{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9999629259109497, "class": 2 } ], "prob": 0.9999629, "class": 2, "models": [ { "m": "az", "prob": 0.9978896, "class": 1 }, { "m": "az/scripts", "prob": 0.9998343, "class": 2 }, { "m": "az/php", "prob": 0.9999629, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-09T20:17:20Z" }, "path": "dc2.php", "raw": { "v": "4", "fs": [ { "f": "KO₈(C₁₀As₅CaEr₂XeDyILa₃)H₅(Po₅Cm₈Db₈F₅Os₂)Md₂(Pt)Th", "k": { "source.imports[0]": "acl", "source.imports[1]": "aml", "source.imports[2]": "array_map", "source.imports[3]": "array_merge", "source.imports[4]": "base64_encode", "source.imports[5]": "bname", "source.imports[6]": "cd", "source.imports[7]": "ceil", "source.imports[8]": "chdir", "source.imports[9]": "chgrp", "source.strings[0]": " ] --", "source.strings[1]": " * FROM (SELECT TOP ", "source.strings[2]": " * FROM [", "source.strings[3]": " \u003cb\u003eMSSQL\u003c/b\u003e", "source.strings[4]": " \u003cb\u003eMySQL\u003c/b\u003e/", "source.strings[5]": " \u003cb\u003eOracle\u003c/b\u003e", "source.strings[6]": " \u003cb\u003ePostgreSQL\u003c/b\u003e", "source.strings[7]": " \u003cb\u003ecURL\u003c/b\u003e", "source.strings[8]": " AND not a.attisdropped AND a.attnum\u003e0 AND a.attrelid=c.oid AND c.relnamespace=(select oid from pg_namespace where nspname=", "source.strings[9]": " AND relname=", "source.has_imports": true, "source.imports[10]": "chmod", "source.imports[11]": "clearstatcache", "source.imports[12]": "closedir", "source.imports[13]": "copy", "source.imports[14]": "count", "source.imports[15]": "crc32", "source.imports[16]": "create_function", "source.imports[17]": "ctf", "source.imports[18]": "date", "source.imports[19]": "dd", "source.imports[20]": "define", "source.imports[21]": "dfd", "source.imports[22]": "die", "source.imports[23]": "dirname", "source.imports[24]": "empty", "source.imports[25]": "end", "source.imports[26]": "error_reporting", "source.imports[27]": "escHTML", "source.imports[28]": "eval", "source.imports[29]": "exec", "source.imports[30]": "expect_popen", "source.imports[31]": "explode", "source.imports[32]": "fclose", "source.imports[33]": "feof", "source.imports[34]": "fgets", "source.imports[35]": "file", "source.imports[36]": "file_get_contents", "source.imports[37]": "fileperms", "source.imports[38]": "filesize", "source.imports[39]": "flush", "source.imports[40]": "fopen", "source.imports[41]": "fread", "source.imports[42]": "fseek", "source.imports[43]": "fsockopen", "source.imports[44]": "ftp_close", "source.imports[45]": "ftp_connect", "source.imports[46]": "ftp_login", "source.imports[47]": "function_exists", "source.imports[48]": "fwrite", "source.imports[49]": "get_current_user", "source.imports[50]": "get_magic_quotes_gpc", "source.imports[51]": "getdate", "source.imports[52]": "gethostbyname", "source.imports[53]": "getmygid", "source.imports[54]": "getmyuid", "source.imports[55]": "getservbyport", "source.imports[56]": "glob", "source.imports[57]": "gmdate", "source.imports[58]": "gs", "source.imports[59]": "gzclose", "source.imports[60]": "gzdeflate", "source.imports[61]": "gzopen", "source.imports[62]": "gzwrite", "source.imports[63]": "header", "source.imports[64]": "ignore_user_abort", "source.imports[65]": "implode", "source.imports[66]": "ini_get", "source.imports[67]": "ini_restore", "source.imports[68]": "ini_set", "source.imports[69]": "intval", "source.imports[70]": "is_array", "source.imports[71]": "is_dir", "source.imports[72]": "is_file", "source.imports[73]": "is_readable", "source.imports[74]": "is_resource", "source.imports[75]": "is_string", "source.imports[76]": "is_writable", "source.imports[77]": "isset", "source.imports[78]": "microtime", "source.imports[79]": "mkdir", "source.imports[80]": "move_uploaded_file", "source.imports[81]": "mssql_close", "source.imports[82]": "mssql_connect", "source.imports[83]": "mssql_fetch_row", "source.imports[84]": "mssql_get_last_message", "source.imports[85]": "mssql_num_rows", "source.imports[86]": "mssql_query", "source.imports[87]": "mssql_result", "source.imports[88]": "mssql_select_db", "source.imports[89]": "mt", "source.imports[90]": "mysql_close", "source.imports[91]": "mysql_connect", "source.imports[92]": "mysql_error", "source.imports[93]": "mysql_fetch_row", "source.imports[94]": "mysql_get_client_info", "source.imports[95]": "mysql_get_server_info", "source.imports[96]": "mysql_list_dbs", "source.imports[97]": "mysql_list_tables", "source.imports[98]": "mysql_num_rows", "source.imports[99]": "mysql_query", "source.strings[10]": " AND schemaname!=", "source.strings[11]": " AND table_name=", "source.strings[12]": " AND table_schema!=", "source.strings[13]": " LIMIT ", "source.strings[14]": " OFFSET ", "source.strings[15]": " ORDER BY schemaname", "source.strings[16]": " ORDER BY table_schema", "source.strings[17]": " VALUES ", "source.strings[18]": " dbname=", "source.strings[19]": " password=", "source.strings[20]": " port=", "source.strings[21]": " selected=\"selected", "source.strings[22]": " selected=\"selected\"", "source.strings[23]": " style=\"width:", "source.strings[24]": " user=", "source.strings[25]": "\" LIMIT ", "source.strings[26]": "\" VALUES ", "source.strings[27]": "\" style=\"padding:0; border:none; background:none;\"\u003e", "source.strings[28]": "\" style=\"width:", "source.strings[29]": "\".\"information_schema\".\"tables\" WHERE table_schema!=\\'pg_catalog\\' AND table_schema!=\\'information_schema\\' ORDER BY table_schema", "source.strings[30]": "\".\"pg_catalog\".\"pg_stat_all_tables\" WHERE schemaname!=\\'pg_catalog\\' AND schemaname!=\\'pg_toast\\' AND schemaname!=\\'information_schema\\' ORDER BY schemaname", "source.strings[31]": "\".\"pg_catalog\".\"pg_stat_all_tables\" WHERE schemaname=\\", "source.strings[32]": "\".\"pg_catalog\".\"pg_statio_all_tables\" where schemaname!=\\'pg_catalog\\' AND schemaname!=\\'pg_toast\\' AND schemaname!=\\'information_schema\\' ORDER BY schemaname", "source.strings[33]": "\".\"pg_catalog\".\"pg_tables\" WHERE schemaname!=\\'pg_catalog\\' AND schemaname!=\\'information_schema\\' ORDER BY schemaname", "source.strings[34]": "\"/\u003e\u003c/center\u003e", "source.strings[35]": "\"value=\"", "source.strings[36]": "#([^ ]*)/#U", "source.strings[37]": "\u0026quot;", "source.strings[38]": ") DROP TABLE [", "source.strings[39]": ") gid=", "source.strings[40]": ");\\n\\n", "source.strings[41]": ", format_type(a.atttypid, a.atttypmod), CASE WHEN a.attnotnull then 'NOT NULL' end FROM pg_class c, pg_attribute a WHERE c.relname=", "source.strings[42]": "-- -------------------------------- --", "source.strings[43]": "-- [ ", "source.strings[44]": "-- [ SQL Dump created by S.A.P. ] --", "source.strings[45]": ".