Upgrade to Pro — share decks privately, control downloads, hide ads and more …

ハニーポットで集める攻撃手法-seccamp2016

junk_coken
August 10, 2016

 ハニーポットで集める攻撃手法-seccamp2016

seccamp2016チューター成果報告-CTF妨害コンテンツ

junk_coken

August 10, 2016
Tweet

More Decks by junk_coken

Other Decks in Technology

Transcript

  1. IP - - [日時] "GET /feed/ HTTP/1.1" 200 17309 "-"

    "-" "-" "-" IP - - [日時] “POST /xmlrpc.php HTTP/1.0” 499 0 “<?xmlversion=¥x221.0¥x22?><methodCall> <methodName>pingback.ping</methodName><params><param> <value><string>攻撃対象のURL</string></value></param> <param><value><string>記事URL</string></value></param> </params></methodCall>" IP - - [日時] "POST /xmlrpc.php HTTP/1.0" 499 0 "<?xmlversion=¥x221.0¥x22?><methodCall> <methodName>pingback.ping</methodName><params><param> <value><string>攻撃対象のURL</string></value></param> <param><value><string>記事URL</string></value></param> </params></methodCall>"
  2. IP - - [日時] "GET //wp-login.php HTTP/1.1" 200 2746 "-"

    "-" IP - - [日時] "GET /?author=1 HTTP/1.1" 200 23660 "-" "-“ IP - - [日時] "GET /?author=2 HTTP/1.1" 404 7444 "-" "-" "-" IP - - [日時] "POST //wp-login.php HTTP/1.1" 200 3732 "-" "log=user&pwd=219&wp-submit=Login& redirect_to=http://URL/wp-admin/&testcookie=1¥x0D¥x0A" IP - - [日時] "POST //wp-login.php HTTP/1.1" 200 3732 "-" "log=user&pwd=admin&wp-submit=Login& redirect_to=http://URL/wp-admin/&testcookie=1¥x0D¥x0A" IP - - [日時] "POST //wp-login.php HTTP/1.1" 200 3732 "-" "-" "log=user&pwd=admin123&wp-submit=Login& redirect_to=http://URL/wp-admin/&testcookie=1¥x0D¥x0A"
  3. Cowrie –国別TOP10 CN 49% US 12% RU 7% VN 6%

    FR 5% KR 5% IN 5% JP 4% UA 4% NL 3% CN US RU VN FR KR IN JP UA NL