目次
公開している web サーバのログから通常のアクセスではない通信について分析しました。
多かったリクエスト
環境変数ファイル(.env)の露出スキャン
WebアプリケーションのデータベースのパスワードやAPIキーなど、重大な機密情報が記述されている「.env」ファイルが外部から直接閲覧可能になっていないかを探る、非常に一般的な自動スキャン攻撃です。
/staging/.env
/config/.env
/docker/.env
/src/.env
/frontend/.env
/laravel/.env
/config.env
/production/.env
/.env
/admin/.env
/dev/.env
/web/.env
/public/.env
/sendgrid.env
/api/.env
/backend/.env
/app/.env
/core/.env
/server/.env
WordPressへの不正アクセス・探索行為
WordPressのログイン画面や、外部からの遠隔操作用API（XML-RPC）を狙った通信です。管理者パスワードの総当たり攻撃（ブルートフォース）や、踏み台としての悪用を目的としたスキャンと考えられます。
/wp-login.php
/wp-content/plugins/hellopress/wp_filemanager.php
/wp-content/admin.php
/wp-content/uploads/
/wp-content/index.php
/wp-content/themes/index.php
PHPUnitのevalをリモート実行
PHPのユニットテストツールのPHPUnitの脆弱性を利用してのeval()を実行しようとする通信です。
/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/phpunit/Util/PHP/eval-stdin.php
/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/Util/PHP/eval-stdin.php
/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/phpunit/Util/PHP/eval-stdin.php
/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/Util/PHP/eval-stdin.php
/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php
/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/phpunit/phpunit/Util/PHP/eval-stdin.php
/vendor/phpunit/src/Util/PHP/eval-stdin.php
/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/src/Util/PHP/eval-stdin.php
/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/phpunit/src/Util/PHP/eval-stdin.php
不審な通信の一覧
| アクセス数 | メソッド | リクエスト |
|---|---|---|
| 3933 | GET | HTTP/1.1 /robots.txt |
| 537 | GET | HTTP/1.1 /.env |
| 537 | GET | HTTP/1.1 /favicon.ico |
| 419 | GET | HTTP/1.1 /wp-login.php |
| 413 | GET | HTTP/1.1 /.git/config |
| 370 | GET | HTTP/1.1 /wp-content/plugins/hellopress/wp_filemanager.php |
| 368 | GET | HTTP/1.1 /SDK/webLanguage |
| 358 | GET | HTTP/1.1 /this_is_a_new_hello_world.php |
| 239 | GET | HTTP/1.1 /222.php |
| 228 | GET | HTTP/1.1 /1.php |
| 203 | GET | HTTP/1.1 /.env.local |
| 202 | GET | HTTP/1.1 /api/.env |
| 202 | GET | HTTP/1.1 /.env.production |
| 196 | GET | HTTP/1.1 /backend/.env |
| 192 | GET | HTTP/1.1 /app/.env |
| 181 | GET | HTTP/1.1 /about.php |
| 178 | GET | HTTP/1.1 /info.php |
| 176 | GET | HTTP/1.1 /images.php |
| 174 | GET | HTTP/1.1 /admin/.env |
| 174 | GET | HTTP/1.1 /mac.php |
| 172 | GET | HTTP/1.1 /laravel/.env |
| 170 | GET | HTTP/1.1 /.env.example |
| 169 | GET | HTTP/1.1 /ops.php |
| 168 | GET | HTTP/1.1 /admin.php |
| 168 | GET | HTTP/1.1 /.aws/credentials |
| 168 | GET | HTTP/1.1 /media.php |
| 160 | GET | HTTP/1.1 /core/.env |
| 159 | GET | HTTP/1.1 /.env.bak |
| 158 | GET | HTTP/1.1 /3PJcpMFsD8B.php |
| 157 | GET | HTTP/1.1 /.env.old |
| 155 | GET | HTTP/1.1 /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 152 | GET | HTTP/1.1 /chosen.php |
| 152 | GET | HTTP/1.1 /4PJcpMFsD8B.php |
| 149 | GET | HTTP/1.1 /config.json |
| 148 | GET | HTTP/1.1 /login |
| 145 | GET | HTTP/1.1 /simple.php |
| 145 | GET | HTTP/1.1 /.env.backup |
| 145 | GET | HTTP/1.1 /.env.dev |
| 145 | GET | HTTP/1.1 /dex.php |
| 143 | GET | HTTP/1.1 /8.php |
| 142 | GET | HTTP/1.1 /src/.env |
| 142 | GET | HTTP/1.1 /phpinfo.php |
| 142 | GET | HTTP/1.1 /wp.php |
| 141 | GET | HTTP/1.1 /dev/.env |