\"information_schema\".\"tables\" WHERE table_schema!=", "source.strings[46]": ".\"pg_catalog\".\"pg_stat_all_tables\" WHERE schemaname!=", "source.strings[47]": ".\"pg_catalog\".\"pg_stat_all_tables\" WHERE schemaname=", "source.strings[48]": ".\"pg_catalog\".\"pg_statio_all_tables\" where schemaname!=", "source.strings[49]": ".\"pg_catalog\".\"pg_tables\" WHERE schemaname!=", "source.strings[50]": ".information_schema.columns WHERE table_schema=", "source.strings[51]": "/(default CURRENT_TIMESTAMP on update CURRENT_TIMESTAMP|DEFAULT CHARSET=\\w+|COLLATE=\\w+|character set \\w+|collate \\w+)/i", "source.strings[52]": "/*!40101 ", "source.strings[53]": "/*!40101 \\\\1 */", "source.strings[54]": "/\u003c/button\u003e", "source.strings[55]": "/\u003e\u003c/center\u003e", "source.strings[56]": "/bin/sh", "source.strings[57]": "/dir2/subdir2", "source.strings[58]": "/dir3/*/subsubdir3", "source.strings[59]": "/directory1", "source.strings[60]": "/etc/group", "source.strings[61]": "/etc/issue.net", "source.strings[62]": "/etc/passwd", "source.strings[63]": "900px\" readonly=\"readonly\"/\u003e READ ONLY", "source.strings[64]": "925px\" name=\"fef\"/\u003e \u003cinput type=\"submit\" name=\"fe\" value=\"Save\"/\u003e\u003cinput type=\"hidden\" name=\"fefs\"/\u003e", "source.strings[65]": "\u003c/button\u003e\u003c/td\u003e\u003cinput type=\"hidden\" name=\"fe\"/\u003e\u003c/form\u003e", "source.strings[66]": "\u003c/fieldset\u003e", "source.strings[67]": "\u003c/td\u003e\u003c/tr\u003e", "source.strings[68]": "\u003c/td\u003e\u003ctd onclick=\"gf(this);", "source.strings[69]": "\u003c/td\u003e\u003ctd onclick=\"gf(this);\"", "source.strings[70]": "\u003cb\u003e$1\u003c/b\u003e/", "source.strings[71]": "\u003cb\u003ePHP\u003c/b\u003e/", "source.strings[72]": "\u003cbutton type=\"submit\"name=\"fp\"class=\"sb\"value=", "source.strings[73]": "\u003cbutton type=\"submit\"name=\"fp\"class=\"sb\"value=\"", "source.strings[74]": "\u003ccenter\u003e\u003cimg alt=\"Can", "source.strings[75]": "\u003ccenter\u003e\u003cimg alt=\"Can\\'t show as image. Sorry.\" src=\"data:image;base64,", "source.strings[76]": "\u003cfieldset class=", "source.strings[77]": "\u003cfieldset class=\"", "source.strings[78]": "\u003cform action=\"\" method=\"post\"\u003e\u003ctd width=\"20px\"\u003e\u003cbutton type=\"submit\" name=\"fp\" value=", "source.strings[79]": "\u003cform action=\"\" method=\"post\"\u003e\u003ctd width=\"20px\"\u003e\u003cbutton type=\"submit\" name=\"fp\" value=\"", "source.strings[80]": "\u003cinput type=\"text\" value=", "source.strings[81]": "\u003cinput type=\"text\" value=\"", "source.strings[82]": "\u003cth width=\"50px\"\u003eExt\u003c/th\u003e", "source.strings[83]": "\u003ctr\u003e\u003ctd\u003e\u003cinput type=", "source.strings[84]": "\u003ctr\u003e\u003ctd\u003e\u003cinput type=\"", "source.strings[85]": "\u003ctr\u003e\u003cth\u003eDisable functions :\u0026nbsp;\u003c/th\u003e\u003ctd style=\"color:#FF4500\"\u003e", "source.strings[86]": "\u003ctr\u003e\u003cth\u003eOpenBaseDir :\u003c/th\u003e\u003ctd style=\"color:#FF4500\"\u003e", "source.strings[87]": "\u003ctr\u003e\u003cth\u003eSafeMode :\u003c/th\u003e\u003cth style=\"color:#FF4500\"\u003eON\u003c/th\u003e\u003c/tr\u003e", "source.strings[88]": "Accept-Ranges: bytes", "source.strings[89]": "Archive created by S.A.P. v.2.1", "source.strings[90]": "Archive created by S.A.P. v.2.1\\nHost: : ", "source.strings[91]": "CREATE TABLE ", "source.strings[92]": "CREATE TABLE \"", "source.strings[93]": "CREATE TABLE [", "source.strings[94]": "Can\\'t change file group. Sorry.", "source.strings[95]": "Can\\'t change file modification times. Sorry", "source.strings[96]": "Can\\'t change file permissions. Sorry.", "source.strings[97]": "Can\\'t create file. Sorry.", "source.strings[98]": "Can\\'t create folder. Sorry.", "source.strings[99]": "Can\\'t read this file. Sorry.", "source.functions[0]": "acl", "source.functions[1]": "ad", "source.functions[2]": "add", "source.functions[3]": "af", "source.functions[4]": "aml", "source.functions[5]": "bname", "source.functions[6]": "cd", "source.functions[7]": "cf", "source.functions[8]": "cgms", "source.functions[9]": "cgmt", "source.imports[100]": "mysql_result", "source.imports[101]": "mysql_select_db", "source.imports[102]": "mysql_unbuffered_query", "source.imports[103]": "nl2br", "source.imports[104]": "number_format", "source.imports[105]": "ob_get_clean", "source.imports[106]": "ob_start", "source.imports[107]": "opendir", "source.imports[108]": "pack", "source.imports[109]": "passthru", "source.imports[110]": "pclose", "source.imports[111]": "pcntl_exec", "source.imports[112]": "pe", "source.imports[113]": "pg_close", "source.imports[114]": "pg_connect", "source.imports[115]": "pg_fetch_result", "source.imports[116]": "pg_fetch_row", "source.imports[117]": "pg_last_error", "source.imports[118]": "pg_num_rows", "source.imports[119]": "pg_query", "source.imports[120]": "php_uname", "source.imports[121]": "phpinfo", "source.imports[122]": "phpversion", "source.imports[123]": "popen", "source.imports[124]": "posix_getegid", "source.imports[125]": "posix_geteuid", "source.imports[126]": "posix_getgrgid", "source.imports[127]": "posix_getpwuid", "source.imports[128]": "preg_replace", "source.imports[129]": "proc_close", "source.imports[130]": "proc_open", "source.imports[131]": "range", "source.imports[132]": "readdir", "source.imports[133]": "readfile", "source.imports[134]": "realpath", "source.imports[135]": "rename", "source.imports[136]": "rmdir", "source.imports[137]": "rtrim", "source.imports[138]": "se", "source.imports[139]": "session_start", "source.imports[140]": "session_write_close", "source.imports[141]": "set_magic_quotes_runtime", "source.imports[142]": "set_time_limit", "source.imports[143]": "shell_exec", "source.imports[144]": "sm", "source.imports[145]": "socket_close", "source.imports[146]": "socket_connect", "source.imports[147]": "socket_create", "source.imports[148]": "socket_read", "source.imports[149]": "socket_select", "source.imports[150]": "socket_set_block", "source.imports[151]": "socket_set_nonblock", "source.imports[152]": "socket_set_option", "source.imports[153]": "socket_shutdown", "source.imports[154]": "socket_write", "source.imports[155]": "sprintf", "source.imports[156]": "ssa", "source.imports[157]": "ssh2_auth_password", "source.imports[158]": "ssh2_connect", "source.imports[159]": "stat", "source.imports[160]": "str_pad", "source.imports[161]": "str_replace", "source.imports[162]": "str_rot13", "source.imports[163]": "stream_get_contents", "source.imports[164]": "stripos", "source.imports[165]": "stripslashes", "source.imports[166]": "strlen", "source.imports[167]": "strnatcmp", "source.imports[168]": "strpos", "source.imports[169]": "strrev", "source.imports[170]": "strrpos", "source.imports[171]": "strtolower", "source.imports[172]": "strtotime", "source.imports[173]": "strtoupper", "source.imports[174]": "substr", "source.imports[175]": "system", "source.imports[176]": "tempnam", "source.imports[177]": "time", "source.imports[178]": "touch", "source.imports[179]": "trim", "source.imports[180]": "uasort", "source.imports[181]": "unlink", "source.imports[182]": "usleep", "source.strings[100]": "Can\\'t