRE TA0001 Tactiques MITRE TA0001 TA0002 Motifs de détection (base) CRS 921130 duplicate CL CRS 932200 CRS 932205 CRS 932301 Ligne de requête `POST / HTTP/1.1` User-Agent Mozilla/5.0 Règles WAF sqli-4 lfi-14 rce-0 ssrf-3 nosqli-3 upload-0 sap-sapcontrol-path Payload (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1367 Accept: / Connection: close Content-T Requête brute (extrait) POST / HTTP/1.1 Host: 62.3.50.33:3000 User-Agent: Mozilla/5.0 Content-Length: 1367 Accept: / Connection: close Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryReactCVE Next-Action: x Accept-Encoding: gzip ------WebKitFormBoun Meta JSON brut { "protocol_emulated": true, "emulator_response": "485454502f312e3120343034204e6f7420466f756e640d0a582d506f77657265642d42793a20457870726573730d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2031320d0a0d0a43616e6e6f7420474554202f", "emulator_response_len": 106, "http_header_count": 8, "http_query_params": 0, "http_path_depth": 0, "http_path_ext": null, "http_ua_hash": "82aa6a482bd276cff149740478a603a5fe834840", "http_host_hash": "46f5955a67387b75de712e640b0687c888a438e5", "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8", "http_referer_hash": null, "http_method": "POST", "http_ua_is_cli": false, "http_ua_is_browser": true, "bytes_in": 1603, "payload_entropy": 5.42038767869279, "port_category": "registered", "org": "Storm Industries LLC", "service": "http", "app_proto": "http", "asn": 219502, "country": "UA", "dst_port": 3000, "risk_waf": 100, "risk_classification": 85, "risk_behavior": 0, "risk_geo": 0, "risk_protocol": 43, "risk_novelty": 25, "risk_boost": 15, "risk_granularity": 6.8, "risk_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25 }, "risk_score": 80, "tag_count": 14, "anomaly_count": 0, "campaign_key": "a3fdde3048344272ed899db1cd91af593db961ac", "event_fingerprint": "726426a3d8edea4ef12e10ac04631ad1c495e15b", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "confidence": 0.95, "classification_confidence": 0.95, "precision_score": 84, "precision_signals": [ "pat-0842" ], "kb_rule_ids": [ "pat-0842" ], "matched_patterns": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "matched_pattern_names": [ "CRS 921130 duplicate CL", "CRS 932200", "CRS 932205", "CRS 932301" ], "pattern_ids": [ "pat-0842", "pat-0145", "pat-0146", "pat-0153" ], "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "named_classification_skipped": false, "service_name": "http", "risk_confidence_factor": 95, "city": null, "is_datacenter": false, "is_tor_hint": false, "geo": { "country": "UA", "asn": 219502, "org": "Storm Industries LLC", "is_datacenter": false, "is_tor_hint": false }, "fingerprint": { "http_ua_hash": "1066b48224bb188ceb955605f4fcff98", "payload_hash": "e3c6251f09abddae1bcb0f13e38a032d", "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d" }, "target_context": { "dst_port": 3000, "service": "http", "service_name": "http", "risk_score": 80 }, "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "evidence": { "method": "POST", "path": "\/", "user_agent": "Mozilla\/5.0", "waf_tags": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path" ], "waf_rule_names": [ "sqli-4", "lfi-14", "rce-0", "ssrf-3", "nosqli-3", "upload-0", "sap-sapcontrol-path" ], "request_line": "POST \/ HTTP\/1.1", "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-Type: multipart\/form-data; boundary=----WebKitFormBoundaryReactCVE\r\nNext-Action: x\r\nAccept-Encoding: gzip\r\n\r\n------WebKitFormBoun", "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%" }, "attack_stage": "exploit_attempt", "mitre_tactics": [ "TA0001", "TA0002" ], "mitre": "TA0001", "threat_family": [ "web_injection", "ssrf_probe" ], "recommended_client_action": "investigate", "policy_mode": "intelligence", "sensor_role": "threat_intelligence", "event_signature": "f51cae630544796691f132b6dee345c15da6966b", "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "site_display": { "classification": null, "classification_reason": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "classification_reason_label_fr": "Injection commande dans la requ\u00eate \u00b7 confiance 95%", "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 80\/100 (\u00c9lev\u00e9) \u2014 MITRE TA0001 \u2014 confiance 95 % \u2014 via HTTP", "confidence_pct": 95, "confidence_breakdown": { "waf": 100, "classification": 85, "behavior": 0, "geo": 0, "protocol": 43, "novelty": 25, "risk_score": 80 }, "attack_stage": "exploit_attempt", "attack_stage_label": "Tentative d'exploit", "attack_chain_stage": "exploitation", "attack_chain_stage_label_fr": "Exploitation", "risk_score": 80, "risk_label": "\u00c9lev\u00e9", "service_name": "http", "service_label_fr": "HTTP", "dst_port": 3000, "protocol_emulated": true, "tags_summary": [ "pat-0842" ], "tags_summary_labels_fr": [ "pat-0842" ], "recommended_action": "investigate", "recommended_action_label": "Investiguer", "mitre": "TA0001", "mitre_technique": "TA0001", "persona_hostname": "mail.sensor-1.internal", "persona_service_banner": "honeypot-http", "correlation_flags": null, "correlation_flags_labels_fr": null, "sensor_role": "threat_intelligence", "sensor_role_label_fr": "Renseignement menaces", "confidence_hint_fr": null, "protocol_details": { "http_method": "POST", "http_path": "\/", "request_line": "POST \/ HTTP\/1.1", "http_user_agent": "Mozilla\/5.0", "port": 3000, "service": "http", "service_label_fr": "HTTP" }, "attack_vector": "http smuggling probe \u00b7 via HTTP:3000 \u00b7 (tentative d'exploit)", "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:3000\r\nUser-Agent: Mozilla\/5.0\r\nContent-Length: 1367\r\nAccept: \/\r\nConnection: close\r\nContent-T", "target_port_label": "3000 \u00b7 HTTP", "emulator_service": "http", "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9 \u00b7 8 tag(s) WAF", "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 100 \u00b7 8 tag(s) WAF", "campaign_hint_fr": null, "attack_phases_timeline_fr": [ { "key": "recon", "label_fr": "Reconnaissance", "active": false, "kind": "stage" }, { "key": "probe", "label_fr": "Sonde \/ probe", "active": false, "kind": "stage" }, { "key": "exploit_attempt", "label_fr": "Tentative d'exploit", "active": true, "kind": "stage" }, { "key": "post_exploit", "label_fr": "Post-exploitation", "active": false, "kind": "stage" }, { "key": "c2", "label_fr": "Commande & contr\u00f4le", "active": false, "kind": "stage" }, { "key": "exploitation", "label_fr": "Exploitation", "active": true, "kind": "chain", "hint_fr": null } ] }, "honeypot_persona": { "sensor_id": "sensor-1", "hostname": "mail.sensor-1.internal", "mail_host": "mail.sensor-1.internal", "ldap_dc": "dc.sensor-1.internal", "k8s_cluster": "hp-sensor-1", "domain": "sensor-1.internal", "service_role": "http", "service_banner": "honeypot-http", "service_os": "linux", "dst_port": "3000" }, "hostname": "mail.sensor-1.internal", "sensor_id": "sensor-1", "attack_chain_stage": "exploitation", "ban_policy": "advisory_investigate", "tags_list": [ "950019:sqli-4", "950319:lfi-14", "950326:rce-0", "950327:rce-0", "950407:ssrf-3", "950471:nosqli-3", "950549:upload-0", "950734:sap-sapcontrol-path", "http_cmd_injection", "http_contenttype_attack_surface", "http_jwt_body", "http_ldap_injection", "http_ssrf_body", "net_web_probe" ] }

94.154.43.12

Pourquoi listée

Comparaison ASN / FAI

IPs apparentées

Géolocalisation

FAI / réseau

Renseignement menaces

Décomposition confiance

Filtres

Timeline

Ports 24 h

Top ports

Top classifications

Heatmap attaques 7j

Chronologie des événements

Comparaison côte à côte

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence

Preuve / Evidence