API tools faq
paste
Advertisement
danrancan

Modsec Log #2 for Jetpack Debug Test

danrancan
Mar 12th, 2025
246
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 68.94 KB | None | 0 0
raw download clone embed print report
  1. ---AJ1GOJrx---A--
  2. [12/Mar/2025:22:21:11 -0500] 174183607127.350869 192.0.99.205 38698 10.10.10.2 443
  3. ---AJ1GOJrx---B--
  4. POST /?for=jetpack&jetpack=comms&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836071&nonce=SSMkiDw6c4&body-hash=pdst%2B%2B8gjpsEsdzTGdS19%2BYN3g4%3D&signature=NmIh7Zx3wP3Fr%2Bh29C1eamXKANs%3D HTTP/1.1
  5. Host: danran.rocks
  6. Authorization: X_JETPACK token="P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0" timestamp="1741836071" nonce="SSMkiDw6c4" body-hash="pdst++8gjpsEsdzTGdS19+YN3g4=" signature="NmIh7Zx3wP3Fr+h29C1eamXKANs="
  7. User-Agent: Jetpack by WordPress.com
  8. Accept: */*
  9. Accept-Encoding: deflate, gzip, br, zstd
  10. Referer: https://danran.rocks/?for=jetpack&jetpack=comms&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836071&nonce=SSMkiDw6c4&body-hash=pdst%2B%2B8gjpsEsdzTGdS19%2BYN3g4%3D&signature=NmIh7Zx3wP3Fr%2Bh29C1eamXKANs%3D
  11. Content-Type: text/xml
  12. Connection: close
  13. Content-Length: 114
  14.  
  15. ---AJ1GOJrx---C--
  16. <?xml version="1.0"?>
  17. <methodCall>
  18. <methodName>jetpack.testConnection</methodName>
  19. <params>
  20. </params></methodCall>
  21.  
  22. ---AJ1GOJrx---E--
  23. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  24.  
  25. ---AJ1GOJrx---F--
  26. HTTP/1.1 403
  27. Server: nginx
  28. Date: Thu, 13 Mar 2025 03:21:11 GMT
  29. Content-Length: 146
  30. Content-Type: text/html
  31. X-Content-Type-Options: nosniff
  32. Connection: close
  33. X-XSS-Protection: 1; mode=block
  34. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  35. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  36. Referrer-Policy: no-referrer-when-downgrade
  37. x-frame-options: SAMEORIGIN
  38.  
  39. ---AJ1GOJrx---H--
  40. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:[\n\r;`\{]|\|\|?|&&?)[\s\v]*[\s\v\"'-\(,@]*(?:[\"'\.-9A-Z_a-z]+/|(?:[\"'\x5c\^]*[0-9A-Z_a-z][\"'\x5c\^]*:.*|[ \"'\.-9A-Z\x5c\^-_a-z]*)\x5c)?[\"\^]*(?:a[\"\^]*(?:s[\"\^]*s[\"\^]*o[\"\^]*c|t[\"\^ (7601 characters omitted)' against variable `XML:/*' (Value: `\x0ajetpack.testConnection\x0a\x0a' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "815"] [id "932380"] [rev ""] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: \x0ajetpack.testConnection found within XML:/*: \x0ajetpack.testConnection\x0a\x0a"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607127.350869"] [ref "o0,23"]
  41. ModSecurity: Warning. detected SQLi using libinjection. [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "46"] [id "942100"] [rev ""] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: nov&n found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607127.350869"] [ref "v39,36"]
  42. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)!=|&&|\|\||>[=->]|<(?:<|=>?|>(?:[\s\v]+binary)?)|\b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)\b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)\b|[0-9A-Z_a- (321 characters omitted)' against variable `ARGS:token' (Value: `P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "645"] [id "942120"] [rev ""] [msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: && found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607127.350869"] [ref "o26,2v39,36t:utf8toUnicode,t:urlDecodeUni"]
  43. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607127.350869"] [ref ""]
  44.  
  45. ---AJ1GOJrx---J--
  46.  
  47. ---AJ1GOJrx---K--
  48.  
  49. ---AJ1GOJrx---Z--
  50.  
  51. ---WrySEHjs---A--
  52. [12/Mar/2025:22:21:11 -0500] 174183607159.400384 192.0.99.205 38706 10.10.10.2 443
  53. ---WrySEHjs---B--
  54. POST /?for=jetpack&jetpack=comms&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836071&nonce=jpr8UAIOQq&body-hash=l5MGKDtBMCRLlbhRxcm3udBaUGk%3D&signature=R9NP12tSJIHfqs%2F6s03juUc%2BHXs%3D HTTP/1.1
  55. Host: danran.rocks
  56. Authorization: X_JETPACK token="P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0" timestamp="1741836071" nonce="jpr8UAIOQq" body-hash="l5MGKDtBMCRLlbhRxcm3udBaUGk=" signature="R9NP12tSJIHfqs/6s03juUc+HXs="
  57. User-Agent: Jetpack by WordPress.com
  58. Accept: */*
  59. Accept-Encoding: deflate, gzip, br, zstd
  60. Referer: https://danran.rocks/?for=jetpack&jetpack=comms&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836071&nonce=jpr8UAIOQq&body-hash=l5MGKDtBMCRLlbhRxcm3udBaUGk%3D&signature=R9NP12tSJIHfqs%2F6s03juUc%2BHXs%3D
  61. Content-Type: text/xml
  62. Connection: close
  63. Content-Length: 110
  64.  
  65. ---WrySEHjs---C--
  66. <?xml version="1.0"?>
  67. <methodCall>
  68. <methodName>system.listMethods</methodName>
  69. <params>
  70. </params></methodCall>
  71.  
  72. ---WrySEHjs---E--
  73. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  74.  
  75. ---WrySEHjs---F--
  76. HTTP/1.1 403
  77. Server: nginx
  78. Date: Thu, 13 Mar 2025 03:21:11 GMT
  79. Content-Length: 146
  80. Content-Type: text/html
  81. X-Content-Type-Options: nosniff
  82. Connection: close
  83. X-XSS-Protection: 1; mode=block
  84. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  85. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  86. Referrer-Policy: no-referrer-when-downgrade
  87. x-frame-options: SAMEORIGIN
  88.  
  89. ---WrySEHjs---H--
  90. ModSecurity: Warning. detected SQLi using libinjection. [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "46"] [id "942100"] [rev ""] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: nov&n found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607159.400384"] [ref "v39,36"]
  91. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)!=|&&|\|\||>[=->]|<(?:<|=>?|>(?:[\s\v]+binary)?)|\b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)\b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)\b|[0-9A-Z_a- (321 characters omitted)' against variable `ARGS:token' (Value: `P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "645"] [id "942120"] [rev ""] [msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: && found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607159.400384"] [ref "o26,2v39,36t:utf8toUnicode,t:urlDecodeUni"]
  92. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `10' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607159.400384"] [ref ""]
  93.  
  94. ---WrySEHjs---J--
  95.  
  96. ---WrySEHjs---K--
  97.  
  98. ---WrySEHjs---Z--
  99.  
