API tools faq
paste
Advertisement
danrancan

Jetpack - Oddcake - Rule Exclusions - tail modsec log

danrancan
Mar 8th, 2025
210
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 71.01 KB | None | 0 0
raw download clone embed print report
  1. ==> /var/log/modsec_audit.log <==
  2. ---mJW7r7m9---A--
  3. [08/Mar/2025:08:09:52 -0600] 174144299226.029033 192.0.101.183 23584 10.10.10.2 443
  4. ---mJW7r7m9---B--
  5. POST /xmlrpc.php?for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442992&nonce=WnTAO9nFUZ&body-hash=pdst%2B%2B8gjpsEsdzTGdS19%2BYN3g4%3D&signature=zkPvTCqzH6WosQCbEkl%2B6b5%2FwEE%3D HTTP/1.1
  6. Host: oddcake.net
  7. Authorization: X_JETPACK token="myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0" timestamp="1741442992" nonce="WnTAO9nFUZ" body-hash="pdst++8gjpsEsdzTGdS19+YN3g4=" signature="zkPvTCqzH6WosQCbEkl+6b5/wEE="
  8. User-Agent: Jetpack by WordPress.com
  9. Accept: */*
  10. Accept-Encoding: deflate, gzip, br, zstd
  11. Referer: https://oddcake.net/xmlrpc.php?for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442992&nonce=WnTAO9nFUZ&body-hash=pdst%2B%2B8gjpsEsdzTGdS19%2BYN3g4%3D&signature=zkPvTCqzH6WosQCbEkl%2B6b5%2FwEE%3D
  12. Content-Type: text/xml
  13. Connection: close
  14. Content-Length: 114
  15.  
  16. ---mJW7r7m9---C--
  17. <?xml version="1.0"?>
  18. <methodCall>
  19. <methodName>jetpack.testConnection</methodName>
  20. <params>
  21. </params></methodCall>
  22.  
  23. ---mJW7r7m9---E--
  24. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  25.  
  26. ---mJW7r7m9---F--
  27. HTTP/1.1 403
  28. Server: nginx
  29. Date: Sat, 08 Mar 2025 14:09:52 GMT
  30. Content-Length: 146
  31. Content-Type: text/html
  32. X-Content-Type-Options: nosniff
  33. Connection: close
  34. X-XSS-Protection: 1; mode=block
  35. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  36. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  37. Referrer-Policy: no-referrer-when-downgrade
  38. x-frame-options: SAMEORIGIN
  39.  
  40. ---mJW7r7m9---H--
  41. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:[\n\r;`\{]|\|\|?|&&?)[\s\v]*[\s\v\"'-\(,@]*(?:[\"'\.-9A-Z_a-z]+/|(?:[\"'\x5c\^]*[0-9A-Z_a-z][\"'\x5c\^]*:.*|[ \"'\.-9A-Z\x5c\^-_a-z]*)\x5c)?[\"\^]*(?:a[\"\^]*(?:s[\"\^]*s[\"\^]*o[\"\^]*c|t[\"\^ (7601 characters omitted)' against variable `XML:/*' (Value: `\x0ajetpack.testConnection\x0a\x0a' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "815"] [id "932380"] [rev ""] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: \x0ajetpack.testConnection found within XML:/*: \x0ajetpack.testConnection\x0a\x0a"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299226.029033"] [ref "o0,23"]
  42. ModSecurity: Warning. Matched "Operator `Rx' with parameter `[0-9]\s*\'\s*[0-9]' against variable `MATCHED_VAR' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1137"] [id "932240"] [rev ""] [msg "Remote Command Execution: Unix Command Injection evasion attempt detected"] [data "Matched Data: myHT$0Zj8lKRmvGMlE1 found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299226.029033"] [ref "o0,19v35,36v819,8v819,11v819,3v819,11v819,1v819,11v819,11v819,11v819,11v819,11v819,11v819,11v819,11v819,11v819,11v819,11v819,1v819,1v819,11v819,11v819,11v819,11v819,1v819,11v819,1v819,1v819,1v819,1v81 (515 characters omitted)"]
  43. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b[\s\v\"'-\)`]*?(?:![<->]|<[=->]?|>=?|\^|is[\s\v]+not|not[\s\v]+(?:like|r(?:like|egexp)))[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b' against variable `ARGS:token' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "722"] [id "942131"] [rev ""] [msg "SQL Injection Attack: SQL Boolean-based attack detected"] [data "Matched Data: RflT5W81x1^v found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299226.029033"] [ref "o20,12o20,10o31,1v35,36"]
  44. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299226.029033"] [ref ""]
  45.  
  46. ---mJW7r7m9---J--
  47.  
  48. ---mJW7r7m9---K--
  49.  
  50. ---mJW7r7m9---Z--
  51.  
  52. ---9yGKyWst---A--
  53. [08/Mar/2025:08:09:53 -0600] 174144299351.793461 192.0.101.183 23594 10.10.10.2 443
  54. ---9yGKyWst---B--
  55. POST /xmlrpc.php?for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442993&nonce=VFtTBwbKeO&body-hash=l5MGKDtBMCRLlbhRxcm3udBaUGk%3D&signature=2GdXJgy%2BZNlVKojUemEw%2B6hQScc%3D HTTP/1.1
  56. Host: oddcake.net
  57. Authorization: X_JETPACK token="myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0" timestamp="1741442993" nonce="VFtTBwbKeO" body-hash="l5MGKDtBMCRLlbhRxcm3udBaUGk=" signature="2GdXJgy+ZNlVKojUemEw+6hQScc="
  58. User-Agent: Jetpack by WordPress.com
  59. Accept: */*
  60. Accept-Encoding: deflate, gzip, br, zstd
  61. Referer: https://oddcake.net/xmlrpc.php?for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442993&nonce=VFtTBwbKeO&body-hash=l5MGKDtBMCRLlbhRxcm3udBaUGk%3D&signature=2GdXJgy%2BZNlVKojUemEw%2B6hQScc%3D
  62. Content-Type: text/xml
  63. Connection: close
  64. Content-Length: 110
  65.  
  66. ---9yGKyWst---C--
  67. <?xml version="1.0"?>
  68. <methodCall>
  69. <methodName>system.listMethods</methodName>
  70. <params>
  71. </params></methodCall>
  72.  
  73. ---9yGKyWst---E--
  74. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  75.  
  76. ---9yGKyWst---F--
  77. HTTP/1.1 403
  78. Server: nginx
  79. Date: Sat, 08 Mar 2025 14:09:53 GMT
  80. Content-Length: 146
  81. Content-Type: text/html
  82. X-Content-Type-Options: nosniff
  83. Connection: close
  84. X-XSS-Protection: 1; mode=block
  85. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  86. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  87. Referrer-Policy: no-referrer-when-downgrade
  88. x-frame-options: SAMEORIGIN
  89.  
  90. ---9yGKyWst---H--
  91. ModSecurity: Warning. Matched "Operator `Rx' with parameter `[0-9]\s*\'\s*[0-9]' against variable `MATCHED_VAR' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1137"] [id "932240"] [rev ""] [msg "Remote Command Execution: Unix Command Injection evasion attempt detected"] [data "Matched Data: myHT$0Zj8lKRmvGMlE1 found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299351.793461"] [ref "o0,19v35,36v807,8v807,11v807,3v807,11v807,1v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,1v807,1v807,11v807,11v807,11v807,11v807,1v807,11v807,1v807,1v807,1v807,1v80 (508 characters omitted)"]
  92. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b[\s\v\"'-\)`]*?(?:![<->]|<[=->]?|>=?|\^|is[\s\v]+not|not[\s\v]+(?:like|r(?:like|egexp)))[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b' against variable `ARGS:token' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "722"] [id "942131"] [rev ""] [msg "SQL Injection Attack: SQL Boolean-based attack detected"] [data "Matched Data: RflT5W81x1^v found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299351.793461"] [ref "o20,12o20,10o31,1v35,36"]
  93. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `10' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299351.793461"] [ref ""]
  94.  
  95. ---9yGKyWst---J--
  96.  
  97. ---9yGKyWst---K--
  98.  
  99. ---9yGKyWst---Z--
  100.  
