公開している web サーバのログから通常のアクセスではない通信について分析しました。
多かったリクエスト
ログイン画面へのアクセス
どのサービス化までは特定できませんでしたが、ブルートフォース目的のログイン画面へのアクセスがありました。
/admin/assets/js/views/login.js
wordpressのログイン画面へのアクセスもありました。
/wp-login.php
TP-Link製ルータArcher AX21の脆弱性（CVE-2023-1389）を狙った攻撃
2023年6月度 MBSD-SOCの検知傾向トピックス | 技術者ブログ | 三井物産セキュアディレクション株式会社
/cgi-bin/luci/;stok=/locale
PHPUnitのevalをリモート実行
PHPのユニットテストツールのPHPUnitの脆弱性を利用してのeval()を実行しようとする通信
JVNDB-2017-005280 - JVN iPedia - 脆弱性対策情報データベース
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php
/vendor/phpunit/Util/PHP/eval-stdin.php
/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/phpunit/LICENSE/eval-stdin.php
/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/phpunit/src/Util/PHP/eval-stdin.php
/phpunit/phpunit/Util/PHP/eval-stdin.php
/phpunit/Util/PHP/eval-stdin.php
/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/phpunit/Util/PHP/eval-stdin.php
/lib/phpunit/Util/PHP/eval-stdin.php
/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
Apacheのパストラバーサルの脆弱性 (CVE-2021-41773、CVE-2021-42013)を利用したシェルの実行
普通にパストラバーサルを試す攻撃がありました。
Apache HTTP Serverのディレクトリトラバーサル脆弱性_CVE-2021-41773_検証 #Apache_http_server - Qiita
/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh
Cisco 製 Cisco IOS XE などのネットワーク機器の Web UI の脆弱性
下記の記事のようなネットワーク機器のWeb UIにアクセスを試みる通信だと思われます。
Cisco 製 Cisco IOS XE の Web UI の脆弱性について(CVE-2023-20198 等) | 情報セキュリティ | IPA 独立行政法人 情報処理推進機構
/webui/
Spring Frameworkの脆弱性
Spring FrameworkのSpring Cloud Gatewayという機能の脆弱性に関する通信みたいです。
CVE-2022-22947: Spring Cloud Gateway Code Injection Vulnerability
/actuator/gateway/routes
GeoServerの脆弱性
GeoServer の深刻な脆弱性 CVE-2023-35042 が FIX：RCE 攻撃が観測されている – IoT OT Security News
/geoserver/web/
地理空間データ共有OSS「GeoServer」の脆弱性
OSSのGeoServerで脆弱性が見つかっていてそれを利用しようとしていると思われる通信がありました。
【セキュリティ ニュース】地理空間データ共有OSS「GeoServer」にRCE脆弱性 - アップデートの実施を（1ページ目 / 全1ページ）：Security NEXT
/geoserver/web/wicket/bookmarkable/org.geoserver.web.AboutGeoServerPage
不審な通信の一覧
| uri | count |
|---|---|
| /robots.txt | 1536 |
| /.env | 537 |
| / | 363 |
| /favicon.ico | 337 |
| /admin/assets/js/views/login.js | 318 |
| /cgi-bin/luci/;stok=/locale | 292 |
| /sw.js | 222 |
| /ads.txt | 211 |
| /.git/config | 180 |
| * | 158 |
| /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 153 |
| /wp-login.php | 144 |
| /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh | 139 |
| /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh | 126 |
| /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 124 |
| /vendor/phpunit/src/Util/PHP/eval-stdin.php | 122 |
| /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php | 122 |
| /vendor/phpunit/Util/PHP/eval-stdin.php | 122 |
| /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input | 122 |
| /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 121 |
| /vendor/phpunit/phpunit/LICENSE/eval-stdin.php | 121 |
| /phpunit/phpunit/src/Util/PHP/eval-stdin.php | 121 |
| /phpunit/src/Util/PHP/eval-stdin.php | 120 |
| /phpunit/phpunit/Util/PHP/eval-stdin.php | 120 |
| /phpunit/Util/PHP/eval-stdin.php | 120 |
| /lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 120 |
| /lib/phpunit/src/Util/PHP/eval-stdin.php | 119 |
| /lib/phpunit/phpunit/Util/PHP/eval-stdin.php | 119 |
| /lib/phpunit/Util/PHP/eval-stdin.php | 119 |
| /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 118 |
| mstshash=hello | 116 |
| /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /public/index.php?s=/index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello | 116 |
| /panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /index.php?s=/index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello | 116 |
| /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/+/tmp/index1.php | 116 |
| /demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| /V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | 116 |
| mstshash=Administr | 115 |
| /index.php?lang=../../../../../../../../tmp/index1 | 115 |
| /app-ads.txt | 99 |
| /.env.example | 79 |
| /index.xml | 73 |
| /_profiler/phpinfo | 72 |
| /wp-includes/js/jquery/jquery.js | 65 |
| /vendor/phpunit/phpunit/build.xml | 63 |
| /plugins/system/debug/debug.xml | 63 |
| /misc/ajax.js | 63 |
