Web Application Attack
Signature: ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 1 ...
show moreWeb Application Attack
Signature: ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 1
Severity: high
alert http any any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 1"; flow:established,to_server; http.request_body; content:"name["; nocase; fast_pattern; pcre:"/(?:^|&|Content-Disposition[\x3a][^\n]*?name\s*?=\s*?[\x22\x27])name\[[^\x5d]*?\W/i"; reference:url,pastebin.com/F2Dk9LbX; classtype:web-application-attack; sid:2019422; rev:4;)
show less
Event Type: Web Application Attack
Signature: ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt ...
show moreEvent Type: Web Application Attack
Signature: ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 1
Severity: high
Source IP: 46.177.28.199
alert http any any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 1"; flow:established,to_server; http.request_body; content:"name["; nocase; fast_pattern; pcre:"/(?:^|&|Content-Disposition[\x3a][^\n]*?name\s*?=\s*?[\x22\x27])name\[[^\x5d]*?\W/i"; reference:url,pastebin.com/F2Dk9LbX; classtype:web-application-attack; sid:2019422; rev:4;;)
show less
Event Type: A Network Trojan was detected
Signature: ET WEB_SERVER Possible XXE SYSTEM ENTITY in PO ...
show moreEvent Type: A Network Trojan was detected
Signature: ET WEB_SERVER Possible XXE SYSTEM ENTITY in POST BODY.
Severity: high
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible XXE SYSTEM ENTITY in POST BODY."; flow:established,to_server; content:"ENTITY"; nocase; pcre:"/^\s+?[^\s\>]+?\s+?SYSTEM\s/Ri"; http.request_body; content:"DOCTYPE"; nocase; fast_pattern; content:"SYSTEM"; nocase; classtype:trojan-activity; sid:2018056; rev:4;)
show less
Event Type: A Network Trojan was detected
Signature: ET WEB_SERVER WebShell Generic - ASP File Uplo ...
show moreEvent Type: A Network Trojan was detected
Signature: ET WEB_SERVER WebShell Generic - ASP File Uploaded
Severity: high
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER WebShell Generic - ASP File Uploaded"; flow:established,to_server; http.request_body; content:"|0D 0A|"; content:"<%"; within:5; fast_pattern; content:"%>"; distance:0; pcre:"/<%[\x00-\x7f]{20}/"; classtype:trojan-activity; sid:2017260; rev:12;)
show less
Event Type: Web Application Attack
Signature: ET WEB_SERVER PHP tags in HTTP POST
Severity: high
...
show moreEvent Type: Web Application Attack
Signature: ET WEB_SERVER PHP tags in HTTP POST
Severity: high
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SERVER PHP tags in HTTP POST"; flow:established,to_server; http.method; content:"POST"; nocase; http.request_body; content:"<?php"; nocase; fast_pattern; reference:url,isc.sans.edu/diary.html?storyid=9478; classtype:web-application-attack; sid:2011768; rev:8;)
show less
Event Type: A Network Trojan was detected
Signature: ET WEB_SERVER Possible XXE SYSTEM ENTITY in PO ...
show moreEvent Type: A Network Trojan was detected
Signature: ET WEB_SERVER Possible XXE SYSTEM ENTITY in POST BODY.
Severity: high
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible XXE SYSTEM ENTITY in POST BODY."; flow:established,to_server; content:"ENTITY"; nocase; pcre:"/^\s+?[^\s\>]+?\s+?SYSTEM\s/Ri"; http.request_body; content:"DOCTYPE"; nocase; fast_pattern; content:"SYSTEM"; nocase; classtype:trojan-activity; sid:2018056; rev:4;)
show less
Event Type: Web Application Attack
Signature: ET WEB_SERVER Possible Attempt to Get SQL Server Vers ...
show moreEvent Type: Web Application Attack
Signature: ET WEB_SERVER Possible Attempt to Get SQL Server Version in URI using SELECT VERSION
Severity: high
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER Possible Attempt to Get SQL Server Version in URI using SELECT VERSION"; flow:established,to_server; http.uri; content:"SELECT"; nocase; content:"VERSION"; nocase; distance:1; reference:url,support.microsoft.com/kb/321185; reference:url,doc.emergingthreats.net/2011037; classtype:web-application-attack; sid:2011037; rev:6;)
show less
Event Type: A Network Trojan was detected
Signature: ET WEB_SERVER WebShell Generic - ASP File Uplo ...
show moreEvent Type: A Network Trojan was detected
Signature: ET WEB_SERVER WebShell Generic - ASP File Uploaded
Severity: high
Source IP: 193.92.71.169
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER WebShell Generic - ASP File Uploaded"; flow:established,to_server; http.request_body; content:"|0D 0A|"; content:"<%"; within:5; fast_pattern; content:"%>"; distance:0; pcre:"/<%[\x00-\x7f]{20}/"; classtype:trojan-activity; sid:2017260; rev:12;)
show less
Event Type: Web Application Attack
Signature: ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt ...