rename. Sorry.", "source.strings[101]": "Can\\'t save this file. Sorry.", "source.strings[102]": "Content-Disposition: attachment; filename=", "source.strings[103]": "Content-Length: ", "source.strings[104]": "Content-Transfer-Encoding: binary", "source.strings[105]": "Content-Type: text/html; charset=", "source.strings[106]": "Content-type: application/x-zip", "source.strings[107]": "Content-type: multipart/octet-stream", "source.strings[108]": "D, d M Y H:i:s", "source.strings[109]": "DROP TABLE IF EXISTS ", "source.strings[110]": "DROP TABLE IF EXISTS \"", "source.strings[111]": "Date : ", "source.strings[112]": "EXEC sys.sp_databases", "source.strings[113]": "EXEC sys.sp_helpdb", "source.strings[114]": "EXEC sys.sp_oledb_database", "source.strings[115]": "File group successfully changed. Congratulations!", "source.strings[116]": "File modification times successfully changed. Congratulations!", "source.strings[117]": "File permissions successfully changed. Congratulations!", "source.strings[118]": "File successfully saved. Congratulations!", "source.strings[119]": "Folder created successfully. Congratulations!", "source.strings[120]": "HTTP_HOST", "source.strings[121]": "Host: : ", "source.strings[122]": "IF EXISTS(SELECT table_name FROM information_schema.tables WHERE table_name=", "source.strings[123]": "INSERT INTO ", "source.strings[124]": "INSERT INTO \"", "source.strings[125]": "INSERT INTO [", "source.strings[126]": "Last-Modified: ", "source.strings[127]": "Rename successfully. Congratulations!", "source.strings[128]": "SCRIPT_FILENAME", "source.strings[129]": "SELECT ", "source.strings[130]": "SELECT '['+column_name+']', '['+data_type+']', case when character_maximum_length IS NOT NULL then '('+ cast( character_maximum_length as varchar(255)) +')' end, case when is_nullable='no' then 'NOT NULL' end, case when column_default IS NOT NULL then 'DEFAULT '+column_default end FROM ", "source.strings[131]": "SELECT '\\\"'||a.attname||'\\\"', format_type(a.atttypid, a.atttypmod), CASE WHEN a.attnotnull then 'NOT NULL' end FROM pg_class c, pg_attribute a WHERE c.relname=", "source.strings[132]": "SELECT * FROM ", "source.strings[133]": "SELECT * FROM \"", "source.strings[134]": "SELECT * FROM [", "source.strings[135]": "SELECT COUNT(*) FROM ", "source.strings[136]": "SELECT COUNT(*) FROM \"", "source.strings[137]": "SELECT COUNT(*) FROM [", "source.strings[138]": "SELECT TOP ", "source.strings[139]": "SELECT datname FROM pg_catalog.pg_database WHERE NOT datistemplate", "source.strings[140]": "SELECT datname FROM pg_catalog.pg_stat_database WHERE numbackends!=0", "source.strings[141]": "SELECT n_live_tup FROM ", "source.strings[142]": "SELECT n_live_tup FROM \"", "source.strings[143]": "SELECT name FROM sys.databases", "source.strings[144]": "SELECT name FROM sys.sysdatabases", "source.strings[145]": "SELECT schema_name FROM information_schema.schemata", "source.strings[146]": "SELECT schema_name(schema_id)+'.'+name FROM [", "source.strings[147]": "SELECT schemaname||", "source.strings[148]": "SELECT schemaname||\\'.\\'||relname FROM \"", "source.strings[149]": "SELECT schemaname||\\'.\\'||tablename FROM \"", "source.strings[150]": "SELECT table_name FROM information_schema.tables WHERE table_schema=", "source.strings[151]": "SELECT table_rows FROM information_schema.tables WHERE table_schema=", "source.strings[152]": "SELECT table_schema+'.'+table_name FROM [", "source.strings[153]": "SELECT table_schema||", "source.strings[154]": "SELECT table_schema||\\'.\\'||table_name FROM \"", "source.strings[155]": "SERVER_ADDR", "source.strings[156]": "SERVER_NAME", "source.strings[157]": "SERVER_SOFTWARE", "source.strings[158]": "SET NAMES utf8", "source.strings[159]": "SET SQL_QUOTE_SHOW_CREATE=1", "source.strings[160]": "SHOW CREATE TABLE ", "source.strings[161]": "SHOW DATABASES", "source.strings[162]": "SHOW TABLES FROM ", "source.strings[163]": "SQL_dump", "source.strings[164]": "Y-m-d H:i:s", "source.strings[165]": "Y-m-d_H.i", "source.strings[166]": "[ .. ]", "source.strings[167]": "[ DIR ]", "source.strings[168]": "\\' AND relname=\\", "source.strings[169]": "\\n-- \\n", "source.strings[170]": "\\n-- \\n-- ", "source.strings[171]": "\\n-- \\nDROP TABLE IF EXISTS ", "source.strings[172]": "\\n-- \\nIF EXISTS(SELECT table_name FROM information_schema.tables WHERE table_name=", "source.strings[173]": "\\nDate : ", "source.strings[174]": "\\x00\\x00", "source.strings[175]": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00", "source.strings[176]": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00", "source.strings[177]": "\\x14\\x00\\x08\\x00", "source.strings[178]": "\\x14\\x00\\x08\\x00\\x00\\x00", "source.strings[179]": "\\x50\\x4b\\x01\\x02\\x00\\x00", "source.strings[180]": "\\x50\\x4b\\x03\\x04", "source.strings[181]": "\\x50\\x4b\\x05\\x06\\x00\\x00\\x00\\x00", "source.strings[182]": "\\x50\\x4b\\x07\\x08", "source.strings[183]": "] ORDER BY 1 DESC)T ORDER BY 1 ASC", "source.strings[184]": "] VALUES ", "source.strings[185]": "].[information_schema].[tables] ORDER BY table_schema", "source.strings[186]": "].[sys].[all_objects] WHERE type='U' ORDER BY schema_id", "source.strings[187]": "].[sys].[objects] WHERE type='U' ORDER BY schema_id", "source.strings[188]": "].[sys].[tables] ORDER BY schema_id", "source.strings[189]": "];\\nCREATE TABLE [", "source.strings[190]": "_close", "source.strings[191]": "_fetch_row", "source.strings[192]": "_field_name", "source.strings[193]": "_result", "source.strings[194]": "addslashes", "source.strings[195]": "archive", "source.strings[196]": "checkbox\"name=\"fc[]", "source.strings[197]": "curl_init", "source.strings[198]": "dir4/lang-??