| 140 | GET | HTTP/1.1 /web/.env |
| 139 | GET | HTTP/1.1 /BDKR28WP.php |
| 138 | GET | HTTP/1.1 /server/.env |
| 137 | POST | HTTP/1.1 /register |
| 136 | GET | HTTP/1.1 /classwithtostring.php?p= |
| 135 | GET | HTTP/1.1 /config.env |
| 134 | GET | HTTP/1.1 /wp-admin/ |
| 133 | GET | HTTP/1.1 /app-ads.txt |
| 131 | GET | HTTP/1.1 /wp-content/admin.php |
| 130 | GET | HTTP/1.1 /.git/HEAD |
| 130 | GET | HTTP/1.1 /.env.prod |
| 128 | POST | HTTP/1.1 /signin |
| 128 | GET | HTTP/1.1 /.env.development |
| 127 | POST | HTTP/1.1 /login |
| 127 | GET | HTTP/1.1 /staging/.env |
| 126 | GET | HTTP/1.1 /k.php |
| 125 | GET | HTTP/1.1 /public/.env |
| 124 | GET | HTTP/1.1 /config/.env |
| 124 | GET | HTTP/1.1 /wp-content/uploads/ |
| 124 | GET | HTTP/1.1 //av.php |
| 123 | GET | HTTP/1.1 /.env.staging |
| 120 | GET | HTTP/1.1 /actuator/env |
| 120 | GET | HTTP/1.1 /inputs.php |
| 119 | GET | HTTP/1.1 /.env.save |
| 117 | GET | HTTP/1.1 /wp-content/index.php |
| 117 | GET | HTTP/1.1 /classwithtostring.php |
| 116 | GET | HTTP/1.1 /coffexium.php |
| 116 | GET | HTTP/1.1 /fpwch.php |
| 112 | GET | HTTP/1.1 /wp-content/themes/index.php |
| 110 | GET | HTTP/1.1 /ms-edit.php |
| 109 | GET | HTTP/1.1 /wp-config.php.bak |
| 109 | GET | HTTP/1.1 /config/.env.php |
| 109 | GET | HTTP/1.1 /.gitlab-ci.yml |
| 108 | GET | HTTP/1.1 /.aws/config |
| 108 | GET | HTTP/1.1 /aaa.php |
| 108 | GET | HTTP/1.1 /new.php |
| 107 | POST | HTTP/1.1 /wp-json/batch/v1 |
| 107 | GET | HTTP/1.1 /file.php |
| 107 | GET | HTTP/1.1 /domvf.php |
| 106 | GET | HTTP/1.1 /.env.php.bak |
| 105 | GET | HTTP/1.1 /as.php |
| 105 | GET | HTTP/1.1 /x.php |
| 105 | GET | HTTP/1.1 /appsettings.json |
| 103 | GET | HTTP/1.1 /biufile.php |
| 103 | POST | HTTP/1.1 /dashboard |
| 102 | GET | HTTP/1.1 /yj09.php |
| 102 | GET | HTTP/1.1 /w.php |
| 102 | GET | HTTP/1.1 /f35.php |
| 101 | GET | HTTP/1.1 /application.yml |
| 100 | GET | HTTP/1.1 /wp-json |
| 99 | GET | HTTP/1.1 /test.php |
| 99 | POST | HTTP/1.1 /admin |
| 99 | GET | HTTP/1.1 /administrator/ |
| 98 | GET | HTTP/1.1 /goods.php |
| 98 | GET | HTTP/1.1 /application.properties |
| 98 | GET | HTTP/1.1 /.bashrc |
| 96 | GET | HTTP/1.1 /ip |
| 95 | GET | HTTP/1.1 /wp-ws68.php?p= |
| 94 | GET | HTTP/1.1 /adminner.php |
| 94 | GET | HTTP/1.1 /.well-known/traffic-advice |
| 93 | POST | HTTP/1.1 /auth/callback |
| 93 | GET | HTTP/1.1 /config.js |
| 92 | GET | HTTP/1.1 /.env.test |
| 92 | GET | HTTP/1.1 /production/.env |
| 91 | POST | HTTP/1.1 /graphql |
| 91 | GET | HTTP/1.1 /aa.php |
| 91 | GET | HTTP/1.1 /i.php |
| 90 | POST | HTTP/1.1 /api/graphql |
| 90 | GET | HTTP/1.1 /frontend/.env |
| 90 | GET | HTTP/1.1 /alfa.php |
| 90 | GET | HTTP/1.1 /web.config |
| 89 | GET | HTTP/1.1 /config.php.bak |
| 89 | GET | HTTP/1.1 /terraform.tfstate |
| 89 | GET | HTTP/1.1 /ioxi-o.php |
| 89 | POST | HTTP/1.1 /wordpress/wp-json/batch/v1 |
| 89 | GET | HTTP/1.1 /rclone.conf |
| 89 | GET | HTTP/1.1 /docker/.env |
| 89 | GET | HTTP/1.1 //abcd.php |
| 89 | GET | HTTP/1.1 /settings.py |
| 89 | GET | HTTP/1.1 /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings |
| 89 | GET | HTTP/1.1 /.git-credentials |
| 88 | POST | HTTP/1.1 /v1/graphql |
