检测到 URI Encoded 响应.Write Web Shell Command or ASP Injection_111.14.219.164_soar
关联分析规则:攻击成功告警详情同步
威胁信息:检测到 URI Encoded 响应.Write Web Shell Command or ASP Injection
源地址:111.14.219.164
目的地址:dmz.16.27.32
国家:未知
城市:济南市
威胁特征:特征1:"Response.Write("
请求信息:
GET /eportal/uiFramework/huilan-jquery-ui/js/huilan-jquery-ui.js?self=Response.Write(8-9999108099999)Response.Write(8-9999108099999)&skin=default&random=15634 HTTP/1.1
Host: www.sdrcu.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; rv 11.0) like Gecko
Accept: /
Accept-Encoding: gzip,deflate
Cookie: JSESSIONID=14A17910D75D77483452D1799DFD73D3;BIGipServerpool_oportal_ap_7088=!xoge/nyTnrRWZS8TF7YXYUJzE1lDsf7jgbnzZXvg2d/v51Au28RaGwclF9hzwVhpNKb5uOddB8+wrw==;BIGipServerpool_oportal_web_7099=!chiGSj+Py5cpWUZZvUwc8o53CerdpWa67Vih9IQqElG/SD0RXOl0t3y5cuzQFMimyBjtfKmLV8zF6g==;
Connection: Keep-alive
Via: 1.1 ID-0016035512643552 uproxy-3
X-Forwarded-For: 111.14.219.164
返回信息:
HTTP/1.1 200
Date: Mon, 10 Mar 2025 13:19:36 GMT
Content-Type: application/x-javascript;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ETag: W/"170617-1713850962000"
Last-Modified: Tue, 23 Apr 2024 05:42:42 GMT
X-Frame-Options: SAMEORIGIN
Content-Encoding: gzip
.....items : [ 'Source', '-', 'DocProps', 'Print', '-' ]
......},
......{
.......name : 'clipboard',
.......items : [ 'PasteText', 'PasteFromWord', '-',
.........'Undo', 'Redo', '-' ]
......},
......{
.......name : 'editing',
.......items : [ 'Find', 'Replace', '-', 'SelectAll' ]
......},
......{
.......name : 'insert',
.......items : [ 'Image', 'Flash', 'Table',
.........'HorizontalRule', '-' ]
......},
......// '/',
......{
.......name : 'basicstyles',
.......items : [ 'Bold', 'Italic', 'Underline', 'Strike',
.........'-', 'RemoveFormat' ]
......},
......{
.......name : 'paragraph',
.......items : [ 'JustifyLeft', 'JustifyCenter',
.........'JustifyRight', 'JustifyBlock', '-' ]
......}, {
.......name : 'links',
.......items : [ 'Link', 'Unlink', '-' ]
......},
......// 'textindent','textoutdent','textIndentAll','delAllFirstSpaces','delEmptyP','changetext'
......// '/',
......{
.......name : 'styles',
.......items : [ 'Font', 'FontSize', '-' ]
......}, {
.......name : 'colors',
.......items : [ 'TextColor', 'BGColor', '-' ]
......}, {
.......name : 'tools',
.......items : [ 'ShowBlocks' ]
......} ]
...});
.return ckeditor;
}
function getMyCkEditor(id, array, has
这是攻击吗?
最新发布