  100. ---zyfbUIXJ---A--
  101. [12/Mar/2025:22:21:12 -0500] 174183607296.212170 192.0.99.205 38720 10.10.10.2 443
  102. ---zyfbUIXJ---B--
  103. GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Ftest-wpcom%2F&timestamp=1741836072&url=https%3A%2F%2Fdanran.rocks&signature=mr0tX1lS6ZnpxdHuximC2IJod7aHtNLYL4NmnKgGEvyC6qaANKBCfMiTP4kQ4trDUPu3siCtUPxXx5DqiU21ur9HI38IrTcK%2FU7FGFEy8%2F8%2Fh7B56ecuuX0Y45Cb0MY3YsqIeumTqGfCkk0Pan5pAL%2BwyFt13A%2BSaslwP826Ubgxxz9IXsJ0nGcIbxG%2FIMNujdIMYcZFnHdBGAFHtl4L2skqs1Cbih7lbm9bEdYuDTZIKpWkXz5%2FDAaTrIKLNOQycfRKXv5n%2FrYqGp5ehsBwJI6Jsc0LK30fERwfeNxZUWmhv7fyBQomqvrn6LqnFSHGSV06maUFMSjjaClRK5uZHw%3D%3D HTTP/1.1
  104. Host: danran.rocks
  105. User-Agent: WordPress.com; https://jptools.wordpress.com
  106. Accept: */*
  107. Accept-Encoding: deflate, gzip, br, zstd
  108. Referer: https://danran.rocks/?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Ftest-wpcom%2F&timestamp=1741836072&url=https%3A%2F%2Fdanran.rocks&signature=mr0tX1lS6ZnpxdHuximC2IJod7aHtNLYL4NmnKgGEvyC6qaANKBCfMiTP4kQ4trDUPu3siCtUPxXx5DqiU21ur9HI38IrTcK%2FU7FGFEy8%2F8%2Fh7B56ecuuX0Y45Cb0MY3YsqIeumTqGfCkk0Pan5pAL%2BwyFt13A%2BSaslwP826Ubgxxz9IXsJ0nGcIbxG%2FIMNujdIMYcZFnHdBGAFHtl4L2skqs1Cbih7lbm9bEdYuDTZIKpWkXz5%2FDAaTrIKLNOQycfRKXv5n%2FrYqGp5ehsBwJI6Jsc0LK30fERwfeNxZUWmhv7fyBQomqvrn6LqnFSHGSV06maUFMSjjaClRK5uZHw%3D%3D
  109. Connection: close
  110.  
  111. ---zyfbUIXJ---E--
  112. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  113.  
  114. ---zyfbUIXJ---F--
  115. HTTP/1.1 403
  116. Server: nginx
  117. Date: Thu, 13 Mar 2025 03:21:12 GMT
  118. Content-Length: 146
  119. Content-Type: text/html
  120. X-Content-Type-Options: nosniff
  121. Connection: close
  122. X-XSS-Protection: 1; mode=block
  123. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  124. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  125. Referrer-Policy: no-referrer-when-downgrade
  126. x-frame-options: SAMEORIGIN
  127.  
  128. ---zyfbUIXJ---H--
  129. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:get /[^#\?]*(?:\?[^\s\v#]*)?(?:#[^\s\v]*)?|(?:connect (?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}\.?(?::[0-9]+)?|[\--9A-Z_a-z]+:[0-9]+)|options \*|[a-z]{3,10}[\s\v]+(?:[0-9A-Z_a-z]{3,7}?://[\--9A-Z_a-z]* (76 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Ftest-wpcom%2F&timestamp=1741836072&url=https%3A%2F%2 (397 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Ftest-wpcom%2F&timestamp=1741836072&url=https%3A%2F%2Fdanran.rocks&signature=mr0tX1lS6ZnpxdHuximC2IJod7aHtNLYL4NmnKgGEvyC6qaANKBCfMiTP4kQ4trDUPu3siCtUPxX (297 characters omitted)"] [severity "4"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607296.212170"] [ref "v0,497"]
  130. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `StrEq' with parameter `0' against variable `TX:MSC_PCRE_LIMITS_EXCEEDED' (Value: `1' ) [file "/etc/nginx/modsec/modsecurity.conf"] [line "147"] [id "200005"] [rev ""] [msg "ModSecurity internal error flagged: TX:MSC_PCRE_LIMITS_EXCEEDED"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607296.212170"] [ref ""]
  131.  
  132. ---zyfbUIXJ---J--
  133.  
  134. ---zyfbUIXJ---K--
  135.  
  136. ---zyfbUIXJ---Z--
  137.  
  138. ---UpW2XYvI---A--
  139. [12/Mar/2025:22:21:12 -0500] 174183607255.090224 192.0.99.205 38728 10.10.10.2 443
  140. ---UpW2XYvI---B--
  141. POST /?for=jetpack&jetpack=comms&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836072&nonce=rnyjBecJGN&body-hash=METbiCw%2BtMQdctk0fdLMNlXOKKM%3D&signature=17%2BXM5wmLeBsyr%2Fef9wx64v1zKg%3D HTTP/1.1
  142. Host: danran.rocks
  143. Authorization: X_JETPACK token="P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0" timestamp="1741836072" nonce="rnyjBecJGN" body-hash="METbiCw+tMQdctk0fdLMNlXOKKM=" signature="17+XM5wmLeBsyr/ef9wx64v1zKg="
  144. User-Agent: Jetpack by WordPress.com
  145. Accept: */*
  146. Accept-Encoding: deflate, gzip, br, zstd
  147. Referer: https://danran.rocks/?for=jetpack&jetpack=comms&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836072&nonce=rnyjBecJGN&body-hash=METbiCw%2BtMQdctk0fdLMNlXOKKM%3D&signature=17%2BXM5wmLeBsyr%2Fef9wx64v1zKg%3D
  148. Content-Type: text/xml
  149. Connection: close
  150. Content-Length: 116
  151.  
  152. ---UpW2XYvI---C--
  153. <?xml version="1.0"?>
  154. <methodCall>
  155. <methodName>jetpack.getHeartbeatData</methodName>
  156. <params>
  157. </params></methodCall>
  158.  
  159. ---UpW2XYvI---E--
  160. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  161.  
  162. ---UpW2XYvI---F--
  163. HTTP/1.1 403
  164. Server: nginx
  165. Date: Thu, 13 Mar 2025 03:21:12 GMT
  166. Content-Length: 146
  167. Content-Type: text/html
  168. X-Content-Type-Options: nosniff
  169. Connection: close
  170. X-XSS-Protection: 1; mode=block
  171. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  172. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  173. Referrer-Policy: no-referrer-when-downgrade
  174. x-frame-options: SAMEORIGIN
  175.  
  176. ---UpW2XYvI---H--
  177. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:[\n\r;`\{]|\|\|?|&&?)[\s\v]*[\s\v\"'-\(,@]*(?:[\"'\.-9A-Z_a-z]+/|(?:[\"'\x5c\^]*[0-9A-Z_a-z][\"'\x5c\^]*:.*|[ \"'\.-9A-Z\x5c\^-_a-z]*)\x5c)?[\"\^]*(?:a[\"\^]*(?:s[\"\^]*s[\"\^]*o[\"\^]*c|t[\"\^ (7601 characters omitted)' against variable `XML:/*' (Value: `\x0ajetpack.getHeartbeatData\x0a\x0a' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "815"] [id "932380"] [rev ""] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: \x0ajetpack.getHeartbeatData found within XML:/*: \x0ajetpack.getHeartbeatData\x0a\x0a"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607255.090224"] [ref "o0,25"]
  178. ModSecurity: Warning. Matched "Operator `Rx' with parameter `\s' against variable `TX:1' (Value: `for=jetpack&jetpack=comms&token=p7*@tm6cgproauhn6jkpog8w0b&&whve:1:0&timestamp=1741836072&nonce=rnyj (71 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1002"] [id "932205"] [rev ""] [msg "RCE Bypass Technique"] [data "Matched Data: *@tm6cgproauhn6jkpog8w0b&&whve:1:0&timestamp=1741836072&nonce=rnyjbecjgn&body-hash=metbicw+tmqdctk0fdlmnlxokkm=&signature=17+xm5wmlebsyr/ found within REQUEST_HEADERS:Referer: for=jetpac (161 characters omitted)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607255.090224"] [ref "o0,193o22,171o56,137v341,228t:lowercase,t:urlDecodeUnio170,1t:urlDecodeUnio124,1t:urlDecodeUni"]
  179. ModSecurity: Warning. detected SQLi using libinjection. [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "46"] [id "942100"] [rev ""] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: nov&n found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607255.090224"] [ref "v39,36"]
  180. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)!=|&&|\|\||>[=->]|<(?:<|=>?|>(?:[\s\v]+binary)?)|\b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)\b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)\b|[0-9A-Z_a- (321 characters omitted)' against variable `ARGS:token' (Value: `P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "645"] [id "942120"] [rev ""] [msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: && found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607255.090224"] [ref "o26,2v39,36t:utf8toUnicode,t:urlDecodeUni"]
  181. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `20' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607255.090224"] [ref ""]
  182.  
