WebShell and Threat Intelligence

来源:互联网 发布:渠道管控管理系统源码 编辑:程序博客网 时间:2024/05/17 07:00

Webshell

Good image, hope it could be useful for u.

And then, four points you need to pay a little attention:

  1. Traffic monitor

    • ”CaiDao” ‘s payload are all in request body.
    • “Weevely“‘s payload are all in cookie and spreate to make up again.
  2. File moitor

    • Always include system method
    • Encrypt is very common
  3. Attack origin

    • Tor network , proxy server is the common attack origin.
    • Night is the high frequency time
    • Someone do batch scan at night, unexpectedly it work.
  4. Attack method

    • Web leak and config issue occupy more.
    • One sentence Webshell and rebound shell occupy more.

Finally :

Created with Raphaël 2.1.0Threat IntelligenceThreat IntelligenceWebshell MonitorWebshell MonitorDefender websiteDefender websiteSirpSirpAttacker featurewebshell feature.Analyze system leakEmergency measuresCommunity dataLeak database
原创粉丝点击