  101. ---8j4tgVuU---A--
  102. [08/Mar/2025:08:09:53 -0600] 174144299318.783015 192.0.101.183 23598 10.10.10.2 443
  103. ---8j4tgVuU---B--
  104. GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Ftest-wpcom%2F&timestamp=1741442993&url=https%3A%2F%2Foddcake.net&signature=MVpZsW9VXU4FfFXdTChHFoYTpIBUN2khFhp4bEhKZtHV3%2BtOdg1HLIktRjYltOdjmVoWFEemNpJX7lWel7%2B52H0EV5VdIXnitYEjI9T%2Bo6jKt0UtOMU2u6nBbmzn9r6qRHLVMrVSMdnBxbDajaoMI6Df%2F%2Bl8i%2B4eQ2%2FzYTFVdzQfvcOho51GNjCt1EyuWWAuxcXifrFMEiXDW2bNQpVMi4PXKyGjyOezhIl18ulLasLzZsc0uQI9OYlzupng0NWeZIBSiUrGRvScrbhwZE1xnTnzrl%2B9qjuymijSFC77I4BtZIpnDtQIWUPFOLwA7D3tYEjWYUFpXYVGfYev0hpHVw%3D%3D HTTP/1.1
  105. Host: oddcake.net
  106. User-Agent: WordPress.com; https://jptools.wordpress.com
  107. Accept: */*
  108. Accept-Encoding: deflate, gzip, br, zstd
  109. Referer: https://oddcake.net/?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Ftest-wpcom%2F&timestamp=1741442993&url=https%3A%2F%2Foddcake.net&signature=MVpZsW9VXU4FfFXdTChHFoYTpIBUN2khFhp4bEhKZtHV3%2BtOdg1HLIktRjYltOdjmVoWFEemNpJX7lWel7%2B52H0EV5VdIXnitYEjI9T%2Bo6jKt0UtOMU2u6nBbmzn9r6qRHLVMrVSMdnBxbDajaoMI6Df%2F%2Bl8i%2B4eQ2%2FzYTFVdzQfvcOho51GNjCt1EyuWWAuxcXifrFMEiXDW2bNQpVMi4PXKyGjyOezhIl18ulLasLzZsc0uQI9OYlzupng0NWeZIBSiUrGRvScrbhwZE1xnTnzrl%2B9qjuymijSFC77I4BtZIpnDtQIWUPFOLwA7D3tYEjWYUFpXYVGfYev0hpHVw%3D%3D
  110. Connection: close
  111.  
  112. ---8j4tgVuU---E--
  113. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  114.  
  115. ---8j4tgVuU---F--
  116. HTTP/1.1 403
  117. Server: nginx
  118. Date: Sat, 08 Mar 2025 14:09:53 GMT
  119. Content-Length: 146
  120. Content-Type: text/html
  121. X-Content-Type-Options: nosniff
  122. Connection: close
  123. X-XSS-Protection: 1; mode=block
  124. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  125. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  126. Referrer-Policy: no-referrer-when-downgrade
  127. x-frame-options: SAMEORIGIN
  128.  
  129. ---8j4tgVuU---H--
  130. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:get /[^#\?]*(?:\?[^\s\v#]*)?(?:#[^\s\v]*)?|(?:connect (?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}\.?(?::[0-9]+)?|[\--9A-Z_a-z]+:[0-9]+)|options \*|[a-z]{3,10}[\s\v]+(?:[0-9A-Z_a-z]{3,7}?://[\--9A-Z_a-z]* (76 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Ftest-wpcom%2F&timestamp=1741442993&url=https%3A%2F%2 (396 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Ftest-wpcom%2F&timestamp=1741442993&url=https%3A%2F%2Foddcake.net&signature=MVpZsW9VXU4FfFXdTChHFoYTpIBUN2khFhp4bEhKZtHV3%2BtOdg1HLIktRjYltOdjmVoWFEemNpJ (296 characters omitted)"] [severity "4"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299318.783015"] [ref "v0,496"]
  131. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `StrEq' with parameter `0' against variable `TX:MSC_PCRE_LIMITS_EXCEEDED' (Value: `1' ) [file "/etc/nginx/modsec/modsecurity.conf"] [line "147"] [id "200005"] [rev ""] [msg "ModSecurity internal error flagged: TX:MSC_PCRE_LIMITS_EXCEEDED"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299318.783015"] [ref ""]
  132.  
  133. ---8j4tgVuU---J--
  134.  
  135. ---8j4tgVuU---K--
  136.  
  137. ---8j4tgVuU---Z--
  138.  
  139. ---sCkBCEh8---A--
  140. [08/Mar/2025:08:09:53 -0600] 174144299329.597005 192.0.101.183 23600 10.10.10.2 443
  141. ---sCkBCEh8---B--
  142. POST /xmlrpc.php?for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442993&nonce=tuiRcYRFZ1&body-hash=METbiCw%2BtMQdctk0fdLMNlXOKKM%3D&signature=dAHtkHBsyUYHsI6U4MKyP5TabGQ%3D HTTP/1.1
  143. Host: oddcake.net
  144. Authorization: X_JETPACK token="myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0" timestamp="1741442993" nonce="tuiRcYRFZ1" body-hash="METbiCw+tMQdctk0fdLMNlXOKKM=" signature="dAHtkHBsyUYHsI6U4MKyP5TabGQ="
  145. User-Agent: Jetpack by WordPress.com
  146. Accept: */*
  147. Accept-Encoding: deflate, gzip, br, zstd
  148. Referer: https://oddcake.net/xmlrpc.php?for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442993&nonce=tuiRcYRFZ1&body-hash=METbiCw%2BtMQdctk0fdLMNlXOKKM%3D&signature=dAHtkHBsyUYHsI6U4MKyP5TabGQ%3D
  149. Content-Type: text/xml
  150. Connection: close
  151. Content-Length: 116
  152.  
  153. ---sCkBCEh8---C--
  154. <?xml version="1.0"?>
  155. <methodCall>
  156. <methodName>jetpack.getHeartbeatData</methodName>
  157. <params>
  158. </params></methodCall>
  159.  
  160. ---sCkBCEh8---E--
  161. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  162.  
  163. ---sCkBCEh8---F--
  164. HTTP/1.1 403
  165. Server: nginx
  166. Date: Sat, 08 Mar 2025 14:09:53 GMT
  167. Content-Length: 146
  168. Content-Type: text/html
  169. X-Content-Type-Options: nosniff
  170. Connection: close
  171. X-XSS-Protection: 1; mode=block
  172. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  173. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  174. Referrer-Policy: no-referrer-when-downgrade
  175. x-frame-options: SAMEORIGIN
  176.  
  177. ---sCkBCEh8---H--
  178. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:[\n\r;`\{]|\|\|?|&&?)[\s\v]*[\s\v\"'-\(,@]*(?:[\"'\.-9A-Z_a-z]+/|(?:[\"'\x5c\^]*[0-9A-Z_a-z][\"'\x5c\^]*:.*|[ \"'\.-9A-Z\x5c\^-_a-z]*)\x5c)?[\"\^]*(?:a[\"\^]*(?:s[\"\^]*s[\"\^]*o[\"\^]*c|t[\"\^ (7601 characters omitted)' against variable `XML:/*' (Value: `\x0ajetpack.getHeartbeatData\x0a\x0a' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "815"] [id "932380"] [rev ""] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: \x0ajetpack.getHeartbeatData found within XML:/*: \x0ajetpack.getHeartbeatData\x0a\x0a"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299329.597005"] [ref "o0,25"]
  179. ModSecurity: Warning. Matched "Operator `Rx' with parameter `[0-9]\s*\'\s*[0-9]' against variable `MATCHED_VAR' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1137"] [id "932240"] [rev ""] [msg "Remote Command Execution: Unix Command Injection evasion attempt detected"] [data "Matched Data: myHT$0Zj8lKRmvGMlE1 found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299329.597005"] [ref "o0,19v35,36v803,8v803,11v803,3v803,11v803,1v803,11v803,11v803,11v803,11v803,11v803,11v803,11v803,11v803,11v803,11v803,11v803,1v803,1v803,11v803,11v803,11v803,11v803,1v803,11v803,1v803,1v803,1v803,1v80 (515 characters omitted)"]
  180. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b[\s\v\"'-\)`]*?(?:![<->]|<[=->]?|>=?|\^|is[\s\v]+not|not[\s\v]+(?:like|r(?:like|egexp)))[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b' against variable `ARGS:token' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "722"] [id "942131"] [rev ""] [msg "SQL Injection Attack: SQL Boolean-based attack detected"] [data "Matched Data: RflT5W81x1^v found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299329.597005"] [ref "o20,12o20,10o31,1v35,36"]
  181. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299329.597005"] [ref ""]
  182.  
  183. ---sCkBCEh8---J--
  184.  
  185. ---sCkBCEh8---K--
  186.  
  187. ---sCkBCEh8---Z--
  188.  