  183. ---UpW2XYvI---J--
  184.  
  185. ---UpW2XYvI---K--
  186.  
  187. ---UpW2XYvI---Z--
  188.  
  189. ---iBzwJT1U---A--
  190. [12/Mar/2025:22:21:12 -0500] 174183607281.437117 192.0.99.205 38736 10.10.10.2 443
  191. ---iBzwJT1U---B--
  192. GET /?rest_route=%2Fjetpack%2Fv4%2Fheartbeat%2Fdata%2F&_for=jetpack&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836072&nonce=ocNmGZ5IxD&body-hash&signature=LzD1X4nnHfK2aPdRNyJ5AM3Yqw8%3D HTTP/1.1
  193. Host: danran.rocks
  194. Authorization: X_JETPACK token="P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0" timestamp="1741836072" nonce="ocNmGZ5IxD" body-hash="" signature="LzD1X4nnHfK2aPdRNyJ5AM3Yqw8="
  195. User-Agent: Jetpack by WordPress.com
  196. Accept: */*
  197. Accept-Encoding: deflate, gzip, br, zstd
  198. Referer: https://danran.rocks/?rest_route=%2Fjetpack%2Fv4%2Fheartbeat%2Fdata%2F&_for=jetpack&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836072&nonce=ocNmGZ5IxD&body-hash&signature=LzD1X4nnHfK2aPdRNyJ5AM3Yqw8%3D
  199. Connection: close
  200.  
  201. ---iBzwJT1U---E--
  202. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  203.  
  204. ---iBzwJT1U---F--
  205. HTTP/1.1 403
  206. Server: nginx
  207. Date: Thu, 13 Mar 2025 03:21:12 GMT
  208. Content-Length: 146
  209. Content-Type: text/html
  210. X-Content-Type-Options: nosniff
  211. Connection: close
  212. X-XSS-Protection: 1; mode=block
  213. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  214. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  215. Referrer-Policy: no-referrer-when-downgrade
  216. x-frame-options: SAMEORIGIN
  217.  
  218. ---iBzwJT1U---H--
  219. ModSecurity: Warning. detected SQLi using libinjection. [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "46"] [id "942100"] [rev ""] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: nov&n found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607281.437117"] [ref "v74,36"]
  220. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)!=|&&|\|\||>[=->]|<(?:<|=>?|>(?:[\s\v]+binary)?)|\b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)\b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)\b|[0-9A-Z_a- (321 characters omitted)' against variable `ARGS:token' (Value: `P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "645"] [id "942120"] [rev ""] [msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: && found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607281.437117"] [ref "o26,2v74,36t:utf8toUnicode,t:urlDecodeUni"]
  221. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `10' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607281.437117"] [ref ""]
  222.  
  223. ---iBzwJT1U---J--
  224.  
  225. ---iBzwJT1U---K--
  226.  
  227. ---iBzwJT1U---Z--
  228.  
  229. ---1rBylrD4---A--
  230. [12/Mar/2025:22:21:12 -0500] 174183607270.147522 192.0.99.205 38752 10.10.10.2 443
  231. ---1rBylrD4---B--
  232. GET /?rest_route=%2Fjetpack%2Fv4%2Fsync%2Fstatus&_for=jetpack&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836072&nonce=iPcsvu0Gea&body-hash&signature=DT6QgTH1eE8ycLQgIou702Iuq0Y%3D HTTP/1.1
  233. Host: danran.rocks
  234. Authorization: X_JETPACK token="P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0" timestamp="1741836072" nonce="iPcsvu0Gea" body-hash="" signature="DT6QgTH1eE8ycLQgIou702Iuq0Y="
  235. User-Agent: Jetpack by WordPress.com
  236. Accept: */*
  237. Accept-Encoding: deflate, gzip, br, zstd
  238. Referer: https://danran.rocks/?rest_route=%2Fjetpack%2Fv4%2Fsync%2Fstatus&_for=jetpack&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836072&nonce=iPcsvu0Gea&body-hash&signature=DT6QgTH1eE8ycLQgIou702Iuq0Y%3D
  239. Connection: close
  240.  
  241. ---1rBylrD4---E--
  242. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  243.  
  244. ---1rBylrD4---F--
  245. HTTP/1.1 403
  246. Server: nginx
  247. Date: Thu, 13 Mar 2025 03:21:12 GMT
  248. Content-Length: 146
  249. Content-Type: text/html
  250. X-Content-Type-Options: nosniff
  251. Connection: close
  252. X-XSS-Protection: 1; mode=block
  253. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  254. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  255. Referrer-Policy: no-referrer-when-downgrade
  256. x-frame-options: SAMEORIGIN
  257.  
  258. ---1rBylrD4---H--
  259. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8015 characters omitted)' against variable `REQUEST_HEADERS:Referer' (Value: `https://danran.rocks/?rest_route=%2Fjetpack%2Fv4%2Fsync%2Fstatus&_for=jetpack&token=P7%2A%40Tm6CgPRO (121 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1410"] [id "932239"] [rev ""] [msg "Remote Command Execution: Unix Command Injection found in user-agent or referer header"] [data "Matched Data: =iP found within REQUEST_HEADERS:Referer: https://danran.rocks/?rest_route=%2Fjetpack%2Fv4%2Fsync%2Fstatus&_for=jetpack&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1 (77 characters omitted)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607270.147522"] [ref "o159,3v333,221"]
  260. ModSecurity: Warning. detected SQLi using libinjection. [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "46"] [id "942100"] [rev ""] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: nov&n found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607270.147522"] [ref "v68,36"]
  261. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)!=|&&|\|\||>[=->]|<(?:<|=>?|>(?:[\s\v]+binary)?)|\b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)\b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)\b|[0-9A-Z_a- (321 characters omitted)' against variable `ARGS:token' (Value: `P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "645"] [id "942120"] [rev ""] [msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: && found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607270.147522"] [ref "o26,2v68,36t:utf8toUnicode,t:urlDecodeUni"]
  262. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607270.147522"] [ref ""]
  263.  
  264. ---1rBylrD4---J--
  265.  
  266. ---1rBylrD4---K--
  267.  
  268. ---1rBylrD4---Z--
  269.  