/", "source.strings[199]": "disable_function", "source.strings[200]": "disable_functions", "source.strings[201]": "echo 1", "source.strings[202]": "error_log", "source.strings[203]": "error_reporting", "source.strings[204]": "expect://", "source.strings[205]": "expect_popen", "source.strings[206]": "file_uploads", "source.strings[207]": "gzopen", "source.strings[208]": "hidden", "source.strings[209]": "information_schema", "source.strings[210]": "log_errors", "source.strings[211]": "log_errors_max_len", "source.strings[212]": "magic_quotes_gpc", "source.strings[213]": "magic_quotes_runtime", "source.strings[214]": "magic_quotes_sybase", "source.strings[215]": "max_execution_time", "source.strings[216]": "memory_limit", "source.strings[217]": "minutes", "source.strings[218]": "mssql_connect", "source.strings[219]": "mysql_connect", "source.strings[220]": "mysql_list_dbs", "source.strings[221]": "mysql_list_tables", "source.strings[222]": "mysql_real_escape_string", "source.strings[223]": "ocilogon", "source.strings[224]": "open_basedir", "source.strings[225]": "passthru", "source.strings[226]": "pcntl_exec", "source.strings[227]": "pg_catalog", "source.strings[228]": "pg_connect", "source.strings[229]": "pg_escape_string", "source.strings[230]": "pg_fetch_result", "source.strings[231]": "pg_toast", "source.strings[232]": "posix_geteuid", "source.strings[233]": "safe_mode", "source.strings[234]": "safe_mode_exec_dir", "source.strings[235]": "seconds", "source.strings[236]": "shell_exec", "source.strings[237]": "str_rot13", "source.strings[238]": "style=\"text-decoration:line-through", "source.strings[239]": "style=\"text-decoration:line-through\"", "source.strings[240]": "system", "source.strings[241]": "t change file group. Sorry.", "source.strings[242]": "t change file modification times. Sorry", "source.strings[243]": "t change file permissions. Sorry.", "source.strings[244]": "t create file. Sorry.", "source.strings[245]": "t create folder. Sorry.", "source.strings[246]": "t read this file. Sorry.", "source.strings[247]": "t rename. Sorry.", "source.strings[248]": "t save this file. Sorry.", "source.strings[249]": "t show as image. Sorry.\" src=\"data:image;base64,", "source.strings[250]": "tmp_name", "source.strings[251]": "value=", "source.strings[252]": "||a.attname||", "source.strings[253]": "||relname FROM ", "source.strings[254]": "||table_name FROM ", "source.strings[255]": "||tablename FROM ", "source.functions[10]": "cl", "source.functions[11]": "cn", "source.functions[12]": "crc32c", "source.functions[13]": "ctf", "source.functions[14]": "dd", "source.functions[15]": "dfd", "source.functions[16]": "dt", "source.functions[17]": "e", "source.functions[18]": "escHTML", "source.functions[19]": "fn", "source.functions[20]": "fr", "source.functions[21]": "fv", "source.functions[22]": "gs", "source.functions[23]": "init", "source.functions[24]": "ld", "source.functions[25]": "lt", "source.functions[26]": "me", "source.functions[27]": "mt", "source.functions[28]": "of", "source.functions[29]": "pd", "source.functions[30]": "pe", "source.functions[31]": "q", "source.functions[32]": "ql", "source.functions[33]": "sd", "source.functions[34]": "se", "source.functions[35]": "sm", "source.functions[36]": "ssa", "source.functions[37]": "ts", "source.functions[38]": "wf" }, "x": 553, "id": 0, "is": [ "ini_set", "ini_restore", "ini_restore", "ini_restore", "ini_set", "ini_set", "ini_set", "error_reporting", "ini_set", "set_time_limit", "ignore_user_abort", "ini_set", "ini_set", "ini_restore", "ini_restore", "ini_set", "ini_set", "ini_set", "set_magic_quotes_runtime", "ini_restore", "ini_restore", "ini_restore", "ini_set", "ini_set", "ini_set", "ini_restore", "ini_set", "str_replace", "is_array", "ssa", "stripslashes", "explode", "end", "get_magic_quotes_gpc", "ssa", "function_exists", "header", "header", "date", "header", "header", "gmdate", "is_readable", "is_dir", "is_file", "opendir", "readdir", "is_readable", "is_dir", "is_file", "closedir", "stat", "pack", "strlen", "file_get_contents", "pack", "crc32", "gzdeflate", "strlen", "tempnam", "fopen", "gzopen", "feof", "gzwrite", "fread", "gzclose", "fclose", "fopen", "fseek", "feof", "fread", "fseek", "fread", "fclose", "filesize", "unlink", "fopen", "feof", "fread", "strlen", "crc32", "fclose", "pack", "pack", "pack", "pack", "strlen", "time", "pack", "strlen", "strlen", "crc32", "pack", "pack", "pack", "pack", "strlen", "getdate", "pack", "pack", "date", "pack", "pack", "strlen", "pack", "pack", "strlen", "empty", "mysql_connect", "mysql_query", "mysql_get_server_info", "empty", "mssql_connect", "empty", "pg_connect", "mysql_select_db", "mssql_select_db", "pg_close", "pg_connect", "mysql_query", "mssql_query", "pg_query", "explode", "explode", "function_exists", "mysql_list_dbs", "mysql_query", "mysql_num_rows", "mysql_query", "mssql_query", "mssql_num_rows", "mssql_query", "mssql_num_rows", "mssql_query", "mssql_num_rows", "mssql_query", "mssql_num_rows", "mssql_query", "pg_query", "pg_num_rows", "pg_query", "function_exists", "mysql_list_tables", "mysql_query", "mysql_num_rows", "mysql_query", "mssql_query", "mssql_num_rows", "mssql_query", "mssql_num_rows", "mssql_query", "mssql_num_rows", "mssql_query", "pg_close", "pg_connect", "pg_query", "pg_num_rows", "pg_query", "pg_num_rows", "pg_query", "pg_num_rows", "pg_query", "mysql_query", "mysql_result", "mysql_query", "mysql_result", "explode", "mssql_query", "mssql_result", "explode", "pg_query", "pg_query", "pg_fetch_result", "mysql_error", "mssql_get_last_message", "pg_last_error", "mysql_query", "mysql_query", "mysql_fetch_row", "preg_replace", "mysql_unbuffered_query", "mysql_fetch_row", "array_map", "implode", "mysql_fetch_row", "array_map", "implode", "explode", "mssql_query", "mssql_fetch_row", "implode", "implode", "mssql_query", "mssql_fetch_row", "array_map", "implode", "mssql_fetch_row", "array_map", "implode", "pg_close", "pg_connect", "explode", "pg_query", "pg_fetch_row", "implode", "implode", "pg_query", "pg_fetch_row", "array_map", "implode", "pg_fetch_row", "array_map", "implode", "isset", "isset", "session_write_close", "isset", "empty", "array_map", "die", "isset", "str_rot13", "header", "header", "bname", "header", "header", "header", "filesize", "header", "gmdate", "readfile", "die", "isset", "empty", "session_start", "session_write_close", "str_pad", "date", "die", "isset", "empty", "session_start", "session_write_close", "header", "header", "date", "header", "header", "gmdate", "str_pad", "date", "die", "explode", "microtime", "define", "mt", "define", "strtolower", "substr", "session_start", "empty", "empty", "empty", "isset", "dirname", "isset", "isset", "isset", "str_rot13", "is_file", "dirname", "is_dir", "realpath", "str_replace", "substr", "chdir", "define", "function_exists", "is_readable", "file", "explode", "is_readable", "file", "explode", "escHTML", "tempnam", "fopen", "fwrite", "fclose", "ob_start", "function_exists", "exec", "implode", "function_exists", "system", "function_exists", "shell_exec", "function_exists", "passthru", "is_resource", "popen", "feof", "fread", "pclose", "is_resource", "proc_open", "stream_get_contents", "proc_close", "function_exists", "pcntl_exec", "function_exists", "is_resource", "expect_popen", "feof", "fread", "fclose", "is_resource", "fopen", "feof", "fread", "fclose", "escHTML", "ob_get_clean", "header", "escHTML", "empty", "gethostbyname", "empty", "empty", "php_uname", "file_get_contents", "php_uname", "php_uname", "php_uname", "php_uname", "strpos", "phpversion", "preg_replace", "function_exists", "function_exists", "mysql_get_client_info", "function_exists", "function_exists", "function_exists", "posix_getpwuid", "posix_geteuid", "posix_getgrgid", "posix_getegid", "getmygid", "getmyuid", "get_current_user", "empty", "ini_get", "is_string", "ini_get", "trim", "escHTML", "is_string", "ini_get", "trim", "escHTML", "str_replace", "is_readable", "range", "is_dir", "strtoupper", "escHTML", "explode", "rtrim", "escHTML", "escHTML", "isset", "isset", "empty", "isset", "realpath", "opendir", "readdir", "is_dir", "dd", "unlink", "closedir", "rmdir", "str_rot13", "stat", "dirname", "is_dir", "dd", "unlink", "touch", "dirname", "isset", "empty", "dfd", "empty", "dfd", "empty", "isset", "str_rot13", "empty", "empty", "isset", "empty", "aml", "empty", "aml", "empty", "isset", "str_rot13", "empty", "empty", "isset", "empty", "acl", "empty", "acl", "isset", "isset", "realpath", "stat", "bname", "is_dir", "is_writable", "mkdir", "opendir", "stat", "readdir", "is_dir", "cd", "stat", "copy", "touch", "closedir", "touch", "touch", "stat", "empty", "bname", "dirname", "stat", "rename", "touch", "touch", "empty", "is_dir", "cd", "bname", "stat", "copy", "touch", "touch", "empty", "empty", "stat", "dirname", "stat", "dirname", "stat", "rename", "touch", "touch", "dirname", "touch", "dirname", "sm", "sm", "empty", "stat", "dirname", "fopen", "fclose", "sm", "mkdir", "sm", "sm", "touch", "touch", "dirname", "empty", "stat", "move_uploaded_file", "touch", "touch", "isset", "escHTML", "str_rot13", "is_file", "stat", "isset", "fopen", "fwrite", "fclose", "touch", "sm", "sm", "isset", "chmod", "intval", "touch", "sm", "sm", "isset", "chgrp", "touch", "sm", "sm", "isset", "touch", "strtotime", "sm", "sm", "isset", "base64_encode", "file_get_contents", "is_readable", "escHTML", "is_writable", "fopen", "feof", "escHTML", "fread", "fclose", "sm", "clearstatcache", "stat", "substr", "sprintf", "fileperms", "escHTML", "str_rot13", "escHTML", "str_rot13", "date", "date", "escHTML", "str_rot13", "sm", "implode", "implode", "isset", "isset", "escHTML", "escHTML", "escHTML", "escHTML", "strnatcmp", "substr", "strlen", "glob", "is_readable", "is_writable", "is_dir", "bname", "is_file", "fopen", "feof", "fread", "stripos", "feof", "fseek", "fclose", "glob", "gs", "isset", "isset", "explode", "gs", "is_readable", "opendir", "readdir", "realpath", "is_dir", "is_file", "strrpos", "substr", "substr", "closedir", "uasort", "isset", "isset", "stat", "escHTML", "str_rot13", "escHTML", "escHTML", "number_format", "date", "posix_getpwuid", "posix_getgrgid", "is_writable", "is_readable", "substr", "sprintf", "fileperms", "count", "count", "is_writable", "escHTML", "escHTML", "is_writable", "escHTML", "sm", "function_exists", "escHTML", "escHTML", "escHTML", "escHTML", "escHTML", "escHTML", "escHTML", "ceil", "sm", "sm", "function_exists", "session_write_close", "ctf", "se", "unlink", "session_write_close", "ctf", "se", "unlink", "session_write_close", "gethostbyname", "socket_create", "socket_set_option", "socket_set_option", "socket_set_nonblock", "socket_connect", "socket_set_block", "usleep", "socket_select", "socket_write", "socket_read", "socket_shutdown", "socket_close", "getservbyport", "nl2br", "escHTML", "flush", "socket_shutdown", "socket_close", "session_write_close", "function_exists", "intval", "function_exists", "intval", "function_exists", "intval", "function_exists", "intval", "function_exists", "intval", "function_exists", "intval", "file", "explode", "strrev", "array_merge", "ssh2_connect", "ssh2_auth_password", "flush", "usleep", "ftp_connect", "ftp_login", "ftp_close", "flush", "usleep", "fsockopen", "fgets", "fwrite", "fgets", "fwrite", "fgets", "fwrite", "fclose", "flush", "usleep", "mysql_connect", "mysql_close", "flush", "usleep", "mssql_connect", "mssql_close", "flush", "usleep", "pg_connect", "pg_close", "flush", "usleep", "session_write_close", "ob_start", "eval", "eval", "function_exists", "create_function", "ctf", "unlink", "ob_get_clean", "se", "pe", "is_readable", "file_get_contents", "ob_start", "phpinfo", "str_replace", "ob_get_clean", "substr", "strpos", "substr", "strpos", "str_replace", "substr", "strpos", "substr", "strrpos", "str_rot13", "number_format", "mt", "die" ], "ms": { "file": { "size": 59520.0 }, "text": { "digit_ratio": 0.04, "space_count": 3303.0, "total_lines": 2.0, "char_entropy": 5.65, "unique_chars": 94.0, "escape_density": 0.16, "import_density": 36050.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "string_density": 1301.0, "avg_line_length": 29759.0, "lines_over_1000": 1.0, "max_line_length": 59513.0, "hex_escape_count": 97.0, "last_line_length": 59513.0, "long_token_count": 40.0, "most_common_char": "e", "whitespace_ratio": 0.06, "most_common_ratio": 0.05, "identifier_density": 1506.0, "line_length_stddev": 29754.0, "octal_escape_count": 1.0, "normalized_import_count": 509.82, "normalized_string_count": 1839.89, "repeated_char_sequences": 16.0, "suspicious_string_ratio": 0.05, "max_inline_whitespace_run": 20.0, "normalized_function_count": 30.41, "imports_to_functions_ratio": 16.77, "strings_to_functions_ratio": 60.51, "suspicious_identifier_ratio": 0.11, "normalized_unique_identifiers": 310.0, "identifiers_to_functions_ratio": 7.21 }, "imports": { "total": 721.0, "unique_modules": 183.0, "third_party_count": 721.0, "third_party_ratio": 1.0 }, "strings": { "total": 2602.0, "avg_length": 9.9, "max_length": 585.0, "path_count": 48.0, "avg_entropy": 1.79, "sql_strings": 64.0, "total_bytes": 25770.0, "entropy_stddev": 1.26, "high_entropy_count": 3.0, "shell_command_strings": 53.0, "unicode_heavy_strings": 8.0, "embedded_code_candidates": 4.0 }, "comments": { "chars": 14.