  189. ---wz3edLcH---A--
  190. [08/Mar/2025:08:09:53 -0600] 174144299390.700761 192.0.101.183 23602 10.10.10.2 443
  191. ---wz3edLcH---B--
  192. GET /?rest_route=%2Fjetpack%2Fv4%2Fheartbeat%2Fdata%2F&_for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442993&nonce=Xnqgz65QTk&body-hash&signature=Pe8FRuRbZmdbdGjYjjuh%2F5vI%2BHs%3D HTTP/1.1
  193. Host: oddcake.net
  194. Authorization: X_JETPACK token="myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0" timestamp="1741442993" nonce="Xnqgz65QTk" body-hash="" signature="Pe8FRuRbZmdbdGjYjjuh/5vI+Hs="
  195. User-Agent: Jetpack by WordPress.com
  196. Accept: */*
  197. Accept-Encoding: deflate, gzip, br, zstd
  198. Referer: https://oddcake.net/?rest_route=%2Fjetpack%2Fv4%2Fheartbeat%2Fdata%2F&_for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442993&nonce=Xnqgz65QTk&body-hash&signature=Pe8FRuRbZmdbdGjYjjuh%2F5vI%2BHs%3D
  199. Connection: close
  200.  
  201. ---wz3edLcH---E--
  202. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  203.  
  204. ---wz3edLcH---F--
  205. HTTP/1.1 403
  206. Server: nginx
  207. Date: Sat, 08 Mar 2025 14:09:53 GMT
  208. Content-Length: 146
  209. Content-Type: text/html
  210. X-Content-Type-Options: nosniff
  211. Connection: close
  212. X-XSS-Protection: 1; mode=block
  213. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  214. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  215. Referrer-Policy: no-referrer-when-downgrade
  216. x-frame-options: SAMEORIGIN
  217.  
  218. ---wz3edLcH---H--
  219. ModSecurity: Warning. Matched "Operator `Rx' with parameter `[0-9]\s*\'\s*[0-9]' against variable `MATCHED_VAR' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1137"] [id "932240"] [rev ""] [msg "Remote Command Execution: Unix Command Injection evasion attempt detected"] [data "Matched Data: myHT$0Zj8lKRmvGMlE1 found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299390.700761"] [ref "o0,19v74,36v753,1v753,3v753,1v753,1v753,1v753,1v753,1v753,1v753,1v753,1v753,1v753,1v753,1v753,1v753,1v753,11v753,11v753,1v753,1v753,11v753,11v753,11v753,11v753,1v753,11v753,1v753,1v753,1v753,1v753,1v7 (456 characters omitted)"]
  220. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b[\s\v\"'-\)`]*?(?:![<->]|<[=->]?|>=?|\^|is[\s\v]+not|not[\s\v]+(?:like|r(?:like|egexp)))[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b' against variable `ARGS:token' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "722"] [id "942131"] [rev ""] [msg "SQL Injection Attack: SQL Boolean-based attack detected"] [data "Matched Data: RflT5W81x1^v found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299390.700761"] [ref "o20,12o20,10o31,1v74,36"]
  221. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `10' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299390.700761"] [ref ""]
  222.  
  223. ---wz3edLcH---J--
  224.  
  225. ---wz3edLcH---K--
  226.  
  227. ---wz3edLcH---Z--
  228.  
  229. ---ur8VlI3j---A--
  230. [08/Mar/2025:08:09:54 -0600] 174144299459.816749 192.0.101.183 23604 10.10.10.2 443
  231. ---ur8VlI3j---B--
  232. GET /?rest_route=%2Fjetpack%2Fv4%2Fsync%2Fstatus&_for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442993&nonce=5fGS5TqCLq&body-hash&signature=28UILS2lNnvGh1e%2B%2FyvNjKdZvOI%3D HTTP/1.1
  233. Host: oddcake.net
  234. Authorization: X_JETPACK token="myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0" timestamp="1741442993" nonce="5fGS5TqCLq" body-hash="" signature="28UILS2lNnvGh1e+/yvNjKdZvOI="
  235. User-Agent: Jetpack by WordPress.com
  236. Accept: */*
  237. Accept-Encoding: deflate, gzip, br, zstd
  238. Referer: https://oddcake.net/?rest_route=%2Fjetpack%2Fv4%2Fsync%2Fstatus&_for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442993&nonce=5fGS5TqCLq&body-hash&signature=28UILS2lNnvGh1e%2B%2FyvNjKdZvOI%3D
  239. Connection: close
  240.  
  241. ---ur8VlI3j---E--
  242. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  243.  
  244. ---ur8VlI3j---F--
  245. HTTP/1.1 403
  246. Server: nginx
  247. Date: Sat, 08 Mar 2025 14:09:54 GMT
  248. Content-Length: 146
  249. Content-Type: text/html
  250. X-Content-Type-Options: nosniff
  251. Connection: close
  252. X-XSS-Protection: 1; mode=block
  253. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  254. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  255. Referrer-Policy: no-referrer-when-downgrade
  256. x-frame-options: SAMEORIGIN
  257.  
  258. ---ur8VlI3j---H--
  259. ModSecurity: Warning. Matched "Operator `Rx' with parameter `[0-9]\s*\'\s*[0-9]' against variable `MATCHED_VAR' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1137"] [id "932240"] [rev ""] [msg "Remote Command Execution: Unix Command Injection evasion attempt detected"] [data "Matched Data: myHT$0Zj8lKRmvGMlE1 found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299459.816749"] [ref "o0,19v68,36v741,1v741,3v741,1v741,1v741,1v741,1v741,1v741,1v741,1v741,1v741,1v741,1v741,1v741,1v741,1v741,11v741,11v741,1v741,1v741,11v741,11v741,11v741,11v741,1v741,11v741,1v741,1v741,1v741,1v741,1v7 (456 characters omitted)"]
  260. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b[\s\v\"'-\)`]*?(?:![<->]|<[=->]?|>=?|\^|is[\s\v]+not|not[\s\v]+(?:like|r(?:like|egexp)))[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b' against variable `ARGS:token' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "722"] [id "942131"] [rev ""] [msg "SQL Injection Attack: SQL Boolean-based attack detected"] [data "Matched Data: RflT5W81x1^v found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299459.816749"] [ref "o20,12o20,10o31,1v68,36"]
  261. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `10' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299459.816749"] [ref ""]
  262.  
  263. ---ur8VlI3j---J--
  264.  
  265. ---ur8VlI3j---K--
  266.  
  267. ---ur8VlI3j---Z--
  268.  
  269. ---aWkjZgbR---A--
  270. [08/Mar/2025:08:09:54 -0600] 174144299457.765841 192.0.101.183 23612 10.10.10.2 443
  271. ---aWkjZgbR---B--
  272. GET /?rest_route=%2F&_for=jetpack&token=pPLtpiwrI%2A%5EF%24Jq5sN%2Aq88ayi0zN%237%26x%3A1%3A1&timestamp=1741442994&nonce=tVZfQ1BQIG&body-hash&signature=o%2FVIyE1CxJFI7FRCaQGjDJVarZY%3D HTTP/1.1
  273. Host: oddcake.net
  274. Authorization: X_JETPACK token="pPLtpiwrI*^F$Jq5sN*q88ayi0zN#7&x:1:1" timestamp="1741442994" nonce="tVZfQ1BQIG" body-hash="" signature="o/VIyE1CxJFI7FRCaQGjDJVarZY="
  275. User-Agent: Jetpack by WordPress.com
  276. Accept: */*
  277. Accept-Encoding: deflate, gzip, br, zstd
  278. Referer: https://oddcake.net/?rest_route=%2F&_for=jetpack&token=pPLtpiwrI%2A%5EF%24Jq5sN%2Aq88ayi0zN%237%26x%3A1%3A1&timestamp=1741442994&nonce=tVZfQ1BQIG&body-hash&signature=o%2FVIyE1CxJFI7FRCaQGjDJVarZY%3D
  279. Connection: close
  280.  
  281. ---aWkjZgbR---E--
  282. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  283.  
  284. ---aWkjZgbR---F--
  285. HTTP/1.1 403
  286. Server: nginx
  287. Date: Sat, 08 Mar 2025 14:09:54 GMT
  288. Content-Length: 146
  289. Content-Type: text/html
  290. X-Content-Type-Options: nosniff
  291. Connection: close
  292. X-XSS-Protection: 1; mode=block
  293. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  294. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  295. Referrer-Policy: no-referrer-when-downgrade
  296. x-frame-options: SAMEORIGIN
  297.  
