目次
公開している web サーバのログから通常のアクセスではない通信について分析しました。
多かったリクエスト
環境変数ファイル(.env)の露出スキャン
WebアプリケーションのデータベースのパスワードやAPIキーなど、重大な機密情報が記述されている「.env」ファイルが外部から直接閲覧可能になっていないかを探る、非常に一般的な自動スキャン攻撃です。
/v3/.env
/secrets.env
/config/.env
/server/.env
/staging/.env
/dev/.env
/old/.env
/html/.env
/v1/.env
/cms/.env
/.env
/app/.env
/web/.env
/backup/.env
/prod/.env
/public_html/.env
/www/.env
/new/.env
/admin/.env
/frontend/.env
/production/.env
/crm/.env
/site/.env
/.docker/.env
/storage/.env
/laravel/.env
/backend/.env
/src/.env
/sendgrid.env
/api/.env
/config.env
/apps/.env
/client/.env
/core/.env
/v2/.env
/test/.env
/portal/.env
/public/.env
/application/.env
WordPressへの不正アクセス・探索行為
WordPressのログイン画面や、外部からの遠隔操作用API（XML-RPC）を狙った通信です。管理者パスワードの総当たり攻撃（ブルートフォース）や、踏み台としての悪用を目的としたスキャンと考えられます。
/wp-login.php
/post/wp-login.php
/wp-content/plugins/hellopress/wp_filemanager.php
/wordpress/wp-json/batch/v1
/blog/wp-json/batch/v1
/wp-json/batch/v1
/wp-json/Batch/v1
/wordpress/index.php?rest_route=%2Fbatch%2Fv1
/wordpress/?rest_route=/batch/v1
/wordpress/?rest_route=/batch%2Fv1
/wordpress/?rest_route=%2Fbatch%2Fv1
/wordpress/wp-json/Batch/v1
/wordpress/wp-json/batch/v1/
/wordpress//wp-json/batch/v1
/wordpress/blog/wp-json/batch/v1
/wordpress/wordpress/wp-json/batch/v1
PHPUnitのevalをリモート実行
PHPのユニットテストツールのPHPUnitの脆弱性を利用してのeval()を実行しようとする通信です。
/phpunit/Util/PHP/eval-stdin.php
/vendor/phpunit/src/Util/PHP/eval-stdin.php
/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/phpunit/src/Util/PHP/eval-stdin.php
/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/Util/PHP/eval-stdin.php
/lib/phpunit/phpunit/Util/PHP/eval-stdin.php
/vendor/phpunit/Util/PHP/eval-stdin.php
/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/src/Util/PHP/eval-stdin.php
/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php
/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/phpunit/phpunit/Util/PHP/eval-stdin.php
不審な通信の一覧
| アクセス数 | メソッド | リクエスト |
|---|---|---|
| 3170 | GET | HTTP/1.1 /robots.txt |
| 531 | GET | HTTP/1.1 /wp-login.php |
| 474 | GET | HTTP/1.1 /.env |
| 469 | GET | HTTP/1.1 /favicon.ico |
| 383 | GET | HTTP/1.1 /.git/config |
| 356 | POST | HTTP/1.1 /wordpress/wp-json/batch/v1 |
| 332 | POST | HTTP/1.1 /blog/wp-json/batch/v1 |
| 241 | POST | HTTP/1.1 /wp-json/batch/v1 |
| 230 | GET | HTTP/1.1 /.env.production |
| 228 | GET | HTTP/1.1 /.env.local |
| 206 | GET | HTTP/1.1 /.env.bak |
| 204 | GET | HTTP/1.1 /.env.save |
| 200 | GET | HTTP/1.1 /.env.prod |
| 197 | GET | HTTP/1.1 /.env.backup |
| 196 | POST | HTTP/1.1 /index.php?rest_route=/batch/v1 |
| 194 | GET | HTTP/1.1 /api/.env |
| 190 | GET | HTTP/1.1 /.env.dev |