  270. ---FtFbRtCD---A--
  271. [12/Mar/2025:22:21:14 -0500] 174183607418.015913 192.0.99.205 12096 10.10.10.2 443
  272. ---FtFbRtCD---B--
  273. GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836074&url=https%3A%2F%2Fdanran.rocks&signature=gzk%2FhDBTaQS8bYw68fELzijUOQKsJo3WKew0%2FXs9MGYGL6jXEJ8ayMRG6TM%2BN1e%2Foi%2FHkLA7Byc7M7gyBbrVfaH6jX2hIKtcU%2F%2BHFljC%2F4Dml5psBsxtdTLW5Wra9Vqex%2F%2FALGnyp%2BA%2FrGMiUMAOAVrR9NnqL1T%2B7TVAcc2%2FsfstahkYBd0bmoDW74AurRekgyevUIS7geOZxQEdeT1WgyiCkn7YsUvvrhN1aHu7JVOz7kb1IGVf%2FU%2BVqVMZI703k%2FyfhyZJt1jvxBw8zGnfVwzUzxhgKg8FWe2vW1VqOOzyZ6m775k4MT16nUR5M5xtY6f9S7rMNrqlAhPA4bEfpQ%3D%3D HTTP/1.1
  274. Host: danran.rocks
  275. User-Agent: WordPress.com; https://jptools.wordpress.com
  276. Accept: */*
  277. Accept-Encoding: deflate, gzip, br, zstd
  278. Referer: https://danran.rocks/?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836074&url=https%3A%2F%2Fdanran.rocks&signature=gzk%2FhDBTaQS8bYw68fELzijUOQKsJo3WKew0%2FXs9MGYGL6jXEJ8ayMRG6TM%2BN1e%2Foi%2FHkLA7Byc7M7gyBbrVfaH6jX2hIKtcU%2F%2BHFljC%2F4Dml5psBsxtdTLW5Wra9Vqex%2F%2FALGnyp%2BA%2FrGMiUMAOAVrR9NnqL1T%2B7TVAcc2%2FsfstahkYBd0bmoDW74AurRekgyevUIS7geOZxQEdeT1WgyiCkn7YsUvvrhN1aHu7JVOz7kb1IGVf%2FU%2BVqVMZI703k%2FyfhyZJt1jvxBw8zGnfVwzUzxhgKg8FWe2vW1VqOOzyZ6m775k4MT16nUR5M5xtY6f9S7rMNrqlAhPA4bEfpQ%3D%3D
  279. Connection: close
  280.  
  281. ---FtFbRtCD---E--
  282. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  283.  
  284. ---FtFbRtCD---F--
  285. HTTP/1.1 403
  286. Server: nginx
  287. Date: Thu, 13 Mar 2025 03:21:14 GMT
  288. Content-Length: 146
  289. Content-Type: text/html
  290. X-Content-Type-Options: nosniff
  291. Connection: close
  292. X-XSS-Protection: 1; mode=block
  293. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  294. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  295. Referrer-Policy: no-referrer-when-downgrade
  296. x-frame-options: SAMEORIGIN
  297.  
  298. ---FtFbRtCD---H--
  299. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:get /[^#\?]*(?:\?[^\s\v#]*)?(?:#[^\s\v]*)?|(?:connect (?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}\.?(?::[0-9]+)?|[\--9A-Z_a-z]+:[0-9]+)|options \*|[a-z]{3,10}[\s\v]+(?:[0-9A-Z_a-z]{3,7}?://[\--9A-Z_a-z]* (76 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836074&url=https%3A%2F%2Fda (412 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836074&url=https%3A%2F%2Fdanran.rocks&signature=gzk%2FhDBTaQS8bYw68fELzijUOQKsJo3WKew0%2FXs9MGYGL6jXEJ8ayMRG6TM%2BN1e%2Foi%2FHk (312 characters omitted)"] [severity "4"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607418.015913"] [ref "v0,512"]
  300. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `StrEq' with parameter `0' against variable `TX:MSC_PCRE_LIMITS_EXCEEDED' (Value: `1' ) [file "/etc/nginx/modsec/modsecurity.conf"] [line "147"] [id "200005"] [rev ""] [msg "ModSecurity internal error flagged: TX:MSC_PCRE_LIMITS_EXCEEDED"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607418.015913"] [ref ""]
  301.  
  302. ---FtFbRtCD---J--
  303.  
  304. ---FtFbRtCD---K--
  305.  
  306. ---FtFbRtCD---Z--
  307.  
  308. ---2FRY4WMY---A--
  309. [12/Mar/2025:22:21:14 -0500] 174183607425.537050 192.0.99.205 12110 10.10.10.2 443
  310. ---2FRY4WMY---B--
  311. GET /?rest_route=%2Fjetpack%2Fv4%2Ffeatures%2Favailable&_for=jetpack&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836074&nonce=dwm6LBjoSI&body-hash&signature=7BHhFXcBwDt%2FAHX6kMQzkNVCt%2B4%3D HTTP/1.1
  312. Host: danran.rocks
  313. Authorization: X_JETPACK token="P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0" timestamp="1741836074" nonce="dwm6LBjoSI" body-hash="" signature="7BHhFXcBwDt/AHX6kMQzkNVCt+4="
  314. User-Agent: Jetpack by WordPress.com
  315. Accept: */*
  316. Accept-Encoding: deflate, gzip, br, zstd
  317. Referer: https://danran.rocks/?rest_route=%2Fjetpack%2Fv4%2Ffeatures%2Favailable&_for=jetpack&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836074&nonce=dwm6LBjoSI&body-hash&signature=7BHhFXcBwDt%2FAHX6kMQzkNVCt%2B4%3D
  318. Connection: close
  319.  
  320. ---2FRY4WMY---E--
  321. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  322.  
  323. ---2FRY4WMY---F--
  324. HTTP/1.1 403
  325. Server: nginx
  326. Date: Thu, 13 Mar 2025 03:21:14 GMT
  327. Content-Length: 146
  328. Content-Type: text/html
  329. X-Content-Type-Options: nosniff
  330. Connection: close
  331. X-XSS-Protection: 1; mode=block
  332. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  333. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  334. Referrer-Policy: no-referrer-when-downgrade
  335. x-frame-options: SAMEORIGIN
  336.  
  337. ---2FRY4WMY---H--
  338. ModSecurity: Warning. detected SQLi using libinjection. [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "46"] [id "942100"] [rev ""] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: nov&n found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607425.537050"] [ref "v75,36"]
  339. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)!=|&&|\|\||>[=->]|<(?:<|=>?|>(?:[\s\v]+binary)?)|\b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)\b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)\b|[0-9A-Z_a- (321 characters omitted)' against variable `ARGS:token' (Value: `P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "645"] [id "942120"] [rev ""] [msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: && found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607425.537050"] [ref "o26,2v75,36t:utf8toUnicode,t:urlDecodeUni"]
  340. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `10' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607425.537050"] [ref ""]
  341.  
  342. ---2FRY4WMY---J--
  343.  
  344. ---2FRY4WMY---K--
  345.  
  346. ---2FRY4WMY---Z--
  347.  
  348. ---LqYtMTBL---A--
  349. [12/Mar/2025:22:21:14 -0500] 174183607479.673565 192.0.99.205 12112 10.10.10.2 443
  350. ---LqYtMTBL---B--
  351. POST /?for=jetpack&jetpack=comms&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836074&nonce=Y9SHNdnXxJ&body-hash=YpK8wg675VHNMMeuAm1muupdBq8%3D&signature=jMeE3JcThV2foxecwUN0OSrk7TM%3D HTTP/1.1
  352. Host: danran.rocks
  353. Authorization: X_JETPACK token="P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0" timestamp="1741836074" nonce="Y9SHNdnXxJ" body-hash="YpK8wg675VHNMMeuAm1muupdBq8=" signature="jMeE3JcThV2foxecwUN0OSrk7TM="
  354. User-Agent: Jetpack by WordPress.com
  355. Accept: */*
  356. Accept-Encoding: deflate, gzip, br, zstd
  357. Referer: https://danran.rocks/?for=jetpack&jetpack=comms&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836074&nonce=Y9SHNdnXxJ&body-hash=YpK8wg675VHNMMeuAm1muupdBq8%3D&signature=jMeE3JcThV2foxecwUN0OSrk7TM%3D
  358. Content-Type: text/xml
  359. Connection: close
  360. Content-Length: 117
  361.  
  362. ---LqYtMTBL---C--
  363. <?xml version="1.0"?>
  364. <methodCall>
  365. <methodName>jetpack.featuresAvailable</methodName>
  366. <params>
  367. </params></methodCall>
  368.  