  298. ---aWkjZgbR---H--
  299. ModSecurity: Warning. Matched "Operator `Rx' with parameter `[0-9]\s*\'\s*[0-9]' against variable `MATCHED_VAR' (Value: `pPLtpiwrI*^F$Jq5sN*q88ayi0zN#7&x:1:1' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1137"] [id "932240"] [rev ""] [msg "Remote Command Execution: Unix Command Injection evasion attempt detected"] [data "Matched Data: F$Jq5sN*q88ayi0zN#7 found within ARGS:token: pPLtpiwrI*^F$Jq5sN*q88ayi0zN#7&x:1:1"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299457.765841"] [ref "o11,19v40,36v693,1v693,3v693,1v693,1v693,1v693,1v693,1v693,1v693,1v693,1v693,1v693,1v693,1v693,1v693,1v693,11v693,11v693,1v693,1v693,11v693,11v693,11v693,11v693,1v693,11v693,1v693,1v693,1v693,1v693,1v (458 characters omitted)"]
  300. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299457.765841"] [ref ""]
  301.  
  302. ---aWkjZgbR---J--
  303.  
  304. ---aWkjZgbR---K--
  305.  
  306. ---aWkjZgbR---Z--
  307.  
  308. ---tLb3YICS---A--
  309. [08/Mar/2025:08:09:54 -0600] 174144299494.825482 192.0.101.183 23624 10.10.10.2 443
  310. ---tLb3YICS---B--
  311. GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442994&url=https%3A%2F%2Foddcake.net&signature=DhZ%2FYNk%2B1l5MpziOUCt81XmlWXumfp%2BBGRizT2PncGmy5LPYzfQ9Xy%2Bj0q9Zcpc1OTNCbekBjRRDkiiB6Fr7m9axSLic1rbJiqCxNp%2FRgJpePVucXgQOyRUP0bTl79%2FUgrqn1APchmGe%2BI9%2BvhpEDZ4HqpZOmai75QNONaKabyZB%2BQpsiI%2FUxSIVQd3UY8alZdHy0Y02YkaM9u57b5Ry7l1Vy9%2B%2F1UrNJwMW4T1W88Fyew16iyPl%2B5OKpodCZA0Oi4wngVqFCpZLUg4bWOmwAUd1gyHPqv6ogExIuZOSL9dEzM7v8HCBsy6Jj9L3Ub5%2BmMYJSAcYUiyb%2BkiPWjIikw%3D%3D HTTP/1.1
  312. Host: oddcake.net
  313. User-Agent: WordPress.com; https://jptools.wordpress.com
  314. Accept: */*
  315. Accept-Encoding: deflate, gzip, br, zstd
  316. Referer: https://oddcake.net/?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442994&url=https%3A%2F%2Foddcake.net&signature=DhZ%2FYNk%2B1l5MpziOUCt81XmlWXumfp%2BBGRizT2PncGmy5LPYzfQ9Xy%2Bj0q9Zcpc1OTNCbekBjRRDkiiB6Fr7m9axSLic1rbJiqCxNp%2FRgJpePVucXgQOyRUP0bTl79%2FUgrqn1APchmGe%2BI9%2BvhpEDZ4HqpZOmai75QNONaKabyZB%2BQpsiI%2FUxSIVQd3UY8alZdHy0Y02YkaM9u57b5Ry7l1Vy9%2B%2F1UrNJwMW4T1W88Fyew16iyPl%2B5OKpodCZA0Oi4wngVqFCpZLUg4bWOmwAUd1gyHPqv6ogExIuZOSL9dEzM7v8HCBsy6Jj9L3Ub5%2BmMYJSAcYUiyb%2BkiPWjIikw%3D%3D
  317. Connection: close
  318.  
  319. ---tLb3YICS---E--
  320. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  321.  
  322. ---tLb3YICS---F--
  323. HTTP/1.1 403
  324. Server: nginx
  325. Date: Sat, 08 Mar 2025 14:09:54 GMT
  326. Content-Length: 146
  327. Content-Type: text/html
  328. X-Content-Type-Options: nosniff
  329. Connection: close
  330. X-XSS-Protection: 1; mode=block
  331. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  332. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  333. Referrer-Policy: no-referrer-when-downgrade
  334. x-frame-options: SAMEORIGIN
  335.  
  336. ---tLb3YICS---H--
  337. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:get /[^#\?]*(?:\?[^\s\v#]*)?(?:#[^\s\v]*)?|(?:connect (?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}\.?(?::[0-9]+)?|[\--9A-Z_a-z]+:[0-9]+)|options \*|[a-z]{3,10}[\s\v]+(?:[0-9A-Z_a-z]{3,7}?://[\--9A-Z_a-z]* (76 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442994&url=https%3A%2F%2Fod (407 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442994&url=https%3A%2F%2Foddcake.net&signature=DhZ%2FYNk%2B1l5MpziOUCt81XmlWXumfp%2BBGRizT2PncGmy5LPYzfQ9Xy%2Bj0q9Zcpc1OTNCbekB (307 characters omitted)"] [severity "4"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299494.825482"] [ref "v0,507"]
  338. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `StrEq' with parameter `0' against variable `TX:MSC_PCRE_LIMITS_EXCEEDED' (Value: `1' ) [file "/etc/nginx/modsec/modsecurity.conf"] [line "147"] [id "200005"] [rev ""] [msg "ModSecurity internal error flagged: TX:MSC_PCRE_LIMITS_EXCEEDED"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299494.825482"] [ref ""]
  339.  
  340. ---tLb3YICS---J--
  341.  
  342. ---tLb3YICS---K--
  343.  
  344. ---tLb3YICS---Z--
  345.  
  346. ---FD4sZg7R---A--
  347. [08/Mar/2025:08:09:54 -0600] 174144299456.423020 192.0.101.183 23638 10.10.10.2 443
  348. ---FD4sZg7R---B--
  349. GET /?rest_route=%2Fjetpack%2Fv4%2Ffeatures%2Favailable&_for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442994&nonce=P8QWRRnEJQ&body-hash&signature=4dC3LILihpfyg8ClrsNFo%2BFrtQE%3D HTTP/1.1
  350. Host: oddcake.net
  351. Authorization: X_JETPACK token="myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0" timestamp="1741442994" nonce="P8QWRRnEJQ" body-hash="" signature="4dC3LILihpfyg8ClrsNFo+FrtQE="
  352. User-Agent: Jetpack by WordPress.com
  353. Accept: */*
  354. Accept-Encoding: deflate, gzip, br, zstd
  355. Referer: https://oddcake.net/?rest_route=%2Fjetpack%2Fv4%2Ffeatures%2Favailable&_for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442994&nonce=P8QWRRnEJQ&body-hash&signature=4dC3LILihpfyg8ClrsNFo%2BFrtQE%3D
  356. Connection: close
  357.  
  358. ---FD4sZg7R---E--
  359. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  360.  
  361. ---FD4sZg7R---F--
  362. HTTP/1.1 403
  363. Server: nginx
  364. Date: Sat, 08 Mar 2025 14:09:54 GMT
  365. Content-Length: 146
  366. Content-Type: text/html
  367. X-Content-Type-Options: nosniff
  368. Connection: close
  369. X-XSS-Protection: 1; mode=block
  370. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  371. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  372. Referrer-Policy: no-referrer-when-downgrade
  373. x-frame-options: SAMEORIGIN
  374.  
  375. ---FD4sZg7R---H--
  376. ModSecurity: Warning. Matched "Operator `Rx' with parameter `[0-9]\s*\'\s*[0-9]' against variable `MATCHED_VAR' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1137"] [id "932240"] [rev ""] [msg "Remote Command Execution: Unix Command Injection evasion attempt detected"] [data "Matched Data: myHT$0Zj8lKRmvGMlE1 found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299456.423020"] [ref "o0,19v75,36v751,1v751,3v751,1v751,1v751,1v751,1v751,1v751,1v751,1v751,1v751,1v751,1v751,1v751,1v751,1v751,11v751,11v751,1v751,1v751,11v751,11v751,11v751,11v751,1v751,11v751,1v751,1v751,1v751,1v751,1v7 (456 characters omitted)"]
  377. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b[\s\v\"'-\)`]*?(?:![<->]|<[=->]?|>=?|\^|is[\s\v]+not|not[\s\v]+(?:like|r(?:like|egexp)))[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b' against variable `ARGS:token' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "722"] [id "942131"] [rev ""] [msg "SQL Injection Attack: SQL Boolean-based attack detected"] [data "Matched Data: RflT5W81x1^v found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299456.423020"] [ref "o20,12o20,10o31,1v75,36"]
  378. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `10' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299456.423020"] [ref ""]
  379.  