| 189 | POST | HTTP/1.1 /wp/blog/wp-json/batch/v1 |
| 189 | POST | HTTP/1.1 /wp/wp-json/batch/v1/ |
| 189 | POST | HTTP/1.1 /wp/wordpress/wp-json/batch/v1 |
| 189 | POST | HTTP/1.1 /wp//wp-json/batch/v1 |
| 188 | POST | HTTP/1.1 /wp/?rest_route=/batch%2Fv1 |
| 188 | POST | HTTP/1.1 /wp/wp-json/batch/v1 |
| 188 | POST | HTTP/1.1 /wp/wp-json/Batch/v1 |
| 188 | POST | HTTP/1.1 /wp/index.php?rest_route=%2Fbatch%2Fv1 |
| 188 | POST | HTTP/1.1 /wp/?rest_route=/batch/v1 |
| 188 | GET | HTTP/1.1 /app/.env |
| 188 | POST | HTTP/1.1 /wp/index.php?rest_route=/batch/v1 |
| 188 | POST | HTTP/1.1 /wp/?rest_route=%2Fbatch%2Fv1 |
| 186 | GET | HTTP/1.1 /phpinfo.php |
| 185 | GET | HTTP/1.0 /admin/config.php |
| 185 | POST | HTTP/1.1 /index.php?rest_route=%2Fbatch%2Fv1 |
| 183 | GET | HTTP/1.1 /.env.example |
| 181 | POST | HTTP/1.1 /wp-json/batch/v1/ |
| 181 | POST | HTTP/1.1 //wp-json/batch/v1 |
| 181 | GET | HTTP/1.1 /laravel/.env |
| 179 | POST | HTTP/1.1 /wordpress/index.php?rest_route=/batch/v1 |
| 179 | GET | HTTP/1.1 /admin/.env |
| 179 | POST | HTTP/1.1 /wp-json/Batch/v1 |
| 178 | POST | HTTP/1.1 /wordpress/index.php?rest_route=%2Fbatch%2Fv1 |
| 178 | POST | HTTP/1.1 /wordpress/?rest_route=/batch/v1 |
| 178 | POST | HTTP/1.1 /wordpress/?rest_route=/batch%2Fv1 |
| 178 | POST | HTTP/1.1 /wordpress/?rest_route=%2Fbatch%2Fv1 |
| 177 | POST | HTTP/1.1 /wordpress/wp-json/Batch/v1 |
| 177 | POST | HTTP/1.1 /wordpress/wp-json/batch/v1/ |
| 177 | POST | HTTP/1.1 /wordpress//wp-json/batch/v1 |
| 177 | POST | HTTP/1.1 /wordpress/blog/wp-json/batch/v1 |
| 177 | POST | HTTP/1.1 /wordpress/wordpress/wp-json/batch/v1 |
| 176 | GET | HTTP/1.1 /backend/.env |
| 173 | POST | HTTP/1.1 /signup |
| 172 | GET | HTTP/1.1 /config.json |
| 170 | GET | HTTP/1.1 /web/.env |
| 165 | GET | HTTP/1.1 /app-ads.txt |
| 163 | GET | HTTP/1.1 /.env.development |
| 162 | GET | HTTP/1.1 /src/.env |
| 162 | GET | HTTP/1.1 /.env.old |
| 161 | GET | HTTP/1.1 /config/.env |
| 159 | GET | HTTP/1.1 /server/.env |
| 158 | POST | HTTP/1.1 /signin |
| 154 | POST | HTTP/1.1 /blog/index.php?rest_route=/batch/v1 |
| 154 | GET | HTTP/1.1 /.aws/credentials |
| 153 | POST | HTTP/1.1 /blog/wp-json/batch/v1/ |
| 153 | POST | HTTP/1.1 /blog/?rest_route=/batch/v1 |
| 153 | POST | HTTP/1.1 /blog//wp-json/batch/v1 |
| 153 | POST | HTTP/1.1 /blog/wp-json/Batch/v1 |
| 153 | POST | HTTP/1.1 /blog/index.php?rest_route=%2Fbatch%2Fv1 |
| 153 | POST | HTTP/1.1 /blog/blog/wp-json/batch/v1 |
| 153 | POST | HTTP/1.1 /blog/?rest_route=%2Fbatch%2Fv1 |
| 153 | POST | HTTP/1.1 /blog/wordpress/wp-json/batch/v1 |
