面试之流量特征整理
原创
繁星01
繁星01
安全君呀
2026年1月3日 17:45
北京
在小说阅读器读本章
去阅读
扫描器
useragent
agent:\"useragent\"，根据这个来判断扫描者IP
WEB访问
通用型：
uri:\"*spy.php\" AND data:fileuri:\"*spy.aspx\" AND data:fileuri:\"*.ashx\" AND data:fileuri:”*.asa” OR uri:”*.cer” OR uri:”*.cer” OR uri:”*.cdx”uri:”*spy.jsp”
菜刀php
data:\"z0\" AND method:\"POST\"data:\"z0\" AND method:\"GET\"data:\"base64_decode\" OR data:\"eval\" OR data:\"z1\" OR data:\"z0\" AND method:\"POST\"data:\"base64_decode\"OR data:\"eval\"OR data:\"z1\"OR data:\"z0\"AND method:\"GET\"
菜刀aspx
data:\"Response.Write\"AND method:\"POST\"AND uri:\"aspx\"
菜刀jsp
data:\"z0\"AND data:\"z1\"AND method:\"POST\"AND uri:jsp
data:\"z0=GB2312\"
Jspspy
data:\"o=fileList\"OR data:\"o=filelist&folder=\"OR data:\"o=vConn\"
url:\"o=vLogin\"OR data:\"o=login\"
(data:\"base64_decode\"AND method:\"POST\") OR (data:\"Response.Write\"AND method:\"POST\"AND uri:\"aspx\") OR (data:\"z0\"AND data:\"z1\"AND method:\"POST\"AND uri:jsp) OR (data:\"z0=GB2312\") OR (data:\"o=fileList\"OR data:\"o=filelist&folder=\"OR data:\"o=vConn\")
ImageMagick
data:\"push graphic-context\"
data:\"viewbox 0 0 640 480\"
SQL注入
uri:\"select\"OR data:\"select\"OR cookie:\"select\" 或者useraget字段
sqlmap
agent:\"sqlmap\"
上传漏洞
data:\"Content-Disposition\" AND (data:\"php\" OR data:\"asp\" OR data:\"aspx\" OR data:\"jsp\" OR data:”asa” OR data:”cer” OR data:”cdx” OR data:”*.*;*.*”)
Struts2漏洞
data:\"redirect\\%3A\"
uri:\"redirect:\"
data:\"method:%23_memberAccess\" OR uri:\"method:%23_memberAccess\"
数据库操作
sql_info:(\"/etc/passwd\"OR administrator OR whoami OR xp_cmdshell OR backup OR db_name OR\"@version\"OR load_file OR outfile OR dumpfile OR udf OR\"UTL_INADDR.get_host_address\"OR UTL_INADDR OR get_host_address OR\"UTL_HTTP.request\"OR UTL_HTTP OR request OR\"from dual\"OR\"v$version\"OR\"v_$version\")
cmd /c taskkill /f /im install.exe&taskkill /f /im 360safe.exe&taskkill /f /im 360sd.exe&taskkill /f /im 360rp.exe&taskkill /f /im 360rps.exe&taskkill /f /im 360tray.exe&taskkill /f /im ZhuDongFangYu.exe
通用
sql_info:\"/etc/passwd\"
sql_info:administrator
sql_info:whoami
mssql恶意行为
sql_info:xp_cmdshell
sql_info:backup
sql_info:db_name
sql_info:\"@version\"
mysql恶意行为：
sql_info:load_file
sql_info:outfile
sql_info:dumpfile
sql_info:udf
ORACLE恶意行为
sql_info:\"UTL_INADDR.get_host_address\"
sql_info:UTL_INADDR
sql_info:get_host_address
sql_info:\"UTL_HTTP.request\"
sql_info:UTL_HTTP
sql_info:request
sql_info:\"from dual\"
sql_info:\"v$version\"
sql_info:\"v_$version\"
POSTGREPSQL恶意行为
sql_info:COPY
DB2
sql_info:\"syscat.tabauth\"
sql_info:tabauth
登陆行为
查看是否有服务被爆破成功
先搜索
proto:mysqlANDinfo:failed
勾选 SIP，然后查看排名最高的IP，观察时间间隔，如果发包间隔极短，即可判断为爆破，记录爆破 IP，然后搜索
NOT (info:failedORinfo:530)ANDsip:进行过爆破的 IP
或
sip:进行过爆破的IPANDinfo:success （上面的更好）
如果有记录，说明有 mysql账户被成功爆破
邮箱同理
(info:530ORinfo:failed)AND (proto:popORproto:imapORproto:smtp)
也可以直接搜索
info:fail*
查看其它被爆破的协议， FTP之类
搜索非 mysql和邮箱协议
(info:530ORinfo:failed)ANDNOT (proto:popORproto:imapORproto:smtpORproto:mysql)
邮件行为
搜索附件中类似 xxx.doc.exe的文件
attachment.name:\"*.exe\"
邮件行为
attachment.name:(\"*.exe\"OR\"rar\"OR\"zip\"OR\"scr\"OR\"js\")
attachment.name:(\"*.exe\"OR\"rar\"OR\"zip\"OR\"scr\"OR\"js\") AND subject:(\"Bill\"OR\"Financial documents\"OR\"Health Insurance\"OR\" Flight tickets\"OR\" Transactions\"OR\"Credit Card Details\"OR\" Thank you very much\"OR\"\")
勒索邮件
attachment.name:(\"*.exe\"OR\"rar\"OR\"zip\"OR\"scr\"OR\"js\"OR\"doc\"OR\"xls\"OR\"ppt\"OR\"chm\"OR\"bat\") AND _exists_:\"attachment\"AND subject:(\"Flight tickets\"OR\"Fax transmission\"OR\"Transactions\"OR\"New Doc\"OR\"sales orders \"OR\"Scan\"OR\"Document from\"OR\"unauthorized access\"OR\"Bill\"OR\"Financial documents\"OR\"Health Insurance\"OR\"Credit Card Details\"OR\" Thank you very much\"OR\"Payment Processing Problem\"OR\"Due invoice payment\"OR\"Order Receipt\"OR\"Amount Payable\"OR\"Parcel Certificate\"OR\"a image for you\"OR\"Payment Confirmation\")
搜索IP范围
sip:[\"172.24.20.110\" TO \"172.24.20.140\"]
内网IP：
sip:([\"10.0.0.0\" TO \"10.255.255.255\"] OR [\"100.64.0.0\" TO \"100.127.255.255\"] OR [\"172.16.0.0\" TO \"172.31.255.255\"] OR [\"192.168.0.0\" TO \"192.168.255.255\"])
info:fail* AND sip:([\"10.0.0.0\" TO \"10.255.255.255\"] OR [\"100.64.0.0\" TO \"100.127.255.255\"] OR [\"172.16.0.0\" TO \"172.31.255.255\"] OR [\"192.168.0.0\" TO \"192.168.255.255\"]) NOT dip:([\"10.0.0.0\" TO \"10.255.255.255\"] OR [\"100.64.0.0\" TO \"100.127.255.255\"] OR [\"172.16.0.0\" TO \"172.31.255.255\"] OR [\"192.168.0.0\" TO \"192.168.255.255\"])
版权声明
本站仅做备份收录，仅供研究与教学参考之用。
读者将信息用于其他用途的，全部法律及连带责任由读者自行承担，本站不承担任何责任。
评论