  369. ---LqYtMTBL---E--
  370. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  371.  
  372. ---LqYtMTBL---F--
  373. HTTP/1.1 403
  374. Server: nginx
  375. Date: Thu, 13 Mar 2025 03:21:14 GMT
  376. Content-Length: 146
  377. Content-Type: text/html
  378. X-Content-Type-Options: nosniff
  379. Connection: close
  380. X-XSS-Protection: 1; mode=block
  381. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  382. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  383. Referrer-Policy: no-referrer-when-downgrade
  384. x-frame-options: SAMEORIGIN
  385.  
  386. ---LqYtMTBL---H--
  387. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:[\n\r;`\{]|\|\|?|&&?)[\s\v]*[\s\v\"'-\(,@]*(?:[\"'\.-9A-Z_a-z]+/|(?:[\"'\x5c\^]*[0-9A-Z_a-z][\"'\x5c\^]*:.*|[ \"'\.-9A-Z\x5c\^-_a-z]*)\x5c)?[\"\^]*(?:a[\"\^]*(?:s[\"\^]*s[\"\^]*o[\"\^]*c|t[\"\^ (7601 characters omitted)' against variable `XML:/*' (Value: `\x0ajetpack.featuresAvailable\x0a\x0a' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "815"] [id "932380"] [rev ""] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: \x0ajetpack.featuresAvailable found within XML:/*: \x0ajetpack.featuresAvailable\x0a\x0a"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607479.673565"] [ref "o0,26"]
  388. ModSecurity: Warning. detected SQLi using libinjection. [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "46"] [id "942100"] [rev ""] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: nov&n found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607479.673565"] [ref "v39,36"]
  389. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)!=|&&|\|\||>[=->]|<(?:<|=>?|>(?:[\s\v]+binary)?)|\b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)\b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)\b|[0-9A-Z_a- (321 characters omitted)' against variable `ARGS:token' (Value: `P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "645"] [id "942120"] [rev ""] [msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: && found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607479.673565"] [ref "o26,2v39,36t:utf8toUnicode,t:urlDecodeUni"]
  390. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607479.673565"] [ref ""]
  391.  
  392. ---LqYtMTBL---J--
  393.  
  394. ---LqYtMTBL---K--
  395.  
  396. ---LqYtMTBL---Z--
  397.  
  398. ---IMK3CX5R---A--
  399. [12/Mar/2025:22:21:14 -0500] 174183607465.421473 192.0.99.205 12124 10.10.10.2 443
  400. ---IMK3CX5R---B--
  401. GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836074&url=https%3A%2F%2Fdanran.rocks&signature=gzk%2FhDBTaQS8bYw68fELzijUOQKsJo3WKew0%2FXs9MGYGL6jXEJ8ayMRG6TM%2BN1e%2Foi%2FHkLA7Byc7M7gyBbrVfaH6jX2hIKtcU%2F%2BHFljC%2F4Dml5psBsxtdTLW5Wra9Vqex%2F%2FALGnyp%2BA%2FrGMiUMAOAVrR9NnqL1T%2B7TVAcc2%2FsfstahkYBd0bmoDW74AurRekgyevUIS7geOZxQEdeT1WgyiCkn7YsUvvrhN1aHu7JVOz7kb1IGVf%2FU%2BVqVMZI703k%2FyfhyZJt1jvxBw8zGnfVwzUzxhgKg8FWe2vW1VqOOzyZ6m775k4MT16nUR5M5xtY6f9S7rMNrqlAhPA4bEfpQ%3D%3D HTTP/1.1
  402. Host: danran.rocks
  403. User-Agent: WordPress.com; https://jptools.wordpress.com
  404. Accept: */*
  405. Accept-Encoding: deflate, gzip, br, zstd
  406. Referer: https://danran.rocks/?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836074&url=https%3A%2F%2Fdanran.rocks&signature=gzk%2FhDBTaQS8bYw68fELzijUOQKsJo3WKew0%2FXs9MGYGL6jXEJ8ayMRG6TM%2BN1e%2Foi%2FHkLA7Byc7M7gyBbrVfaH6jX2hIKtcU%2F%2BHFljC%2F4Dml5psBsxtdTLW5Wra9Vqex%2F%2FALGnyp%2BA%2FrGMiUMAOAVrR9NnqL1T%2B7TVAcc2%2FsfstahkYBd0bmoDW74AurRekgyevUIS7geOZxQEdeT1WgyiCkn7YsUvvrhN1aHu7JVOz7kb1IGVf%2FU%2BVqVMZI703k%2FyfhyZJt1jvxBw8zGnfVwzUzxhgKg8FWe2vW1VqOOzyZ6m775k4MT16nUR5M5xtY6f9S7rMNrqlAhPA4bEfpQ%3D%3D
  407. Connection: close
  408.  
  409. ---IMK3CX5R---E--
  410. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  411.  
  412. ---IMK3CX5R---F--
  413. HTTP/1.1 403
  414. Server: nginx
  415. Date: Thu, 13 Mar 2025 03:21:14 GMT
  416. Content-Length: 146
  417. Content-Type: text/html
  418. X-Content-Type-Options: nosniff
  419. Connection: close
  420. X-XSS-Protection: 1; mode=block
  421. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  422. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  423. Referrer-Policy: no-referrer-when-downgrade
  424. x-frame-options: SAMEORIGIN
  425.  
  426. ---IMK3CX5R---H--
  427. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:get /[^#\?]*(?:\?[^\s\v#]*)?(?:#[^\s\v]*)?|(?:connect (?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}\.?(?::[0-9]+)?|[\--9A-Z_a-z]+:[0-9]+)|options \*|[a-z]{3,10}[\s\v]+(?:[0-9A-Z_a-z]{3,7}?://[\--9A-Z_a-z]* (76 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836074&url=https%3A%2F%2Fda (412 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836074&url=https%3A%2F%2Fdanran.rocks&signature=gzk%2FhDBTaQS8bYw68fELzijUOQKsJo3WKew0%2FXs9MGYGL6jXEJ8ayMRG6TM%2BN1e%2Foi%2FHk (312 characters omitted)"] [severity "4"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607465.421473"] [ref "v0,512"]
  428. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `StrEq' with parameter `0' against variable `TX:MSC_PCRE_LIMITS_EXCEEDED' (Value: `1' ) [file "/etc/nginx/modsec/modsecurity.conf"] [line "147"] [id "200005"] [rev ""] [msg "ModSecurity internal error flagged: TX:MSC_PCRE_LIMITS_EXCEEDED"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607465.421473"] [ref ""]
  429.  
  430. ---IMK3CX5R---J--
  431.  
  432. ---IMK3CX5R---K--
  433.  
  434. ---IMK3CX5R---Z--
  435.  
  436. ---PL2qCC3F---A--
  437. [12/Mar/2025:22:21:15 -0500] 17418360754.159924 192.0.99.205 12136 10.10.10.2 443
  438. ---PL2qCC3F---B--
  439. GET /?rest_route=%2Fjetpack%2Fv4%2Ffeatures%2Fenabled&_for=jetpack&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836075&nonce=oqop0lmJne&body-hash&signature=IH2t68xhi9FPTISxcbFMNOpAmh8%3D HTTP/1.1
  440. Host: danran.rocks
  441. Authorization: X_JETPACK token="P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0" timestamp="1741836075" nonce="oqop0lmJne" body-hash="" signature="IH2t68xhi9FPTISxcbFMNOpAmh8="
  442. User-Agent: Jetpack by WordPress.com
  443. Accept: */*
  444. Accept-Encoding: deflate, gzip, br, zstd
  445. Referer: https://danran.rocks/?rest_route=%2Fjetpack%2Fv4%2Ffeatures%2Fenabled&_for=jetpack&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836075&nonce=oqop0lmJne&body-hash&signature=IH2t68xhi9FPTISxcbFMNOpAmh8%3D
  446. Connection: close
  447.  