| 153 | POST | HTTP/1.1 /blog/?rest_route=/batch%2Fv1 |
| 152 | POST | HTTP/1.1 /account |
| 152 | GET | HTTP/1.1 /core/.env |
| 150 | GET | HTTP/1.1 /staging/.env |
| 149 | GET | HTTP/1.1 /dev/.env |
| 147 | GET | HTTP/1.1 /wp-admin/ |
| 146 | GET | HTTP/1.1 /info.php |
| 143 | GET | HTTP/1.1 /.env.staging |
| 143 | GET | HTTP/1.1 /v2/.env |
| 140 | GET | HTTP/1.1 /public/.env |
| 138 | GET | HTTP/1.1 /.git/HEAD |
| 137 | GET | HTTP/1.1 /old/.env |
| 136 | GET | HTTP/1.1 /SDK/webLanguage |
| 131 | GET | HTTP/1.1 /v1/.env |
| 131 | GET | HTTP/1.1 /appsettings.json |
| 131 | GET | HTTP/1.1 /config.js |
| 130 | GET | HTTP/1.1 /_profiler/phpinfo |
| 130 | GET | HTTP/1.1 /docker-compose.yml |
| 129 | GET | HTTP/1.1 /.env.test |
| 129 | GET | HTTP/1.1 /wp-config.php.bak |
| 128 | POST | HTTP/1.1 /dashboard |
| 127 | GET | HTTP/1.1 /frontend/.env |
| 123 | GET | HTTP/1.1 /application/.env |
| 123 | GET | HTTP/1.1 /config.env |
| 123 | POST | HTTP/1.1 /auth/callback |
| 121 | POST | HTTP/1.1 /api/auth/signin |
| 119 | POST | HTTP/1.1 /login |
| 118 | GET | HTTP/1.1 /env |
| 118 | POST | HTTP/1.1 /admin |
| 118 | GET | HTTP/1.1 /credentials.json |
| 118 | GET | HTTP/1.1 /apps/.env |
| 117 | POST | HTTP/1.1 /register |
| 112 | GET | HTTP/1.1 /.env.swp |
| 111 | GET | HTTP/1.1 /cms/.env |
| 110 | GET | HTTP/1.1 /post/wp-login.php |
| 110 | GET | HTTP/1.1 /.gitlab-ci.yml |
| 110 | GET | HTTP/1.1 /client/.env |
| 108 | GET | HTTP/1.1 /.env.sample |
| 107 | GET | HTTP/1.1 /.env.php |
| 107 | POST | HTTP/1.1 / |
| 107 | GET | HTTP/1.1 /.env.docker |
| 105 | GET | HTTP/1.1 /backup/.env |
| 100 | GET | HTTP/1.1 /prod/.env |
| 100 | GET | HTTP/1.1 /production/.env |
| 100 | GET | HTTP/1.1 /.env~ |
| 99 | GET | HTTP/1.1 /test/.env |
| 98 | GET | HTTP/1.1 /.env.live |
| 98 | GET | HTTP/1.1 /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 96 | GET | HTTP/1.1 /actuator/env |
| 96 | GET | HTTP/1.1 /.aws/config |
| 94 | GET | HTTP/1.1 /test.php |
| 93 | GET | HTTP/1.1 /crm/.env |
| 92 | GET | HTTP/1.1 /sendgrid.env |
| 90 | GET | HTTP/1.1 /.git-credentials |
| 90 | GET | HTTP/1.1 /.env.json |
| 90 | GET | HTTP/1.1 /.docker/config.json |
| 88 | GET | HTTP/1.1 /database.sql |
| 87 | GET | HTTP/1.1 /html/.env |
| 86 | POST | HTTP/1.1 /wp-admin/admin-ajax.php |
| 86 | GET | HTTP/1.1 /.env.dist |
| 85 | GET | HTTP/1.1 /appsettings.Production.json |
| 84 | GET | HTTP/1.1 /env.json |
| 83 | GET | HTTP/1.1 /config/.env.php |
| 83 | GET | HTTP/1.1 /.env.php.bak |
| 82 | GET | HTTP/1.1 /storage/logs/laravel.log |
| 82 | GET | HTTP/1.1 /env.js |
| 82 | GET | HTTP/1.1 /login |
| 80 | GET | HTTP/1.1 /public_html/.env |