| /js/header-rollup-554.js | 63 |
| /images/editor/separator.gif | 63 |
| /fckeditor/editor/filemanager/connectors/php/upload.php?Type=Media | 63 |
| /config.json | 63 |
| /administrator/language/en-GB/install.xml | 63 |
| /administrator/help/en-GB/toc.json | 63 |
| /administrator/ | 63 |
| /admin/view/javascript/common.js | 63 |
| /admin/includes/general.js | 63 |
| /api/.env | 61 |
| /webui/ | 60 |
| /index.php | 59 |
| /.well-known/traffic-advice | 58 |
| /actuator/gateway/routes | 57 |
| /geoserver/web/ | 55 |
| /post/wp-login.php | 54 |
| /.env.production | 49 |
| /sellers.json | 46 |
| /.env.prod | 46 |
| /phpinfo.php | 45 |
| /info.php | 44 |
| /.env.production.local | 42 |
| /.env.old | 42 |
| /.env.local | 42 |
| /.env.bak | 42 |
| /.env.stage | 41 |
| /.env.save | 41 |
| /t4 | 40 |
| /infos.php | 40 |
| /sftp-config.json | 39 |
| /pinfo.php | 39 |
| /linusadmin-phpinfo.php | 39 |
| /infophp.php | 39 |
| /.env.dev | 39 |
| /.env.backup | 39 |
| /.env.development.local | 38 |
| /test.php | 37 |
| /php-info.php | 37 |
| /.env_sample | 37 |
| /.env.www | 37 |
| /php_info.php | 36 |
| /php.php | 36 |
| /old_phpinfo.php | 36 |
| /i.php | 36 |
| /dashboard/phpinfo.php | 36 |
| /config/default.json | 36 |
| /config/config.json | 36 |
| /_profiler/phpinfo.php | 36 |
| /.env_1 | 36 |
| /.env.prod.local | 36 |
| /.env.live | 36 |
| /.env.dev.local | 36 |
| /temp.php | 35 |
| /pi.php | 35 |
| /phpversion.php | 35 |
| /p.php | 35 |
| /time.php | 34 |
| /sdk | 34 |
| /php2.php | 34 |
| /l.php?act=phpinfo | 34 |
| /ftpsync.settings | 34 |
| /credentials/config.json | 34 |
| /asdf.php | 34 |
| /HNAP1 | 34 |
| /.aws/credentials/.aws/config | 34 |
| /.well-known/security.txt | 30 |
| /webui | 28 |
| /v2/_catalog | 28 |
| /user | 28 |
| /owa/ | 28 |
| /human.aspx | 28 |
| /geoserver/web/wicket/bookmarkable/org.geoserver.web.AboutGeoServerPage | 28 |
| //pagead2.googlesyndication.com/pagead/js/adsbygoogle.js | 28 |
| /post/20191215_go-gui-app | 26 |
| /manifest.js | 26 |
| /cgi-bin/authLogin.cgi | 26 |
| /solr/admin/info/system | 22 |
| /solr/admin/cores?action=STATUS&wt=json | 22 |
| /query?q=SHOW+DIAGNOSTICS | 22 |
| /evox/about | 22 |
| /debug/default/view?panel=config | 22 |
| /about | 21 |
| /wp | 20 |
| /wordpress | 20 |
| /old | 20 |
| /new | 20 |
| /main | 20 |
| /home | 20 |
| /dns-query | 20 |
| /bk | 20 |
| /bc | 20 |
| /backup | 20 |
| /app/.env | 20 |
| /admin.php | 20 |
| /.git/HEAD | 20 |
| /laravel/.env | 19 |
| /actuator/health | 19 |
| /backend/.env | 18 |
| /.vscode/sftp.json | 18 |
| /sendgrid.env | 17 |
| /core/.env | 17 |
| /1.php | 17 |
| /+CSCOE+/logon.html | 17 |
| /server-status | 16 |
| /prod/.env | 16 |
| /login | 16 |
| /admin/.env | 16 |
| /.well-known/assetlinks.json | 16 |
| /.well-known/apple-app-site-association | 16 |
| /staging/.env | 15 |
| /aab8 | 15 |
| /xml/info.xml | 14 |
| /webpages/login.html | 14 |
| /teorema505?t=1 | 14 |
| /post/20231105 | 14 |
| /main.php | 14 |
| /geoserver/index.html | 14 |
| /geoserver/ | 14 |
| /default.php | 14 |
| /dana-na/nc/nc_gina_ver.txt | 14 |
| /dana-cached/hc/HostCheckerInstaller.osx | 14 |
| /cgi-bin/info.cgi | 14 |
| /cgi-bin/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/bin/sh | 14 |
| /alive.php | 14 |
| /ab2h | 14 |
| /ab2g | 14 |
| /CFIDE/componentutils/ | 14 |
| /Account/Login | 14 |
| /shared/.env | 13 |
| /menu.php | 13 |
| /js/NewWindow_2_all.js | 13 |
| /index.jsp | 13 |
| /home.php | 13 |
| /development/.env | 13 |
| /apps/.env | 13 |
| default.asp | 12 |
| /upl.php | 12 |
| /systembc/password.php | 12 |
| /start.shtml | 12 |
| /start.pl | 12 |
| /start.jsp | 12 |
| /start.jsa | 12 |
| /start.jhtml | 12 |
| /start.cgi | 12 |
| /start.aspx | 12 |
| /start.asp | 12 |
| /resolve?name=example.com&type=A | 12 |
| /resolve | 12 |
| /query?name=example.com&type=A | 12 |
| /query | 12 |
| /pools/default/buckets | 12 |
| /pools | 12 |
| /password.php | 12 |
| /menu.shtml | 12 |
| /menu.pl | 12 |
| /menu.jsp | 12 |
| /menu.jsa | 12 |
| /menu.jhtml | 12 |
| /menu.html | 12 |
| /menu.cgi | 12 |
| /menu.cfm | 12 |
| /menu.aspx | 12 |
| /menu.asp | 12 |
| /main.shtml | 12 |