  448. ---PL2qCC3F---E--
  449. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  450.  
  451. ---PL2qCC3F---F--
  452. HTTP/1.1 403
  453. Server: nginx
  454. Date: Thu, 13 Mar 2025 03:21:15 GMT
  455. Content-Length: 146
  456. Content-Type: text/html
  457. X-Content-Type-Options: nosniff
  458. Connection: close
  459. X-XSS-Protection: 1; mode=block
  460. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  461. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  462. Referrer-Policy: no-referrer-when-downgrade
  463. x-frame-options: SAMEORIGIN
  464.  
  465. ---PL2qCC3F---H--
  466. ModSecurity: Warning. detected SQLi using libinjection. [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "46"] [id "942100"] [rev ""] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: nov&n found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "17418360754.159924"] [ref "v73,36"]
  467. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)!=|&&|\|\||>[=->]|<(?:<|=>?|>(?:[\s\v]+binary)?)|\b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)\b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)\b|[0-9A-Z_a- (321 characters omitted)' against variable `ARGS:token' (Value: `P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "645"] [id "942120"] [rev ""] [msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: && found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "17418360754.159924"] [ref "o26,2v73,36t:utf8toUnicode,t:urlDecodeUni"]
  468. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `10' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "17418360754.159924"] [ref ""]
  469.  
  470. ---PL2qCC3F---J--
  471.  
  472. ---PL2qCC3F---K--
  473.  
  474. ---PL2qCC3F---Z--
  475.  
  476. ---QSlSy5yI---A--
  477. [12/Mar/2025:22:21:15 -0500] 174183607539.109098 192.0.99.205 12140 10.10.10.2 443
  478. ---QSlSy5yI---B--
  479. POST /?for=jetpack&jetpack=comms&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836075&nonce=JZXzuiXNOl&body-hash=h2%2BsjEWmrXuLoPmTZBJXbegPpI8%3D&signature=IGduX7gM8uexzhkMQcNT2cNvY00%3D HTTP/1.1
  480. Host: danran.rocks
  481. Authorization: X_JETPACK token="P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0" timestamp="1741836075" nonce="JZXzuiXNOl" body-hash="h2+sjEWmrXuLoPmTZBJXbegPpI8=" signature="IGduX7gM8uexzhkMQcNT2cNvY00="
  482. User-Agent: Jetpack by WordPress.com
  483. Accept: */*
  484. Accept-Encoding: deflate, gzip, br, zstd
  485. Referer: https://danran.rocks/?for=jetpack&jetpack=comms&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836075&nonce=JZXzuiXNOl&body-hash=h2%2BsjEWmrXuLoPmTZBJXbegPpI8%3D&signature=IGduX7gM8uexzhkMQcNT2cNvY00%3D
  486. Content-Type: text/xml
  487. Connection: close
  488. Content-Length: 115
  489.  
  490. ---QSlSy5yI---C--
  491. <?xml version="1.0"?>
  492. <methodCall>
  493. <methodName>jetpack.featuresEnabled</methodName>
  494. <params>
  495. </params></methodCall>
  496.  
  497. ---QSlSy5yI---E--
  498. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  499.  
  500. ---QSlSy5yI---F--
  501. HTTP/1.1 403
  502. Server: nginx
  503. Date: Thu, 13 Mar 2025 03:21:15 GMT
  504. Content-Length: 146
  505. Content-Type: text/html
  506. X-Content-Type-Options: nosniff
  507. Connection: close
  508. X-XSS-Protection: 1; mode=block
  509. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  510. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  511. Referrer-Policy: no-referrer-when-downgrade
  512. x-frame-options: SAMEORIGIN
  513.  
  514. ---QSlSy5yI---H--
  515. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:[\n\r;`\{]|\|\|?|&&?)[\s\v]*[\s\v\"'-\(,@]*(?:[\"'\.-9A-Z_a-z]+/|(?:[\"'\x5c\^]*[0-9A-Z_a-z][\"'\x5c\^]*:.*|[ \"'\.-9A-Z\x5c\^-_a-z]*)\x5c)?[\"\^]*(?:a[\"\^]*(?:s[\"\^]*s[\"\^]*o[\"\^]*c|t[\"\^ (7601 characters omitted)' against variable `XML:/*' (Value: `\x0ajetpack.featuresEnabled\x0a\x0a' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "815"] [id "932380"] [rev ""] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: \x0ajetpack.featuresEnabled found within XML:/*: \x0ajetpack.featuresEnabled\x0a\x0a"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607539.109098"] [ref "o0,24"]
  516. ModSecurity: Warning. detected SQLi using libinjection. [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "46"] [id "942100"] [rev ""] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: nov&n found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607539.109098"] [ref "v39,36"]
  517. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)!=|&&|\|\||>[=->]|<(?:<|=>?|>(?:[\s\v]+binary)?)|\b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)\b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)\b|[0-9A-Z_a- (321 characters omitted)' against variable `ARGS:token' (Value: `P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "645"] [id "942120"] [rev ""] [msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: && found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607539.109098"] [ref "o26,2v39,36t:utf8toUnicode,t:urlDecodeUni"]
  518. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607539.109098"] [ref ""]
  519.  
  520. ---QSlSy5yI---J--
  521.  
  522. ---QSlSy5yI---K--
  523.  
  524. ---QSlSy5yI---Z--
  525.  
  526. ---wWBIxKeG---A--
  527. [12/Mar/2025:22:21:15 -0500] 174183607587.061254 192.0.99.205 12142 10.10.10.2 443
  528. ---wWBIxKeG---B--
  529. GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836075&url=https%3A%2F%2Fdanran.rocks&signature=YTfFaqWAzYDSVmwNTtdouE3Qd0%2Fle0geTYV0YBXOqah2UcyJu9Nx1EiyGZ9Dzth7NIiZRpG3ZdXBCeI76q3J5gr417djVQarWIFWyLl5SqFV6Xt6DFavoEY4EowwYMBAXfkKhlcnXVVP7BZMJTRmbQvIixTvP%2FN1eNIURUpE5tla3Vvf4xge9m%2FbhujV06D3ZbTzqmlM1u8ZQg2tRJ20NnSPRCcxhOn3myKEEe7BwagMEL0vNPoZWU5Mq1bm63eAxdCIIykloVPJO69W936AunLhg%2BaWwv2rGQCw192Wzn9c9ToPHxbhgvnH5%2F6qfrLbRCvD49nV6YrVe0tMgAwUBg%3D%3D HTTP/1.1
  530. Host: danran.rocks
  531. User-Agent: WordPress.com; https://jptools.wordpress.com
  532. Accept: */*
  533. Accept-Encoding: deflate, gzip, br, zstd
  534. Referer: https://danran.rocks/?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836075&url=https%3A%2F%2Fdanran.rocks&signature=YTfFaqWAzYDSVmwNTtdouE3Qd0%2Fle0geTYV0YBXOqah2UcyJu9Nx1EiyGZ9Dzth7NIiZRpG3ZdXBCeI76q3J5gr417djVQarWIFWyLl5SqFV6Xt6DFavoEY4EowwYMBAXfkKhlcnXVVP7BZMJTRmbQvIixTvP%2FN1eNIURUpE5tla3Vvf4xge9m%2FbhujV06D3ZbTzqmlM1u8ZQg2tRJ20NnSPRCcxhOn3myKEEe7BwagMEL0vNPoZWU5Mq1bm63eAxdCIIykloVPJO69W936AunLhg%2BaWwv2rGQCw192Wzn9c9ToPHxbhgvnH5%2F6qfrLbRCvD49nV6YrVe0tMgAwUBg%3D%3D
  535. Connection: close
  536.  