  380. ---FD4sZg7R---J--
  381.  
  382. ---FD4sZg7R---K--
  383.  
  384. ---FD4sZg7R---Z--
  385.  
  386. ---XFuGVxx5---A--
  387. [08/Mar/2025:08:09:54 -0600] 174144299479.386571 192.0.101.183 23646 10.10.10.2 443
  388. ---XFuGVxx5---B--
  389. POST /xmlrpc.php?for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442994&nonce=uVJdJ7sBiX&body-hash=YpK8wg675VHNMMeuAm1muupdBq8%3D&signature=Rw2cNQE0mnqgxroBVhA6cPmryjg%3D HTTP/1.1
  390. Host: oddcake.net
  391. Authorization: X_JETPACK token="myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0" timestamp="1741442994" nonce="uVJdJ7sBiX" body-hash="YpK8wg675VHNMMeuAm1muupdBq8=" signature="Rw2cNQE0mnqgxroBVhA6cPmryjg="
  392. User-Agent: Jetpack by WordPress.com
  393. Accept: */*
  394. Accept-Encoding: deflate, gzip, br, zstd
  395. Referer: https://oddcake.net/xmlrpc.php?for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442994&nonce=uVJdJ7sBiX&body-hash=YpK8wg675VHNMMeuAm1muupdBq8%3D&signature=Rw2cNQE0mnqgxroBVhA6cPmryjg%3D
  396. Content-Type: text/xml
  397. Connection: close
  398. Content-Length: 117
  399.  
  400. ---XFuGVxx5---C--
  401. <?xml version="1.0"?>
  402. <methodCall>
  403. <methodName>jetpack.featuresAvailable</methodName>
  404. <params>
  405. </params></methodCall>
  406.  
  407. ---XFuGVxx5---E--
  408. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  409.  
  410. ---XFuGVxx5---F--
  411. HTTP/1.1 403
  412. Server: nginx
  413. Date: Sat, 08 Mar 2025 14:09:54 GMT
  414. Content-Length: 146
  415. Content-Type: text/html
  416. X-Content-Type-Options: nosniff
  417. Connection: close
  418. X-XSS-Protection: 1; mode=block
  419. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  420. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  421. Referrer-Policy: no-referrer-when-downgrade
  422. x-frame-options: SAMEORIGIN
  423.  
  424. ---XFuGVxx5---H--
  425. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:[\n\r;`\{]|\|\|?|&&?)[\s\v]*[\s\v\"'-\(,@]*(?:[\"'\.-9A-Z_a-z]+/|(?:[\"'\x5c\^]*[0-9A-Z_a-z][\"'\x5c\^]*:.*|[ \"'\.-9A-Z\x5c\^-_a-z]*)\x5c)?[\"\^]*(?:a[\"\^]*(?:s[\"\^]*s[\"\^]*o[\"\^]*c|t[\"\^ (7601 characters omitted)' against variable `XML:/*' (Value: `\x0ajetpack.featuresAvailable\x0a\x0a' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "815"] [id "932380"] [rev ""] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: \x0ajetpack.featuresAvailable found within XML:/*: \x0ajetpack.featuresAvailable\x0a\x0a"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299479.386571"] [ref "o0,26"]
  426. ModSecurity: Warning. Matched "Operator `Rx' with parameter `[0-9]\s*\'\s*[0-9]' against variable `MATCHED_VAR' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1137"] [id "932240"] [rev ""] [msg "Remote Command Execution: Unix Command Injection evasion attempt detected"] [data "Matched Data: myHT$0Zj8lKRmvGMlE1 found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299479.386571"] [ref "o0,19v35,36v799,8v799,11v799,3v799,11v799,1v799,11v799,11v799,11v799,11v799,11v799,11v799,11v799,11v799,11v799,11v799,11v799,1v799,1v799,11v799,11v799,11v799,11v799,1v799,11v799,1v799,1v799,1v799,1v79 (515 characters omitted)"]
  427. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b[\s\v\"'-\)`]*?(?:![<->]|<[=->]?|>=?|\^|is[\s\v]+not|not[\s\v]+(?:like|r(?:like|egexp)))[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b' against variable `ARGS:token' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "722"] [id "942131"] [rev ""] [msg "SQL Injection Attack: SQL Boolean-based attack detected"] [data "Matched Data: RflT5W81x1^v found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299479.386571"] [ref "o20,12o20,10o31,1v35,36"]
  428. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299479.386571"] [ref ""]
  429.  
  430. ---XFuGVxx5---J--
  431.  
  432. ---XFuGVxx5---K--
  433.  
  434. ---XFuGVxx5---Z--
  435.  
  436. ---Thm2OORF---A--
  437. [08/Mar/2025:08:09:55 -0600] 174144299558.072683 192.0.101.183 23660 10.10.10.2 443
  438. ---Thm2OORF---B--
  439. GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442994&url=https%3A%2F%2Foddcake.net&signature=DhZ%2FYNk%2B1l5MpziOUCt81XmlWXumfp%2BBGRizT2PncGmy5LPYzfQ9Xy%2Bj0q9Zcpc1OTNCbekBjRRDkiiB6Fr7m9axSLic1rbJiqCxNp%2FRgJpePVucXgQOyRUP0bTl79%2FUgrqn1APchmGe%2BI9%2BvhpEDZ4HqpZOmai75QNONaKabyZB%2BQpsiI%2FUxSIVQd3UY8alZdHy0Y02YkaM9u57b5Ry7l1Vy9%2B%2F1UrNJwMW4T1W88Fyew16iyPl%2B5OKpodCZA0Oi4wngVqFCpZLUg4bWOmwAUd1gyHPqv6ogExIuZOSL9dEzM7v8HCBsy6Jj9L3Ub5%2BmMYJSAcYUiyb%2BkiPWjIikw%3D%3D HTTP/1.1
  440. Host: oddcake.net
  441. User-Agent: WordPress.com; https://jptools.wordpress.com
  442. Accept: */*
  443. Accept-Encoding: deflate, gzip, br, zstd
  444. Referer: https://oddcake.net/?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442994&url=https%3A%2F%2Foddcake.net&signature=DhZ%2FYNk%2B1l5MpziOUCt81XmlWXumfp%2BBGRizT2PncGmy5LPYzfQ9Xy%2Bj0q9Zcpc1OTNCbekBjRRDkiiB6Fr7m9axSLic1rbJiqCxNp%2FRgJpePVucXgQOyRUP0bTl79%2FUgrqn1APchmGe%2BI9%2BvhpEDZ4HqpZOmai75QNONaKabyZB%2BQpsiI%2FUxSIVQd3UY8alZdHy0Y02YkaM9u57b5Ry7l1Vy9%2B%2F1UrNJwMW4T1W88Fyew16iyPl%2B5OKpodCZA0Oi4wngVqFCpZLUg4bWOmwAUd1gyHPqv6ogExIuZOSL9dEzM7v8HCBsy6Jj9L3Ub5%2BmMYJSAcYUiyb%2BkiPWjIikw%3D%3D
  445. Connection: close
  446.  
  447. ---Thm2OORF---E--
  448. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  449.  
  450. ---Thm2OORF---F--
  451. HTTP/1.1 403
  452. Server: nginx
  453. Date: Sat, 08 Mar 2025 14:09:55 GMT
  454. Content-Length: 146
  455. Content-Type: text/html
  456. X-Content-Type-Options: nosniff
  457. Connection: close
  458. X-XSS-Protection: 1; mode=block
  459. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  460. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  461. Referrer-Policy: no-referrer-when-downgrade
  462. x-frame-options: SAMEORIGIN
  463.  
  464. ---Thm2OORF---H--
  465. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:get /[^#\?]*(?:\?[^\s\v#]*)?(?:#[^\s\v]*)?|(?:connect (?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}\.?(?::[0-9]+)?|[\--9A-Z_a-z]+:[0-9]+)|options \*|[a-z]{3,10}[\s\v]+(?:[0-9A-Z_a-z]{3,7}?://[\--9A-Z_a-z]* (76 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442994&url=https%3A%2F%2Fod (407 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442994&url=https%3A%2F%2Foddcake.net&signature=DhZ%2FYNk%2B1l5MpziOUCt81XmlWXumfp%2BBGRizT2PncGmy5LPYzfQ9Xy%2Bj0q9Zcpc1OTNCbekB (307 characters omitted)"] [severity "4"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299558.072683"] [ref "v0,507"]
  466. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `StrEq' with parameter `0' against variable `TX:MSC_PCRE_LIMITS_EXCEEDED' (Value: `1' ) [file "/etc/nginx/modsec/modsecurity.conf"] [line "147"] [id "200005"] [rev ""] [msg "ModSecurity internal error flagged: TX:MSC_PCRE_LIMITS_EXCEEDED"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299558.072683"] [ref ""]
  467.  
  468. ---Thm2OORF---J--
  469.  
  470. ---Thm2OORF---K--
  471.  
  472. ---Thm2OORF---Z--
  473.  
  474. ---h2IFIShX---A--
  475. [08/Mar/2025:08:09:55 -0600] 174144299562.479955 192.0.101.183 23664 10.10.10.2 443
  476. ---h2IFIShX---B--
  477. GET /?rest_route=%2Fjetpack%2Fv4%2Ffeatures%2Fenabled&_for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442995&nonce=R7pT31bORD&body-hash&signature=vtJCdrXDRrJ0Xko3D%2F%2BmRbjUEYo%3D HTTP/1.1
  478. Host: oddcake.net
  479. Authorization: X_JETPACK token="myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0" timestamp="1741442995" nonce="R7pT31bORD" body-hash="" signature="vtJCdrXDRrJ0Xko3D/+mRbjUEYo="
  480. User-Agent: Jetpack by WordPress.com
  481. Accept: */*
  482. Accept-Encoding: deflate, gzip, br, zstd
  483. Referer: https://oddcake.net/?rest_route=%2Fjetpack%2Fv4%2Ffeatures%2Fenabled&_for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442995&nonce=R7pT31bORD&body-hash&signature=vtJCdrXDRrJ0Xko3D%2F%2BmRbjUEYo%3D
  484. Connection: close
  485.  
  486. ---h2IFIShX---E--
  487. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  488.  
  489. ---h2IFIShX---F--
  490. HTTP/1.1 403
  491. Server: nginx
  492. Date: Sat, 08 Mar 2025 14:09:55 GMT
  493. Content-Length: 146
  494. Content-Type: text/html
  495. X-Content-Type-Options: nosniff
  496. Connection: close
  497. X-XSS-Protection: 1; mode=block
  498. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  499. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  500. Referrer-Policy: no-referrer-when-downgrade
  501. x-frame-options: SAMEORIGIN
  502.  
  503. ---h2IFIShX---H--
  504. ModSecurity: Warning. Matched "Operator `Rx' with parameter `[0-9]\s*\'\s*[0-9]' against variable `MATCHED_VAR' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1137"] [id "932240"] [rev ""] [msg "Remote Command Execution: Unix Command Injection evasion attempt detected"] [data "Matched Data: myHT$0Zj8lKRmvGMlE1 found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299562.479955"] [ref "o0,19v73,36v751,1v751,3v751,1v751,1v751,1v751,1v751,1v751,1v751,1v751,1v751,1v751,1v751,1v751,1v751,1v751,11v751,11v751,1v751,1v751,11v751,11v751,11v751,11v751,1v751,11v751,1v751,1v751,1v751,1v751,1v7 (456 characters omitted)"]
  505. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b[\s\v\"'-\)`]*?(?:![<->]|<[=->]?|>=?|\^|is[\s\v]+not|not[\s\v]+(?:like|r(?:like|egexp)))[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b' against variable `ARGS:token' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "722"] [id "942131"] [rev ""] [msg "SQL Injection Attack: SQL Boolean-based attack detected"] [data "Matched Data: RflT5W81x1^v found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299562.479955"] [ref "o20,12o20,10o31,1v73,36"]
  506. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `10' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299562.479955"] [ref ""]
  507.  
  508. ---h2IFIShX---J--
  509.  
  510. ---h2IFIShX---K--
  511.  
  512. ---h2IFIShX---Z--
  513.  
  514. ---glNDPUew---A--
  515. [08/Mar/2025:08:09:55 -0600] 174144299550.436145 192.0.101.183 23680 10.10.10.2 443
  516. ---glNDPUew---B--
  517. POST /xmlrpc.php?for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442995&nonce=DwLMjcuqXZ&body-hash=h2%2BsjEWmrXuLoPmTZBJXbegPpI8%3D&signature=DdhkjOaHjTIwiyz0MHMktwR%2BLeo%3D HTTP/1.1
  518. Host: oddcake.net
  519. Authorization: X_JETPACK token="myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0" timestamp="1741442995" nonce="DwLMjcuqXZ" body-hash="h2+sjEWmrXuLoPmTZBJXbegPpI8=" signature="DdhkjOaHjTIwiyz0MHMktwR+Leo="
  520. User-Agent: Jetpack by WordPress.com
  521. Accept: */*
  522. Accept-Encoding: deflate, gzip, br, zstd
  523. Referer: https://oddcake.net/xmlrpc.php?for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442995&nonce=DwLMjcuqXZ&body-hash=h2%2BsjEWmrXuLoPmTZBJXbegPpI8%3D&signature=DdhkjOaHjTIwiyz0MHMktwR%2BLeo%3D
  524. Content-Type: text/xml
  525. Connection: close
  526. Content-Length: 115
  527.  
  528. ---glNDPUew---C--
  529. <?xml version="1.0"?>
  530. <methodCall>
  531. <methodName>jetpack.featuresEnabled</methodName>
  532. <params>
  533. </params></methodCall>
  534.  
  535. ---glNDPUew---E--
  536. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  537.  
  538. ---glNDPUew---F--
  539. HTTP/1.1 403
  540. Server: nginx
  541. Date: Sat, 08 Mar 2025 14:09:55 GMT
  542. Content-Length: 146
  543. Content-Type: text/html
  544. X-Content-Type-Options: nosniff
  545. Connection: close
  546. X-XSS-Protection: 1; mode=block
  547. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  548. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  549. Referrer-Policy: no-referrer-when-downgrade
  550. x-frame-options: SAMEORIGIN
  551.  
  552. ---glNDPUew---H--
  553. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:[\n\r;`\{]|\|\|?|&&?)[\s\v]*[\s\v\"'-\(,@]*(?:[\"'\.-9A-Z_a-z]+/|(?:[\"'\x5c\^]*[0-9A-Z_a-z][\"'\x5c\^]*:.*|[ \"'\.-9A-Z\x5c\^-_a-z]*)\x5c)?[\"\^]*(?:a[\"\^]*(?:s[\"\^]*s[\"\^]*o[\"\^]*c|t[\"\^ (7601 characters omitted)' against variable `XML:/*' (Value: `\x0ajetpack.featuresEnabled\x0a\x0a' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "815"] [id "932380"] [rev ""] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: \x0ajetpack.featuresEnabled found within XML:/*: \x0ajetpack.featuresEnabled\x0a\x0a"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299550.436145"] [ref "o0,24"]
  554. ModSecurity: Warning. Matched "Operator `Rx' with parameter `[0-9]\s*\'\s*[0-9]' against variable `MATCHED_VAR' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1137"] [id "932240"] [rev ""] [msg "Remote Command Execution: Unix Command Injection evasion attempt detected"] [data "Matched Data: myHT$0Zj8lKRmvGMlE1 found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299550.436145"] [ref "o0,19v35,36v807,8v807,11v807,3v807,11v807,1v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,1v807,1v807,11v807,11v807,11v807,11v807,1v807,11v807,1v807,1v807,1v807,1v80 (515 characters omitted)"]
  555. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b[\s\v\"'-\)`]*?(?:![<->]|<[=->]?|>=?|\^|is[\s\v]+not|not[\s\v]+(?:like|r(?:like|egexp)))[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b' against variable `ARGS:token' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "722"] [id "942131"] [rev ""] [msg "SQL Injection Attack: SQL Boolean-based attack detected"] [data "Matched Data: RflT5W81x1^v found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299550.436145"] [ref "o20,12o20,10o31,1v35,36"]
  556. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299550.436145"] [ref ""]
  557.  
  558. ---glNDPUew---J--
  559.  
  560. ---glNDPUew---K--
  561.  
  562. ---glNDPUew---Z--
  563.  