| 88 | GET | HTTP/1.1 /storage/logs/laravel.log |
| 87 | POST | HTTP/1.1 /signup |
| 87 | GET | HTTP/1.1 /blurbs.php |
| 87 | GET | HTTP/1.1 /dist/manifest.json |
| 87 | GET | HTTP/1.1 /.env.docker |
| 87 | GET | HTTP/1.1 /credentials.json |
| 86 | GET | HTTP/1.1 /100.php |
| 86 | GET | HTTP/1.1 /containers/json |
| 86 | GET | HTTP/1.1 /config/database.yml |
| 86 | GET | HTTP/1.1 /file5.php |
| 86 | GET | HTTP/1.1 /actuator/configprops |
| 86 | GET | HTTP/1.1 /shiny.php |
| 86 | GET | HTTP/1.1 /service-worker.js |
| 85 | POST | HTTP/1.1 /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input |
| 85 | GET | HTTP/1.1 /wp-config.php.old |
| 85 | GET | HTTP/1.1 /system_log.php |
| 85 | GET | HTTP/1.1 /.env.swp |
| 85 | GET | HTTP/1.1 /secrets.json |
| 84 | GET | HTTP/1.1 /phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /phpunit/phpunit/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /vendor/phpunit/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /vendor/phpunit/phpunit/LICENSE/eval-stdin.php |
| 84 | GET | HTTP/1.1 /vendor/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /lib/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /lib/phpunit/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /lib/phpunit/phpunit/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /phpunit/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 84 | GET | HTTP/1.1 /blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 83 | GET | HTTP/1.1 /lock360.php |
| 83 | GET | HTTP/1.1 /docker-compose.yaml |
| 83 | GET | HTTP/1.1 /apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 83 | GET | HTTP/1.1 /panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 83 | GET | HTTP/1.1 /index.php?lang=../../../../../../../../tmp/index1 |
| 83 | GET | HTTP/1.1 /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 83 | GET | HTTP/1.1 /public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 83 | GET | HTTP/1.1 /workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 83 | GET | HTTP/1.1 /sf.php |
| 82 | GET | HTTP/1.1 /service-account.json |
| 82 | POST | HTTP/1.1 /blog/wp-json/batch/v1 |
| 81 | GET | HTTP/1.1 /inso.php |
| 80 | GET | HTTP/1.1 /firebase-adminsdk.json |
| 80 | GET | HTTP/1.1 /secrets.yml |
| 80 | GET | HTTP/1.1 /appsettings.Production.json |
| 80 | GET | HTTP/1.1 /155.php |
| 80 | GET | HTTP/1.1 /adminfuns.php |
| 80 | GET | HTTP/1.1 /.ssh/id_rsa |
| 79 | GET | HTTP/1.1 /serviceAccountKey.json |
| 79 | GET | HTTP/1.1 /gcp-credentials.json |
| 79 | GET | HTTP/1.1 /sendgrid.env |
![[商品価格に関しましては、リンクが作成された時点と現時点で情報が変更されている場合がございます。]](https://hbb.afl.rakuten.co.jp/hgb/52643321.2dfd8e5e.52643322.d29efbe7/?me_id=1213310&item_id=21641991&pc=https%3A%2F%2Fthumbnail.image.rakuten.co.jp%2F%400_mall%2Fbook%2Fcabinet%2F3737%2F9784087213737_1_33.jpg%3F_ex%3D128x128&s=128x128&t=picttext "[商品価格に関しましては、リンクが作成された時点と現時点で情報が変更されている場合がございます。]")
![[商品価格に関しましては、リンクが作成された時点と現時点で情報が変更されている場合がございます。]](https://hbb.afl.rakuten.co.jp/hgb/52643321.2dfd8e5e.52643322.d29efbe7/?me_id=1213310&item_id=21752483&pc=https%3A%2F%2Fthumbnail.image.rakuten.co.jp%2F%400_mall%2Fbook%2Fcabinet%2F2123%2F9784798192123_1_137.jpg%3F_ex%3D128x128&s=128x128&t=picttext "[商品価格に関しましては、リンクが作成された時点と現時点で情報が変更されている場合がございます。]")