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 1.0 }, "functions": { "total": 43.0, "one_liners": 43.0, "avg_name_length": 2.56, "no_params_count": 43.0, "avg_length_lines": 1.0, "max_length_lines": 1.0, "min_length_lines": 1.0, "single_char_names": 2.0, "density_per_100_lines": 2150.0, "code_in_functions_ratio": 21.5 }, "identifiers": { "total": 3012.0, "avg_length": 6.7, "max_length": 24.0, "min_length": 1.0, "avg_entropy": 2.03, "reuse_ratio": 0.1, "unique_count": 310.0, "length_stddev": 5.11, "has_digit_ratio": 0.06, "sequential_names": 35.0, "single_char_count": 23.0, "single_char_ratio": 0.07, "high_entropy_count": 10.0, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.87, "all_uppercase_ratio": 0.07, "numeric_suffix_count": 14.0, "underscore_prefix_count": 4.0 } }, "ss": [ [ 33, "log_errors_max_len" ], [ 34, "log_errors_max_len" ], [ 70, "log_errors" ], [ 71, "log_errors" ], [ 97, "error_log" ], [ 98, "error_log" ], [ 123, "error_reporting" ], [ 124, "error_reporting" ], [ 151, "log_errors" ], [ 152, "log_errors" ], [ 176, "error_log" ], [ 177, "error_log" ], [ 203, "error_reporting" ], [ 204, "error_reporting" ], [ 256, "max_execution_time" ], [ 257, "max_execution_time" ], [ 333, "memory_limit" ], [ 334, "memory_limit" ], [ 348, "1000M" ], [ 349, "1000M" ], [ 366, "file_uploads" ], [ 367, "file_uploads" ], [ 397, "magic_quotes_runtime" ], [ 398, "magic_quotes_runtime" ], [ 434, "magic_quotes_sybase" ], [ 435, "magic_quotes_sybase" ], [ 466, "magic_quotes_gpc" ], [ 467, "magic_quotes_gpc" ], [ 497, "magic_quotes_runtime" ], [ 498, "magic_quotes_runtime" ], [ 532, "magic_quotes_sybase" ], [ 533, "magic_quotes_sybase" ], [ 572, "5.4" ], [ 573, "5.4" ], [ 621, "safe_mode" ], [ 622, "safe_mode" ], [ 647, "open_basedir" ], [ 648, "open_basedir" ], [ 676, "safe_mode_exec_dir" ], [ 677, "safe_mode_exec_dir" ], [ 707, "safe_mode" ], [ 708, "safe_mode" ], [ 731, "open_basedir" ], [ 732, "open_basedir" ], [ 761, "safe_mode_exec_dir" ], [ 762, "safe_mode_exec_dir" ], [ 799, "disable_function" ], [ 800, "disable_function" ], [ 828, "disable_function" ], [ 829, "disable_function" ], [ 898, "\u0026" ], [ 899, "\u0026" ], [ 903, "\"" ], [ 908, "\u003c" ], [ 909, "\u003c" ], [ 913, "\u003e" ], [ 914, "\u003e" ], [ 925, "\u0026amp;" ], [ 926, "\u0026amp;" ], [ 934, "\u0026quot;" ], [ 935, "\u0026quot;" ], [ 944, "\u0026lt;" ], [ 945, "\u0026lt;" ], [ 952, "\u0026gt;" ], [ 953, "\u0026gt;" ], [ 1307, "archive" ], [ 1308, "archive" ], [ 1345, "gzopen" ], [ 1346, "gzopen" ], [ 1362, "Content-type: application/x-zip" ], [ 1363, "Content-type: application/x-zip" ], [ 1404, "Content-Disposition: attachment; filename=" ], [ 1405, "Content-Disposition: attachment; filename=" ], [ 1452, "_" ], [ 1453, "_" ], [ 1465, "HTTP_HOST" ], [ 1466, "HTTP_HOST" ], [ 1478, "_" ], [ 1479, "_" ], [ 1487, "Y-m-d_H.i" ], [ 1488, "Y-m-d_H.i" ], [ 1500, ".zip" ], [ 1501, ".zip" ], [ 1515, "Content-Transfer-Encoding: binary" ], [ 1516, "Content-Transfer-Encoding: binary" ], [ 1559, "Last-Modified: " ], [ 1560, "Last-Modified: " ], [ 1585, "D, d M Y H:i:s" ], [ 1586, "D, d M Y H:i:s" ], [ 1603, " GMT" ], [ 1604, " GMT" ], [ 1818, "." ], [ 1819, "." ], [ 1829, ".." ], [ 1830, ".." ], [ 1955, "/" ], [ 1956, "/" ], [ 2045, "/" ], [ 2046, "/" ], [ 2121, "\\x14\\x00\\x08\\x00" ], [ 2178, "\\x08" ], [ 2185, "\\x00" ], [ 2195, "\\x00" ], [ 2229, "v" ], [ 2230, "v" ], [ 2247, "\\x00\\x00" ], [ 2263, "\\x50\\x4b\\x03\\x04" ], [ 2287, "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" ], [ 2418, "V" ], [ 2419, "V" ], [ 2528, "/tmp/" ], [ 2529, "/tmp/" ], [ 2555, "rb" ], [ 2556, "rb" ], [ 2576, "wb" ], [ 2577, "wb" ], [ 2671, "rb" ], [ 2672, "rb" ], [ 2858, "rb" ], [ 2859, "rb" ], [ 3031, "V" ], [ 3032, "V" ], [ 3057, "V" ], [ 3058, "V" ], [ 3072, "V" ], [ 3073, "V" ], [ 3088, "\\x50\\x4b\\x07\\x08" ], [ 3123, "\\x50\\x4b\\x01\\x02\\x00\\x00" ], [ 3162, "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" ], [ 3210, "V" ], [ 3211, "V" ], [ 3297, "n" ], [ 3298, "n" ], [ 3308, "\\x14\\x00\\x08\\x00\\x00\\x00" ], [ 3365, "\\x50\\x4b\\x01\\x02\\x00\\x00" ], [ 3405, "h2" ], [ 3406, "h2" ], [ 3416, "v" ], [ 3417, "v" ], [ 3433, "\\x00\\x00" ], [ 3449, "\\x50\\x4b\\x03\\x04" ], [ 3472, "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" ], [ 3533, "h2" ], [ 3534, "h2" ], [ 3552, "cs" ], [ 3553, "cs" ], [ 3570, "crc" ], [ 3571, "crc" ], [ 3638, "cs" ], [ 3639, "cs" ], [ 3662, "crc" ], [ 3663, "crc" ], [ 3679, "crc" ], [ 3680, "crc" ], [ 3710, "crc" ], [ 3711, "crc" ], [ 3740, "crc" ], [ 3741, "crc" ], [ 3782, "V" ], [ 3783, "V" ], [ 3796, "crc" ], [ 3797, "crc" ], [ 3809, "V" ], [ 3810, "V" ], [ 3823, "cs" ], [ 3824, "cs" ], [ 3835, "V" ], [ 3836, "V" ], [ 3849, "cs" ], [ 3850, "cs" ], [ 3861, "\\x50\\x4b\\x07\\x08" ], [ 3908, "h2" ], [ 3909, "h2" ], [ 3914, "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00" ], [ 3962, "V" ], [ 3963, "V" ], [ 3987, "n" ], [ 3988, "n" ], [ 4014, "cs" ], [ 4015, "cs" ], [ 4040, "n" ], [ 4041, "n" ], [ 4120, "v" ], [ 4121, "v" ], [ 4129, "hours" ], [ 4130, "hours" ], [ 4147, "minutes" ], [ 4148, "minutes" ], [ 4165, "seconds" ], [ 4166, "seconds" ], [ 4184, "v" ], [ 4185, "v" ], [ 4194, "year" ], [ 4195, "year" ], [ 4216, "mon" ], [ 4217, "mon" ], [ 4230, "mday" ], [ 4231, "mday" ], [ 4257, "Archive created by S.A.P. v.2.1\\nHost: : " ], [ 4258, "Archive created by S.A.P. v.2.1" ], [ 4291, "Host: : " ], [ 4310, "HTTP_HOST" ], [ 4311, "HTTP_HOST" ], [ 4323, "\\nDate : " ], [ 4326, "Date : " ], [ 4340, "d-m-Y" ], [ 4341, "d-m-Y" ], [ 4364, "v" ], [ 4365, "v" ], [ 4395, "\\x50\\x4b\\x05\\x06\\x00\\x00\\x00\\x00" ], [ 4456, "V" ], [ 4457, "V" ], [ 4486, "V" ], [ 4487, "V" ], [ 4507, "v" ], [ 4508, "v" ], [ 5177, "mysql" ], [ 5178, "mysql" ], [ 5275, "SET NAMES utf8" ], [ 5276, "SET NAMES utf8" ], [ 5359, "mssql" ], [ 5360, "mssql" ], [ 5385, "," ], [ 5386, "," ], [ 5451, "pg" ], [ 5452, "pg" ], [ 5474, " port=" ], [ 5475, " port=" ], [ 5501, "host=" ], [ 5502, "host=" ], [ 5516, " user=" ], [ 5517, " user=" ], [ 5529, " password=" ], [ 5530, " password=" ], [ 5665, "mysql" ], [ 5666, "mysql" ], [ 5716, "mssql" ], [ 5717, "mssql" ], [ 5767, "pg" ], [ 5768, "pg" ], [ 5826, " dbname=" ], [ 5827, " dbname=" ], [ 5887, "mysql" ], [ 5888, "mysql" ], [ 5944, "mssql" ], [ 5945, "mssql" ], [ 6001, "pg" ], [ 6002, "pg" ], [ 6115, "mysql" ], [ 6116, "mysql" ], [ 6140, "SELECT * FROM " ], [ 6141, "SELECT * FROM " ], [ 6161, "." ], [ 6162, "." ], [ 6170, " LIMIT " ], [ 6171, " LIMIT " ] ], "sz": 59520, "ts": [ { "c": 0.8999999761581421, "d": "Calls PHP base64_encode()", "e": [ "base64_encode" ], "i": "micro-behaviors/data/encode/base64::php-base64-encode", "l": 2 }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "c": 0.800000011920929, "d": "Resolve GID to group (posix_getgrgid)", "e": [ "posix_getgrgid" ], "i": "micro-behaviors/os/group/lookup::posix-getgrgid", "l": 3 }, { "c": 0.800000011920929, "d": "SHOW schema administration queries", "e": [ "SHOW TABLES", "SHOW CREATE TABLE" ], "i": "micro-behaviors/data/db/conn/mysql::mysql-show-admin-sql", "l": 3 }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account postgres", "e": [ "postgres" ], "i": "objectives/lateral-movement/brute-force/password::service-account-postgres", "l": 1, "m": "E1110" }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Shell command execution via backticks", "e": [ "`$c`", "`echo 1`" ], "i": "micro-behaviors/process/create/shell/lang::backtick", "l": 