  564. ---hWACT8Gw---A--
  565. [08/Mar/2025:08:09:55 -0600] 174144299575.258469 192.0.101.183 23694 10.10.10.2 443
  566. ---hWACT8Gw---B--
  567. GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442995&url=https%3A%2F%2Foddcake.net&signature=an%2Fnxws1ry%2BSoEqxcloiedpsspa5kqbWEKHRG5LRM3YxFerTnXCes1D90yQe5RJw4iLLpnkgUPr1ow%2FzCpZcqiGHrYK3vrNyYcrKpQIYr3JWKRtRyckqjsqgSIRpqzlGdMKIgwjHegS80PE4Fehvx%2Bzw81NFWS8%2FinOyRZTUv355a6osaWFB2XWV%2FxddlYU%2FTxV88wcD%2BT2uAur51G92QWor%2FLEA1iVN03BGGzfNA6zbGhaLlzKoNzUd5UPFydFz4IApJVSLNWDwbKJLkTUkoXbtPMdJ37llE27KmCknpHb1VctQ9993Y0IS4PxynwBNxJnadMo4IMKXnei0lrM87A%3D%3D HTTP/1.1
  568. Host: oddcake.net
  569. User-Agent: WordPress.com; https://jptools.wordpress.com
  570. Accept: */*
  571. Accept-Encoding: deflate, gzip, br, zstd
  572. Referer: https://oddcake.net/?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442995&url=https%3A%2F%2Foddcake.net&signature=an%2Fnxws1ry%2BSoEqxcloiedpsspa5kqbWEKHRG5LRM3YxFerTnXCes1D90yQe5RJw4iLLpnkgUPr1ow%2FzCpZcqiGHrYK3vrNyYcrKpQIYr3JWKRtRyckqjsqgSIRpqzlGdMKIgwjHegS80PE4Fehvx%2Bzw81NFWS8%2FinOyRZTUv355a6osaWFB2XWV%2FxddlYU%2FTxV88wcD%2BT2uAur51G92QWor%2FLEA1iVN03BGGzfNA6zbGhaLlzKoNzUd5UPFydFz4IApJVSLNWDwbKJLkTUkoXbtPMdJ37llE27KmCknpHb1VctQ9993Y0IS4PxynwBNxJnadMo4IMKXnei0lrM87A%3D%3D
  573. Connection: close
  574.  
  575. ---hWACT8Gw---E--
  576. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  577.  
  578. ---hWACT8Gw---F--
  579. HTTP/1.1 403
  580. Server: nginx
  581. Date: Sat, 08 Mar 2025 14:09:55 GMT
  582. Content-Length: 146
  583. Content-Type: text/html
  584. X-Content-Type-Options: nosniff
  585. Connection: close
  586. X-XSS-Protection: 1; mode=block
  587. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  588. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  589. Referrer-Policy: no-referrer-when-downgrade
  590. x-frame-options: SAMEORIGIN
  591.  
  592. ---hWACT8Gw---H--
  593. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:get /[^#\?]*(?:\?[^\s\v#]*)?(?:#[^\s\v]*)?|(?:connect (?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}\.?(?::[0-9]+)?|[\--9A-Z_a-z]+:[0-9]+)|options \*|[a-z]{3,10}[\s\v]+(?:[0-9A-Z_a-z]{3,7}?://[\--9A-Z_a-z]* (76 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442995&url=https%3A%2F%2Fod (395 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442995&url=https%3A%2F%2Foddcake.net&signature=an%2Fnxws1ry%2BSoEqxcloiedpsspa5kqbWEKHRG5LRM3YxFerTnXCes1D90yQe5RJw4iLLpnkgUPr1 (295 characters omitted)"] [severity "4"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299575.258469"] [ref "v0,495"]
  594. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `StrEq' with parameter `0' against variable `TX:MSC_PCRE_LIMITS_EXCEEDED' (Value: `1' ) [file "/etc/nginx/modsec/modsecurity.conf"] [line "147"] [id "200005"] [rev ""] [msg "ModSecurity internal error flagged: TX:MSC_PCRE_LIMITS_EXCEEDED"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299575.258469"] [ref ""]
  595.  
  596. ---hWACT8Gw---J--
  597.  
  598. ---hWACT8Gw---K--
  599.  
  600. ---hWACT8Gw---Z--
  601.  
  602. ---p0wBMNQ4---A--
  603. [08/Mar/2025:08:09:55 -0600] 174144299570.979173 192.0.101.183 23704 10.10.10.2 443
  604. ---p0wBMNQ4---B--
  605. POST /xmlrpc.php?for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442995&nonce=sqxvfYOMcn&body-hash=DJUiPuzRYfl19%2BIU5IiNKIVlKw8%3D&signature=rIKSL6PtvWlITMHwNVAMoMMT%2BgY%3D HTTP/1.1
  606. Host: oddcake.net
  607. Authorization: X_JETPACK token="myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0" timestamp="1741442995" nonce="sqxvfYOMcn" body-hash="DJUiPuzRYfl19+IU5IiNKIVlKw8=" signature="rIKSL6PtvWlITMHwNVAMoMMT+gY="
  608. User-Agent: Jetpack by WordPress.com
  609. Accept: */*
  610. Accept-Encoding: deflate, gzip, br, zstd
  611. Referer: https://oddcake.net/xmlrpc.php?for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442995&nonce=sqxvfYOMcn&body-hash=DJUiPuzRYfl19%2BIU5IiNKIVlKw8%3D&signature=rIKSL6PtvWlITMHwNVAMoMMT%2BgY%3D
  612. Content-Type: text/xml
  613. Connection: close
  614. Content-Length: 107
  615.  
  616. ---p0wBMNQ4---C--
  617. <?xml version="1.0"?>
  618. <methodCall>
  619. <methodName>jetpack.getBlog</methodName>
  620. <params>
  621. </params></methodCall>
  622.  
  623. ---p0wBMNQ4---E--
  624. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  625.  
  626. ---p0wBMNQ4---F--
  627. HTTP/1.1 403
  628. Server: nginx
  629. Date: Sat, 08 Mar 2025 14:09:55 GMT
  630. Content-Length: 146
  631. Content-Type: text/html
  632. X-Content-Type-Options: nosniff
  633. Connection: close
  634. X-XSS-Protection: 1; mode=block
  635. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  636. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  637. Referrer-Policy: no-referrer-when-downgrade
  638. x-frame-options: SAMEORIGIN
  639.  
  640. ---p0wBMNQ4---H--
  641. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:[\n\r;`\{]|\|\|?|&&?)[\s\v]*[\s\v\"'-\(,@]*(?:[\"'\.-9A-Z_a-z]+/|(?:[\"'\x5c\^]*[0-9A-Z_a-z][\"'\x5c\^]*:.*|[ \"'\.-9A-Z\x5c\^-_a-z]*)\x5c)?[\"\^]*(?:a[\"\^]*(?:s[\"\^]*s[\"\^]*o[\"\^]*c|t[\"\^ (7601 characters omitted)' against variable `XML:/*' (Value: `\x0ajetpack.getBlog\x0a\x0a' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "815"] [id "932380"] [rev ""] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: \x0ajetpack.getBlog found within XML:/*: \x0ajetpack.getBlog\x0a\x0a"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299570.979173"] [ref "o0,16"]
  642. ModSecurity: Warning. Matched "Operator `Rx' with parameter `[0-9]\s*\'\s*[0-9]' against variable `MATCHED_VAR' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1137"] [id "932240"] [rev ""] [msg "Remote Command Execution: Unix Command Injection evasion attempt detected"] [data "Matched Data: myHT$0Zj8lKRmvGMlE1 found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299570.979173"] [ref "o0,19v35,36v807,8v807,11v807,3v807,11v807,1v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,11v807,1v807,1v807,11v807,11v807,11v807,11v807,1v807,11v807,1v807,1v807,1v807,1v80 (515 characters omitted)"]
  643. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b[\s\v\"'-\)`]*?(?:![<->]|<[=->]?|>=?|\^|is[\s\v]+not|not[\s\v]+(?:like|r(?:like|egexp)))[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b' against variable `ARGS:token' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "722"] [id "942131"] [rev ""] [msg "SQL Injection Attack: SQL Boolean-based attack detected"] [data "Matched Data: RflT5W81x1^v found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299570.979173"] [ref "o20,12o20,10o31,1v35,36"]
  644. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/xmlrpc.php"] [unique_id "174144299570.979173"] [ref ""]
  645.  
  646. ---p0wBMNQ4---J--
  647.  
  648. ---p0wBMNQ4---K--
  649.  
  650. ---p0wBMNQ4---Z--
  651.  