| 80 | GET | HTTP/1.1 /v3/.env |
| 79 | GET | HTTP/1.1 /appsettings.Development.json |
| 78 | GET | HTTP/1.1 /www/.env |
| 78 | GET | HTTP/1.1 /settings.json |
| 78 | GET | HTTP/1.1 /actuator/configprops |
| 77 | GET | HTTP/1.1 /portal/.env |
| 77 | GET | HTTP/1.1 /.env.stage |
| 77 | GET | HTTP/1.1 /settings.py |
| 76 | GET | HTTP/1.1 /wp-config.php.old |
| 76 | GET | HTTP/1.1 /site/.env |
| 75 | GET | HTTP/1.1 /phpinfo |
| 75 | GET | HTTP/1.1 /config.yaml |
| 74 | POST | HTTP/1.1 /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input |
| 74 | GET | HTTP/1.1 /.docker/.env |
| 74 | GET | HTTP/1.1 /new/.env |
| 74 | GET | HTTP/1.1 /.github/workflows/deploy.yml |
| 73 | GET | HTTP/1.1 /vendor/phpunit/src/Util/PHP/eval-stdin.php |
| 73 | GET | HTTP/1.1 /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php |
| 73 | GET | HTTP/1.1 /storage/.env |
| 73 | GET | HTTP/1.1 /vendor/phpunit/Util/PHP/eval-stdin.php |
| 73 | GET | HTTP/1.1 /wp-content/plugins/hellopress/wp_filemanager.php |
| 73 | GET | HTTP/1.1 /application.yml |
| 73 | GET | HTTP/1.1 /this_is_a_new_hello_world.php |
| 72 | GET | HTTP/1.1 /secrets.env |
| 72 | GET | HTTP/1.1 /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /phpunit/phpunit/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /lib/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /phpunit/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /index.php?lang=../../../../../../../../tmp/index1 |
| 72 | GET | HTTP/1.1 /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /id_rsa |
| 72 | GET | HTTP/1.1 /ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /lib/phpunit/Util/PHP/eval-stdin.php |
| 72 | POST | HTTP/1.1 /fetch |
| 72 | GET | HTTP/1.1 /lib/phpunit/phpunit/Util/PHP/eval-stdin.php |
| 72 | GET | HTTP/1.1 /vendor/phpunit/phpunit/LICENSE/eval-stdin.php |
| 72 | GET | HTTP/1.1 /lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
![[商品価格に関しましては、リンクが作成された時点と現時点で情報が変更されている場合がございます。]](https://hbb.afl.rakuten.co.jp/hgb/52643321.2dfd8e5e.52643322.d29efbe7/?me_id=1213310&item_id=21641991&pc=https%3A%2F%2Fthumbnail.image.rakuten.co.jp%2F%400_mall%2Fbook%2Fcabinet%2F3737%2F9784087213737_1_33.jpg%3F_ex%3D128x128&s=128x128&t=picttext "[商品価格に関しましては、リンクが作成された時点と現時点で情報が変更されている場合がございます。]")
![[商品価格に関しましては、リンクが作成された時点と現時点で情報が変更されている場合がございます。]](https://hbb.afl.rakuten.co.jp/hgb/52643321.2dfd8e5e.52643322.d29efbe7/?me_id=1213310&item_id=21752483&pc=https%3A%2F%2Fthumbnail.image.rakuten.co.jp%2F%400_mall%2Fbook%2Fcabinet%2F2123%2F9784798192123_1_137.jpg%3F_ex%3D128x128&s=128x128&t=picttext "[商品価格に関しましては、リンクが作成された時点と現時点で情報が変更されている場合がございます。]")