  537. ---wWBIxKeG---E--
  538. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  539.  
  540. ---wWBIxKeG---F--
  541. HTTP/1.1 403
  542. Server: nginx
  543. Date: Thu, 13 Mar 2025 03:21:15 GMT
  544. Content-Length: 146
  545. Content-Type: text/html
  546. X-Content-Type-Options: nosniff
  547. Connection: close
  548. X-XSS-Protection: 1; mode=block
  549. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  550. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  551. Referrer-Policy: no-referrer-when-downgrade
  552. x-frame-options: SAMEORIGIN
  553.  
  554. ---wWBIxKeG---H--
  555. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:get /[^#\?]*(?:\?[^\s\v#]*)?(?:#[^\s\v]*)?|(?:connect (?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}\.?(?::[0-9]+)?|[\--9A-Z_a-z]+:[0-9]+)|options \*|[a-z]{3,10}[\s\v]+(?:[0-9A-Z_a-z]{3,7}?://[\--9A-Z_a-z]* (76 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836075&url=https%3A%2F%2Fda (388 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836075&url=https%3A%2F%2Fdanran.rocks&signature=YTfFaqWAzYDSVmwNTtdouE3Qd0%2Fle0geTYV0YBXOqah2UcyJu9Nx1EiyGZ9Dzth7NIiZRpG3ZdXBC (288 characters omitted)"] [severity "4"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607587.061254"] [ref "v0,488"]
  556. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `StrEq' with parameter `0' against variable `TX:MSC_PCRE_LIMITS_EXCEEDED' (Value: `1' ) [file "/etc/nginx/modsec/modsecurity.conf"] [line "147"] [id "200005"] [rev ""] [msg "ModSecurity internal error flagged: TX:MSC_PCRE_LIMITS_EXCEEDED"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607587.061254"] [ref ""]
  557.  
  558. ---wWBIxKeG---J--
  559.  
  560. ---wWBIxKeG---K--
  561.  
  562. ---wWBIxKeG---Z--
  563.  
  564. ---fwJrRNGq---A--
  565. [12/Mar/2025:22:21:15 -0500] 174183607557.715862 192.0.99.205 12146 10.10.10.2 443
  566. ---fwJrRNGq---B--
  567. POST /?for=jetpack&jetpack=comms&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836075&nonce=NzJ7qqw5tm&body-hash=DJUiPuzRYfl19%2BIU5IiNKIVlKw8%3D&signature=WtnOXAn7lGNH9k7tpfP3jmRfYmk%3D HTTP/1.1
  568. Host: danran.rocks
  569. Authorization: X_JETPACK token="P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0" timestamp="1741836075" nonce="NzJ7qqw5tm" body-hash="DJUiPuzRYfl19+IU5IiNKIVlKw8=" signature="WtnOXAn7lGNH9k7tpfP3jmRfYmk="
  570. User-Agent: Jetpack by WordPress.com
  571. Accept: */*
  572. Accept-Encoding: deflate, gzip, br, zstd
  573. Referer: https://danran.rocks/?for=jetpack&jetpack=comms&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836075&nonce=NzJ7qqw5tm&body-hash=DJUiPuzRYfl19%2BIU5IiNKIVlKw8%3D&signature=WtnOXAn7lGNH9k7tpfP3jmRfYmk%3D
  574. Content-Type: text/xml
  575. Connection: close
  576. Content-Length: 107
  577.  
  578. ---fwJrRNGq---C--
  579. <?xml version="1.0"?>
  580. <methodCall>
  581. <methodName>jetpack.getBlog</methodName>
  582. <params>
  583. </params></methodCall>
  584.  
  585. ---fwJrRNGq---E--
  586. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  587.  
  588. ---fwJrRNGq---F--
  589. HTTP/1.1 403
  590. Server: nginx
  591. Date: Thu, 13 Mar 2025 03:21:15 GMT
  592. Content-Length: 146
  593. Content-Type: text/html
  594. X-Content-Type-Options: nosniff
  595. Connection: close
  596. X-XSS-Protection: 1; mode=block
  597. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  598. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  599. Referrer-Policy: no-referrer-when-downgrade
  600. x-frame-options: SAMEORIGIN
  601.  
  602. ---fwJrRNGq---H--
  603. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:[\n\r;`\{]|\|\|?|&&?)[\s\v]*[\s\v\"'-\(,@]*(?:[\"'\.-9A-Z_a-z]+/|(?:[\"'\x5c\^]*[0-9A-Z_a-z][\"'\x5c\^]*:.*|[ \"'\.-9A-Z\x5c\^-_a-z]*)\x5c)?[\"\^]*(?:a[\"\^]*(?:s[\"\^]*s[\"\^]*o[\"\^]*c|t[\"\^ (7601 characters omitted)' against variable `XML:/*' (Value: `\x0ajetpack.getBlog\x0a\x0a' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "815"] [id "932380"] [rev ""] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: \x0ajetpack.getBlog found within XML:/*: \x0ajetpack.getBlog\x0a\x0a"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607557.715862"] [ref "o0,16"]
  604. ModSecurity: Warning. detected SQLi using libinjection. [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "46"] [id "942100"] [rev ""] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: nov&n found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607557.715862"] [ref "v39,36"]
  605. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)!=|&&|\|\||>[=->]|<(?:<|=>?|>(?:[\s\v]+binary)?)|\b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)\b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)\b|[0-9A-Z_a- (321 characters omitted)' against variable `ARGS:token' (Value: `P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "645"] [id "942120"] [rev ""] [msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: && found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607557.715862"] [ref "o26,2v39,36t:utf8toUnicode,t:urlDecodeUni"]
  606. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607557.715862"] [ref ""]
  607.  
  608. ---fwJrRNGq---J--
  609.  
  610. ---fwJrRNGq---K--
  611.  
  612. ---fwJrRNGq---Z--
  613.  
  614. ---iIfsSg7q---A--
  615. [12/Mar/2025:22:21:15 -0500] 174183607574.261293 192.0.99.205 12148 10.10.10.2 443
  616. ---iIfsSg7q---B--
  617. GET /?rest_route=%2Fjetpack%2Fv4%2Fstats%2Fblog%2F&_for=jetpack&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836075&nonce=Ei2ZG3IOQF&body-hash&signature=GhEnx8OaThx3FZgRmARpkJSgE1o%3D HTTP/1.1
  618. Host: danran.rocks
  619. Authorization: X_JETPACK token="P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0" timestamp="1741836075" nonce="Ei2ZG3IOQF" body-hash="" signature="GhEnx8OaThx3FZgRmARpkJSgE1o="
  620. User-Agent: Jetpack by WordPress.com
  621. Accept: */*
  622. Accept-Encoding: deflate, gzip, br, zstd
  623. Referer: https://danran.rocks/?rest_route=%2Fjetpack%2Fv4%2Fstats%2Fblog%2F&_for=jetpack&token=P7%2A%40Tm6CgPROaUHN6JkpoG8W0b%26%26WhvE%3A1%3A0&timestamp=1741836075&nonce=Ei2ZG3IOQF&body-hash&signature=GhEnx8OaThx3FZgRmARpkJSgE1o%3D
  624. Connection: close
  625.  
  626. ---iIfsSg7q---E--
  627. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  628.  
  629. ---iIfsSg7q---F--
  630. HTTP/1.1 403
  631. Server: nginx
  632. Date: Thu, 13 Mar 2025 03:21:15 GMT
  633. Content-Length: 146
  634. Content-Type: text/html
  635. X-Content-Type-Options: nosniff
  636. Connection: close
  637. X-XSS-Protection: 1; mode=block
  638. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  639. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  640. Referrer-Policy: no-referrer-when-downgrade
  641. x-frame-options: SAMEORIGIN
  642.  