  652. ---OjJg9zCp---A--
  653. [08/Mar/2025:08:09:56 -0600] 174144299676.051821 192.0.101.183 23708 10.10.10.2 443
  654. ---OjJg9zCp---B--
  655. GET /?rest_route=%2Fjetpack%2Fv4%2Fstats%2Fblog%2F&_for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442995&nonce=gN74IDNWMI&body-hash&signature=wd%2Fg%2F4kL3Q4pBsnfM4CjfRqJBi4%3D HTTP/1.1
  656. Host: oddcake.net
  657. Authorization: X_JETPACK token="myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0" timestamp="1741442995" nonce="gN74IDNWMI" body-hash="" signature="wd/g/4kL3Q4pBsnfM4CjfRqJBi4="
  658. User-Agent: Jetpack by WordPress.com
  659. Accept: */*
  660. Accept-Encoding: deflate, gzip, br, zstd
  661. Referer: https://oddcake.net/?rest_route=%2Fjetpack%2Fv4%2Fstats%2Fblog%2F&_for=jetpack&token=myHT%240Zj8lKRmvGMlE1%24RflT5W81x1%5Ev%3A1%3A0&timestamp=1741442995&nonce=gN74IDNWMI&body-hash&signature=wd%2Fg%2F4kL3Q4pBsnfM4CjfRqJBi4%3D
  662. Connection: close
  663.  
  664. ---OjJg9zCp---E--
  665. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  666.  
  667. ---OjJg9zCp---F--
  668. HTTP/1.1 403
  669. Server: nginx
  670. Date: Sat, 08 Mar 2025 14:09:56 GMT
  671. Content-Length: 146
  672. Content-Type: text/html
  673. X-Content-Type-Options: nosniff
  674. Connection: close
  675. X-XSS-Protection: 1; mode=block
  676. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  677. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  678. Referrer-Policy: no-referrer-when-downgrade
  679. x-frame-options: SAMEORIGIN
  680.  
  681. ---OjJg9zCp---H--
  682. ModSecurity: Warning. Matched "Operator `Rx' with parameter `[0-9]\s*\'\s*[0-9]' against variable `MATCHED_VAR' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1137"] [id "932240"] [rev ""] [msg "Remote Command Execution: Unix Command Injection evasion attempt detected"] [data "Matched Data: myHT$0Zj8lKRmvGMlE1 found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299676.051821"] [ref "o0,19v70,36v745,1v745,3v745,1v745,1v745,1v745,1v745,1v745,1v745,1v745,1v745,1v745,1v745,1v745,1v745,1v745,11v745,11v745,1v745,1v745,11v745,11v745,11v745,11v745,1v745,11v745,1v745,1v745,1v745,1v745,1v7 (456 characters omitted)"]
  683. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b[\s\v\"'-\)`]*?(?:![<->]|<[=->]?|>=?|\^|is[\s\v]+not|not[\s\v]+(?:like|r(?:like|egexp)))[\s\v\"'-\)`]*?\b([0-9A-Z_a-z]+)\b' against variable `ARGS:token' (Value: `myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "722"] [id "942131"] [rev ""] [msg "SQL Injection Attack: SQL Boolean-based attack detected"] [data "Matched Data: RflT5W81x1^v found within ARGS:token: myHT$0Zj8lKRmvGMlE1$RflT5W81x1^v:1:0"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299676.051821"] [ref "o20,12o20,10o31,1v70,36"]
  684. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `10' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/"] [unique_id "174144299676.051821"] [ref ""]
  685.  
  686. ---OjJg9zCp---J--
  687.  
  688. ---OjJg9zCp---K--
  689.  
  690. ---OjJg9zCp---Z--
  691.  
  692. ---iZ082c2j---A--
  693. [08/Mar/2025:08:09:56 -0600] 17414429963.697895 192.0.101.183 23720 10.10.10.2 443
  694. ---iZ082c2j---B--
  695. GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442996&url=https%3A%2F%2Foddcake.net&signature=Q2k7USyU%2FYkTqjAZjaG2RBApGKXhurt2%2Bb%2BxJXmZxK%2Bv7Yi%2FpSNyr6S%2BCDe3z3Tu9s7RbpvzLK0UHUjFja1U9nj5Y0ses35v3HdKDcC6mAbqRBzamW20C%2BJA07%2Bxy1lc%2Fl2lwTWUw%2FTuufqnAk63jrfXXYGbR2Gskx73iL12KVYlQZpr4bVyDVUQSpebcFDz5xtKZXt%2Be%2FF27OOV2i3yfq6DAgUb7kg5Z2mD5JdiRVmj0lbZB06OigAyR%2BKZMqndCxDE0N4L5omzcyRR9MwTYbZdXTCvCqDJnDgP56bSReKBKHkmjKAV13I2xT%2FdNi0fdR0oWWHWtr4d0hgcy3ekcw%3D%3D HTTP/1.1
  696. Host: oddcake.net
  697. User-Agent: WordPress.com; https://jptools.wordpress.com
  698. Accept: */*
  699. Accept-Encoding: deflate, gzip, br, zstd
  700. Referer: https://oddcake.net/?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442996&url=https%3A%2F%2Foddcake.net&signature=Q2k7USyU%2FYkTqjAZjaG2RBApGKXhurt2%2Bb%2BxJXmZxK%2Bv7Yi%2FpSNyr6S%2BCDe3z3Tu9s7RbpvzLK0UHUjFja1U9nj5Y0ses35v3HdKDcC6mAbqRBzamW20C%2BJA07%2Bxy1lc%2Fl2lwTWUw%2FTuufqnAk63jrfXXYGbR2Gskx73iL12KVYlQZpr4bVyDVUQSpebcFDz5xtKZXt%2Be%2FF27OOV2i3yfq6DAgUb7kg5Z2mD5JdiRVmj0lbZB06OigAyR%2BKZMqndCxDE0N4L5omzcyRR9MwTYbZdXTCvCqDJnDgP56bSReKBKHkmjKAV13I2xT%2FdNi0fdR0oWWHWtr4d0hgcy3ekcw%3D%3D
  701. Connection: close
  702.  
  703. ---iZ082c2j---E--
  704. <html>\x0d\x0a<head><title>403 Forbidden</title></head>\x0d\x0a<body>\x0d\x0a<center><h1>403 Forbidden</h1></center>\x0d\x0a<hr><center>nginx</center>\x0d\x0a</body>\x0d\x0a</html>\x0d\x0a
  705.  
  706. ---iZ082c2j---F--
  707. HTTP/1.1 403
  708. Server: nginx
  709. Date: Sat, 08 Mar 2025 14:09:56 GMT
  710. Content-Length: 146
  711. Content-Type: text/html
  712. X-Content-Type-Options: nosniff
  713. Connection: close
  714. X-XSS-Protection: 1; mode=block
  715. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  716. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline' blob:
  717. Referrer-Policy: no-referrer-when-downgrade
  718. x-frame-options: SAMEORIGIN
  719.  
  720. ---iZ082c2j---H--
  721. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)^(?:get /[^#\?]*(?:\?[^\s\v#]*)?(?:#[^\s\v]*)?|(?:connect (?:(?:[0-9]{1,3}\.){3}[0-9]{1,3}\.?(?::[0-9]+)?|[\--9A-Z_a-z]+:[0-9]+)|options \*|[a-z]{3,10}[\s\v]+(?:[0-9A-Z_a-z]{3,7}?://[\--9A-Z_a-z]* (76 characters omitted)' against variable `REQUEST_LINE' (Value: `GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442996&url=https%3A%2F%2Fod (405 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "53"] [id "920100"] [rev ""] [msg "Invalid HTTP Request Line"] [data "GET /?rest_route=%2Fjetpack%2Fv4%2Fconnection%2Fplugins%2F&timestamp=1741442996&url=https%3A%2F%2Foddcake.net&signature=Q2k7USyU%2FYkTqjAZjaG2RBApGKXhurt2%2Bb%2BxJXmZxK%2Bv7Yi%2FpSNyr6S%2BCDe3z3Tu9s7R (305 characters omitted)"] [severity "4"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "10.10.10.2"] [uri "/"] [unique_id "17414429963.697895"] [ref "v0,505"]
  722. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `StrEq' with parameter `0' against variable `TX:MSC_PCRE_LIMITS_EXCEEDED' (Value: `1' ) [file "/etc/nginx/modsec/modsecurity.conf"] [line "147"] [id "200005"] [rev ""] [msg "ModSecurity internal error flagged: TX:MSC_PCRE_LIMITS_EXCEEDED"] [data ""] [severity "0"] [ver ""] [maturity "0"] [accuracy "0"] [hostname "10.10.10.2"] [uri "/"] [unique_id "17414429963.697895"] [ref ""]
  723.  
  724. ---iZ082c2j---J--
  725.  
  726. ---iZ082c2j---K--
  727.  
  728. ---iZ082c2j---Z--
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!