show moreEvent Type: Web Application Attack
Signature: ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 1
Source IP: 89.210.58.156
alert http any any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Possible CVE-2014-3704 Drupal SQLi attempt URLENCODE 1"; flow:established,to_server; http.request_body; content:"name["; nocase; fast_pattern; pcre:"/(?:^|&|Content-Disposition[\x3a][^\n]*?name\s*?=\s*?[\x22\x27])name\[[^\x5d]*?\W/i"; reference:url,pastebin.com/F2Dk9LbX; classtype:web-application-attack; sid:2019422; rev:4;)
show less
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Possible JBoss/JMX Invo ...
show morealert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Possible JBoss/JMX InvokerServlet Auth Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/invoker/JMXInvokerServlet/"; nocase; reference:cve,CVE-2007-1036; reference:url,exploit-db.com/exploits/21080/; classtype:web-application-attack; sid:2015747; rev:4;)
show less
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Apache Struts Possible OGNL Java ...
show morealert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Apache Struts Possible OGNL Java Exec In URI"; flow:to_server,established; http.uri; content:"java.lang.Runtime@getRuntime().exec("; nocase; classtype:attempted-user; sid:2016953; rev:4;)
show less
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER /bin/sh In URI Possible Shell ...
show morealert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER /bin/sh In URI Possible Shell Command Execution Attempt"; flow:established,to_server; http.uri; classtype:web-application-attack
show less
Attempted User Privilege Gain/ Attempted Information Leak. alert http $EXTERNAL_NET any -> $HTTP_SER ...
show moreAttempted User Privilege Gain/ Attempted Information Leak. alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Apache Struts Possible OGNL Java Exec In URI"; flow:to_server,established; http.uri; content:"java.lang.Runtime@getRuntime().exec("; nocase; classtype:attempted-user; sid:2016953; rev:4; metadata:created_at 2013_05_31, updated_at 2020_04_24;)
show less
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER allow_url_include PHP config o ...
show morealert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SERVER allow_url_include PHP config option in uri"; flow:established,to_server; http.uri; content:"allow_url_include"; fast_pattern; pcre:"/\ballow_url_include\s*?=/"; reference:url,seclists.org/fulldisclosure/2013/Jun/21; classtype:trojan-activity; sid:2016977; rev:5; metadata:created_at 2013_06_06, updated_at 2020_09_18;)
show less
alert ip [37.187.118.150,37.19.70.111,37.211.15.116,37.211.15.64,37.211.67.18,37.211.93.169,37.216.2 ...
show morealert ip [37.187.118.150,37.19.70.111,37.211.15.116,37.211.15.64,37.211.67.18,37.211.93.169,37.216.200.159,37.221.214.203,37.229.146.160,37.230.79.168,37.239.44.38,37.239.47.202,37.46.16.126,37.46.16.67,37.59.165.80,37.59.165.81,37.59.165.82,37.59.165.83,37.59.165.84,37.59.165.85,37.59.165.86,37.59.165.87,37.59.165.88,37.59.165.89,37.59.165.90,37.59.165.91,37.59.165.92,37.59.165.93,37.59.165.94,37.59.165.95,37.59.33.174,37.59.46.180,37.60.225.99,37.60.228.103,37.60.245.27,37.6.246.30,37.61.219.143,37.97.149.84,37.98.159.217,37.99.159.147,38.132.109.106,38.132.109.112,38.132.109.122,38.132.109.165,38.132.109.168,38.132.109.170,38.140.236.91,38.159.53.18,38.178.107.145,38.183.32.76] any -> $HOME_NET any (msg:"ET CINS Active Threat Intelligence Poor Reputation IP group 36"; reference:url,www.cinsscore.com; threshold: type limit, track by_src, seconds 3600, count 1; classtype:misc-attack; sid:2403335; rev:97799; metadata:affected_product Any, attack_target Any, deployment Perimeter, tag CINS, signature_severity M
show less
alert http [any,![139.59.152.243,164.90.224.231]] any -> 188.117.216.231 any (msg:"ET INFO Apache S ...
show morealert http [any,![139.59.152.243,164.90.224.231]] any -> 188.117.216.231 any (msg:"ET INFO Apache Solr System Information Request"; flow:established,to_server; http.uri; content:"/solr/admin/info/system"; reference:url,www.exploit-db.com/exploits/47572; reference:url,web.archive.org/web/20190718141548/https://www.agarri.fr/blog/archives/2013/11/27/compromising_an_unreachable_solr_server_with_cve-2013-6397/index.html; classtype:web-application-activity; sid:4001419; rev:1; metadata:affected_product Apache_Solr, attack_target Web_Server, created_at 2021_01_08, deployment Perimeter, signature_severity Informational, updated_at 2023_05_02;)
show less
alert dns $HOME_NET any -> any any (msg:"ET EXPLOIT_KIT Balada Domain in DNS Lookup (linetoslice .co ...
show morealert dns $HOME_NET any -> any any (msg:"ET EXPLOIT_KIT Balada Domain in DNS Lookup (linetoslice .com)"; dns.query; dotprefix; content:".linetoslice.com"; nocase; endswith; reference:url,blog.sucuri.net/2024/01/thousands-of-sites-with-popup-builder-compromised-by-balada-injector.html; classtype:exploit-kit; sid:2057108; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2024_10_28, deployment Perimeter, malware_family BALADA, performance_impact Low, confidence High, signature_severity Minor, tag Exploit_Kit, tag compromised_website, updated_at 2024_10_28;)
show less
DNS PoisoningHacking
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.