  643. ---iIfsSg7q---H--
  644. ModSecurity: Warning. detected SQLi using libinjection. [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "46"] [id "942100"] [rev ""] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: nov&n found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607574.261293"] [ref "v70,36"]
  645. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)!=|&&|\|\||>[=->]|<(?:<|=>?|>(?:[\s\v]+binary)?)|\b(?:(?:xor|r(?:egexp|like)|i(?:snull|like)|notnull)\b|collate(?:[^0-9A-Z_a-z]*?(?:U&)?[\"'`]|[^0-9A-Z_a-z]+(?:(?:binary|nocase|rtrim)\b|[0-9A-Z_a- (321 characters omitted)' against variable `ARGS:token' (Value: `P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "645"] [id "942120"] [rev ""] [msg "SQL Injection Attack: SQL Operator Detected"] [data "Matched Data: && found within ARGS:token: P7*@Tm6CgPROaUHN6JkpoG8W0b&&WhvE:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607574.261293"] [ref "o26,2v70,36t:utf8toUnicode,t:urlDecodeUni"]
  646. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `10' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174183607574.261293"] [ref ""]
  647.  
  648. ---iIfsSg7q---J--
  649.  
  650. ---iIfsSg7q---K--
  651.  
  652. ---iIfsSg7q---Z--
  653.  
  654. ---X5rWEigB---A--
  655. [12/Mar/2025:22:21:16 -0500] 17418360766.402796 192.0.99.205 12162 10.10.10.2 443
  656. ---X5rWEigB---B--
  657. GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836076&url=https%3A%2F%2Fdanran.rocks&signature=FB64UR6VYmWGxbEzK7zeEZp%2FLOMvfFHeCtgaVr6agYI9vj6j0Nb8HpSdG9hmy8JNRF8nrPd2lc2wU%2FgDyY%2Fh6NbeYcVeZqolHfqv2J7PBBUQgZFfEX6QzmiJJF9m10XDcAyO8%2FMaoRavnD3Etv3GN395dpqBsMUEiJP9dyukBhmBdWK4YV0rlu0DNeWY0QZFvbxEgqpWSc6ffCMtaqu7T%2FrPfTcy0nvce0Gqr7JuZt%2FgdcOd3rUYHbKa0AYEUYRLlzylcO71ZHJTImz31dm0%2BqdCjuseoFKSuHyeh5J5gkF3yQeik%2BgdCK3U2T3EMjNnGrJo5qL4YOzHIj3H%2FrHAYA%3D%3D HTTP/1.1
  658. Host: danran.rocks
  659. User-Agent: WordPress.com; https://jptools.wordpress.com
  660. Accept: */*
  661. Accept-Encoding: deflate, gzip, br, zstd
  662. Referer: https://danran.rocks/?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836076&url=https%3A%2F%2Fdanran.rocks&signature=FB64UR6VYmWGxbEzK7zeEZp%2FLOMvfFHeCtgaVr6agYI9vj6j0Nb8HpSdG9hmy8JNRF8nrPd2lc2wU%2FgDyY%2Fh6NbeYcVeZqolHfqv2J7PBBUQgZFfEX6QzmiJJF9m10XDcAyO8%2FMaoRavnD3Etv3GN395dpqBsMUEiJP9dyukBhmBdWK4YV0rlu0DNeWY0QZFvbxEgqpWSc6ffCMtaqu7T%2FrPfTcy0nvce0Gqr7JuZt%2FgdcOd3rUYHbKa0AYEUYRLlzylcO71ZHJTImz31dm0%2BqdCjuseoFKSuHyeh5J5gkF3yQeik%2BgdCK3U2T3EMjNnGrJo5qL4YOzHIj3H%2FrHAYA%3D%3D
  663. Connection: close
  664.  
  665. ---X5rWEigB---E--
  666. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  667.  
  668. ---X5rWEigB---F--
  669. HTTP/1.1 403
  670. Server: nginx
  671. Date: Thu, 13 Mar 2025 03:21:16 GMT
  672. Content-Length: 146
  673. Content-Type: text/html
  674. X-Content-Type-Options: nosniff
  675. Connection: close
  676. X-XSS-Protection: 1; mode=block
  677. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  678. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  679. Referrer-Policy: no-referrer-when-downgrade
  680. x-frame-options: SAMEORIGIN
  681.  
  682. ---X5rWEigB---H--
  683. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:get /[^#\?]*(?:\?[^\s\v#]*)?(?:#[^\s\v]*)?|(?:connect (?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}\.?(?::[0-9]+)?|[\--9A-Z_a-z]+:[0-9]+)|options \*|[a-z]{3,10}[\s\v]+(?:[0-9A-Z_a-z]{3,7}?://[\--9A-Z_a-z]* (76 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836076&url=https%3A%2F%2Fda (396 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741836076&url=https%3A%2F%2Fdanran.rocks&signature=FB64UR6VYmWGxbEzK7zeEZp%2FLOMvfFHeCtgaVr6agYI9vj6j0Nb8HpSdG9hmy8JNRF8nrPd2lc2wU (296 characters omitted)"] [severity "4"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "10.10.10.2"] [uri "/"] [unique_id "17418360766.402796"] [ref "v0,496"]
  684. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `StrEq' with parameter `0' against variable `TX:MSC_PCRE_LIMITS_EXCEEDED' (Value: `1' ) [file "/etc/nginx/modsec/modsecurity.conf"] [line "147"] [id "200005"] [rev ""] [msg "ModSecurity internal error flagged: TX:MSC_PCRE_LIMITS_EXCEEDED"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "10.10.10.2"] [uri "/"] [unique_id "17418360766.402796"] [ref ""]
  685.  
  686. ---X5rWEigB---J--
  687.  
  688. ---X5rWEigB---K--
  689.  
  690. ---X5rWEigB---Z--
  691.  
  692. ---m1i9KX4q---A--
  693. [12/Mar/2025:22:22:08 -0500] 17418361289.408673 34.238.245.215 33682 10.10.10.2 80
  694. ---m1i9KX4q---B--
  695. GET /.git/config HTTP/1.1
  696. Host: 149.28.125.6
  697. User-Agent: python-requests/2.25.1
  698. Accept-Encoding: gzip, deflate
  699. Accept: */*
  700. Connection: keep-alive
  701.  
  702. ---m1i9KX4q---E--
  703. <html>\x0d\x0a<head><title>404 Not Found</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>404 Not Found</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  704.  
  705. ---m1i9KX4q---F--
  706. HTTP/1.1 404
  707. Server: nginx
  708. Date: Thu, 13 Mar 2025 03:22:08 GMT
  709. Content-Length: 146
  710. Content-Type: text/html
  711. Connection: keep-alive
  712.  
  713. ---m1i9KX4q---H--
  714. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?:^([\d.]+|\[[\da-f:]+\]|[\da-f:]+)(:[\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `149.28.125.6' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "772"] [id "920350"] [rev ""] [msg "Host header is a numeric IP address"] [data "149.28.125.6"] [severity "4"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "10.10.10.2"] [uri "/.git/config"] [unique_id "17418361289.408673"] [ref "o0,12o0,12v32,12"]
  715. ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `restricted-files.data' against variable `REQUEST_FILENAME' (Value: `/.git/config' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "124"] [id "930130"] [rev ""] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "10.10.10.2"] [uri "/.git/config"] [unique_id "17418361289.408673"] [ref "o0,6v4,12t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin"]
  716.  
  717. ---m1i9KX4q---J--
  718.  
  719. ---m1i9KX4q---K--
  720.  
  721. ---m1i9KX4q---Z--
  722.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!