Telegram group «Offensive Security & Consultancy (OSC)»

Telegram group Offensive Security & Consultancy (OSC)

Free Support Of Telecommunications and Pentesting - Ethical Hacking - Read Team - Blue Team - Purple Team - HACK THE CIA & NSA - Dominate The World - Hack The World - Hack The Planet - The Lord Of CYberSpace - The King Of Hackers - The Monster Of Cryptos

Low activity
Language es

147

Members count

7

Online

1

Active users
  • Tibu3 14:43
    Tibu3

    esto es lo que he logrado averiguar en Json: para facilitar el analisis, la estructura de log del ataque PHP reciente:   llega por NGINX {   "timestamp": "date/time",   "log_type": "web_server_access",   "client_ip": "192.168.xx.xx",   "http_method": "POST",   "request_uri": "/uploads/avatar_shell.php",   "query_string": "?cmd=whoami",   "http_status": 200,   "bytes_sent": 450,   "http_referrer": "-",   "user_agent": "Mozilla/5.0 (Custom)",   "uploaded_files": [     {       "param_name": "file",       "filename": "shell.php",       "mime_type": "application/x-php",       "file_size_bytes": 9999     } ] }     cuando es por aplicación, la estructura cambia:  {   "timestamp": "date/time",   "log_type": "php_execution_audit",   "script_path": "/var/www/html/uploads/avatar_shell.php",   "php_process_id": 9999,   "executed_function": "shell_exec",   "function_arguments": "whoami",   "execution_context": {     "user": "www-data",     "request_method": "POST"   } }   cuando llega por syslog o window Log event:  {   "timestamp": "date/time",   "log_type": "os_process_creation",   "parent_process_name": "php-fpm",   "parent_pid": 9999,   "process_id": 9999,   "process_user": "www-data",   "command_executed": "/usr/bin/whoami",   "working_directory": "/var/www/html/uploads",   "exit_code": 0 }

Online

Activity

Active users