3, "m": "E1059" }, { "a": "T1082", "c": 0.699999988079071, "d": "Gets effective UID of current process", "e": [ "posix_geteuid" ], "i": "objectives/discovery/system/fingerprint/info::posix-geteuid", "l": 3, "m": "E1082" }, { "c": 0.8399999737739563, "d": "\"store\" doc cue (storage instruction)", "e": [ "store" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-6--inline-11769", "l": 1 }, { "d": "SOCK_STREAM socket type", "e": [ "SOCK_STREAM" ], "i": "micro-behaviors/communications/socket/tcp::sock-stream", "l": 3 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "file_get_contents (raw POST body reader)", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "c": 0.8500000238418579, "d": "PHP socket_create function", "e": [ "socket_create" ], "i": "micro-behaviors/communications/socket/connect::php-socket-create", "l": 3 }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads disable_functions setting", "e": [ "ini_get('disable_functions" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-disable-functions", "l": 4, "m": "B0032" }, { "c": 1.0, "d": "PHP rmdir function symbol", "e": [ "rmdir" ], "i": "micro-behaviors/fs/delete/directory::php-rmdir", "l": 3 }, { "c": 0.8199999928474426, "d": "Regex component marker", "e": [ "'postgres'," ], "i": "objectives/lateral-movement/brute-force/ssh::weak-login-pair-set--rx-1", "l": 1 }, { "a": "T1082", "d": "References PHP_VERSION constant", "e": [ "PHP_VERSION" ], "i": "objectives/discovery/system/fingerprint/info::php-version-constant", "l": 2, "m": "E1082" }, { "c": 0.800000011920929, "d": "URL parameter fetched and executed", "e": [ "fopen($_POST['fef'], 'w')", "fopen($_POST['fef'], 'rb')", "fopen($_POST['fn'], 'w')", "base64_encode( @file_get_contents($_POST['fef']))", "file_get_contents($_POST['fef'])" ], "i": "objectives/command-and-control/backdoor/webshell/fetch::url-param-fetch", "l": 4, "m": "B0030" }, { "c": 0.800000011920929, "d": "DROP TABLE IF EXISTS statement", "e": [ "DROP TABLE IF EXISTS" ], "i": "micro-behaviors/data/db/conn/mysql::mysql-drop-table-if-exists-sql", "l": 3 }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads open_basedir setting", "e": [ "ini_get('open_basedir" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-open-basedir", "l": 4, "m": "B0032" }, { "a": "T1105", "c": 0.8500000238418579, "d": "File upload access ($_FILES)", "e": [ "$_FILES" ], "i": "micro-behaviors/communications/http/request/params::files", "l": 3 }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "/etc/passwd" ], "i": "objectives/command-and-control/backdoor/webshell/recon::sensitive-path-panel--rx-6", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "PHP mysql_select_db database selection", "e": [ "mysql_select_db" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-select-db", "l": 3 }, { "a": "T1027", "c": 0.75, "d": "Many no-param functions", "e": [ "functions.no_params_count = 43.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::many-no-param-functions", "l": 2, "m": "B0032" }, { "a": "T1562.001", "c": 1.0, "d": "Regex component marker", "e": [ "function_exists('exec" ], "i": "objectives/evasion/security-bypass/runtime::function-exists-exec--rx-1", "l": 1, "m": "B0032" }, { "a": "T1059", "c": 0.949999988079071, "d": "Direct process execution via pcntl_exec()", "e": [ "pcntl_exec" ], "i": "micro-behaviors/process/create/shell/lang::pcntl-exec", "l": 3, "m": "E1059" }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Process execution via proc_open()", "e": [ "proc_open" ], "i": "micro-behaviors/process/create/shell/lang::proc-open", "l": 3, "m": "E1059" }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via shell_exec()", "e": [ "shell_exec" ], "i": "micro-behaviors/process/create/shell/lang::shell-exec", "l": 3, "m": "E1059" }, { "c": 0.800000011920929, "d": "PHP variable function invocation pattern", "e": [ "f" ], "i": "objectives/anti-static/obfuscation/imports::dynamic-function-execution", "l": 3 }, { "a": "T1505.003", "c": 0.8500000238418579, "d": "PHP request superglobal access", "e": [ "$_POST" ], "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call", "l": 3, "m": "B0030" }, { "c": 0.800000011920929, "d": "PHP copy() symbol", "e": [ "copy" ], "i": "objectives/impact/infect/script::php-copy-call", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "bytes() literal (Python byte array)", "e": [ "bytes" ], "i": "objectives/anti-static/obfuscation/payload/config::api-named-byte-array-const--rx-6", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Ignores client abort (webshell indicator)", "e": [ "ignore_user_abort" ], "i": "objectives/command-and-control/backdoor/webshell/session::ignore-abort", "l": 4 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via system()", "e": [ "system" ], "i": "micro-behaviors/process/create/shell/lang::system", "l": 3, "m": "E1059" }, { "d": "Content-Type header string", "e": [ "Content-Type:" ], "i": "micro-behaviors/communications/http/request/client::content-type-header", "l": 1 }, { "a": "T1027", "c": 0.9200000166893005, "d": "HOST URL component identifier", "e": [ "HOST" ], "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12", "l": 1, "m": "B0032" }, { "a": "T1001.003", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "base64_encode( @file_get_contents($_POST['fef'])), '\"/\u003e\u003c/center\u003e';}else{if(@is_readable($_POST['fef'])){?\u003e\u003cform action=\"\" method" ], "i": "objectives/evasion/masquerade/protocol::base64-encoded-post-body--rx-7", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "method=" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3", "l": 1, "m": "B0030" }, { "a": "T1505.003", "c": 0.949999988079071, "d": "Include followed by unlink cleanup", "e": [ "@include($f);@unlink" ], "i": "objectives/command-and-control/backdoor/webshell/archive::include-then-unlink", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 1.0, "d": "Comment-heavy source context", "e": [ "comments.to_code_ratio = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/strings::comment-heavy-source", "l": 1, "m": "B0032" }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chtml" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "posix_geteuid" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster--rx-18", "l": 1, "m": "B0030" }, { "c": 0.75, "d": "Hardcoded localhost network host", "e": [ "localhost" ], "i": "micro-behaviors/communications/ip/literal::localhost-source", "l": 2 }, { "c": 0.8500000238418579, "d": "MIME attachment disposition", "e": [ "Content-Disposition: attachment" ], "i": "micro-behaviors/communications/email/mime::mime-content-disposition", "l": 1 }, { "c": 0.8500000238418579, "d": "PHP mysql_connect database handle", "e": [ "mysql_connect" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-connect", "l": 3 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "ini_restore('safe_mode" ], "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-1", "l": 1, "m": "B0030" }, { "c": 0.949999988079071, "d": "Disables error reporting (error_reporting(0))", "e": [ "error_reporting(0)" ], "i": "micro-behaviors/os/stdio::error-reporting-off", "l": 3 }, { "c": 0.8399999737739563, "d": "\"password\" doc-context token", "e": [ " password=" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750", "l": 1 }, { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "c": 0.8500000238418579, "d": "PHP mysql table admin APIs", "e": [ "mysql_list_tables" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-table-admin-api", "l": 3 }, { "a": "T1505.003", "c": 0.8799999952316284, "d": "Regex component marker", "e": [ "php_uname" ], "i": "objectives/command-and-control/backdoor/webshell/exec::dangerous-php-function-cluster--rx-17", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "/tmp/" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "c": 0.8999999761581421, "d": "passthru fallback function name", "e": [ "passthru" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-passthru-name", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "system fallback function name", "e": [ "system" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-system-name", "l": 1, "m": "B0030" }, { "a": "T1105", "c": 0.8500000238418579, "d": "Moves uploaded PHP file", "e": [ "move_uploaded_file" ], "i": "micro-behaviors/fs/write/file/direct::move-uploaded-file", "l": 3, "m": "C0052" }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Process open via popen()", "e": [ "popen" ], "i": "micro-behaviors/process/create/shell/lang::popen", "l": 3, "m": "E1059" }, { "c": 0.8500000238418579, "d": "Removes PHP script execution time limit", "e": [ "@set_time_limit(0)" ], "i": "objectives/command-and-control/backdoor/webshell/session::unlimited-runtime-call", "l": 4 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "d": "CREATE TABLE SQL keyword", "e": [ "CREATE TABLE" ], "i": "micro-behaviors/data/db/conn/sql::sql-create-table", "l": 3 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Last line is over 1000 chars", "e": [ "text.last_line_length = 59513.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "\"directory\" path-target noun", "e": [ "directory" ], "i": "micro-behaviors/data/text/llm/action::llm-path-noun-directory", "l": 1 }, { "a": "T1562.001", "c": 1.0, "d": "Regex component marker", "e": [ "function_exists('shell_exec" ], "i": "objectives/evasion/security-bypass/runtime::function-exists-exec--rx-2", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "PHP unlink function symbol", "e": [ "unlink" ], "i": "micro-behaviors/fs/delete/file::php-unlink", "l": 3 }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "SELECT * FROM" ], "i": "micro-behaviors/data/db/conn/sql::sql-select", "l": 3 }, { "a": "T1059.001", "c": 0.8999999761581421, "d": "Error-suppressed eval (@eval)", "e": [ "@eval(" ], "i": "objectives/execution/interpreter/eval/remote::eval-error-suppressed", "l": 4, "m": "E1059" }, { "c": 0.8500000238418579, "d": "PHP mysql database admin APIs", "e": [ "mysql_list_dbs" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-db-admin-api", "l": 3 }, { "c": 0.8399999737739563, "d": "CSV attachment filename response", "e": [ "Content-Disposition: attachment; filename" ], "i": "micro-behaviors/data/format/csv/http-telemetry::csv-attachment-filename", "l": 1 }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "\"password\" string-literal token", "e": [ " password=" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6", "l": 1 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "enctype attribute", "e": [ "enctype=" ], "i": "micro-behaviors/communications/http/post::enctype-attr", "l": 3, "m": "C0002" }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_POST[...] superglobal access", "e": [ "$_POST[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-post", "l": 1, "m": "B0030" }, { "a": "T1222", "c": 0.699999988079071, "d": "Changes file permissions via chmod()", "e": [ "chmod" ], "i": "micro-behaviors/fs/chmod/modify::chmod-call", "l": 3 }, { "a": "T1505.003", "c": 0.8399999737739563, "d": "PHP readfile output function", "e": [ "readfile" ], "i": "objectives/command-and-control/backdoor/webshell/stager::readfile-output", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "inet_aton" ], "i": "micro-behaviors/communications/ip/parse::ip-to-long-conversion--rx-3", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 2.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "Very long line", "e": [ "text.max_line_length = 59513.00" ], "i": "metadata/file/text/metrics::single-long-line", "l": 1 }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@ini_set('max_execution_time',0)", "@ini_set('error_reporting',NULL)", "@ini_set('log_errors_max_len',0)", "@ini_restore('magic_quotes_runtime')", "@ini_set('file_uploads',1)", "@ini_set('log_errors',0)", "@ini_set('magic_quotes_gpc',0)", "@ini_set('error_log',NULL)", "@ini_restore('magic_quotes_sybase')", "@ini_restore('error_log')", "@ini_restore('log_errors')", "@error_reporting(0)", "@ignore_user_abort(TRUE)", "@ini_restore('error_reporting')", "@set_time_limit(0)", "@ini_set('memory_limit','1000M')" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "a": "T1083", "c": 1.0, "d": "Iterate directory contents via functions in PHP", "e": [ "opendir(" ], "i": "micro-behaviors/fs/directory/traverse::php-dir-traverse-fn", "l": 2 }, { "c": 0.8500000238418579, "d": "PHP mysql query execution APIs", "e": [ "mysql_query" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-query", "l": 3 }, { "a": "T1082", "c": 0.699999988079071, "d": "Accesses PHP_OS constant (OS detection)", "e": [ "PHP_OS" ], "i": "objectives/discovery/system/fingerprint/info::php-os-constant", "l": 3, "m": "E1082" }, { "c": 0.800000011920929, "d": "String containing escaped hex control character (06-07)", "e": [ "\\x07" ], "i": "micro-behaviors/data/encode/hex::hex-escaped-control-char", "l": 2 }, { "c": 0.800000011920929, "d": "PHP rename() symbol", "e": [ "rename" ], "i": "objectives/impact/infect/script::php-rename-call", "l": 1 }, { "d": "INSERT INTO SQL keyword", "e": [ "INSERT INTO" ], "i": "micro-behaviors/data/db/conn/sql::sql-insert", "l": 3 }, { "a": "T1562.001", "c": 0.699999988079071, "d": "Reads safe_mode setting", "e": [ "ini_get('safe_mode" ], "i": "objectives/evasion/security-bypass/runtime::ini-get-safe-mode", "l": 4, "m": "B0032" }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 35.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "a": "T1486", "c": 0.4000000059604645, "d": "rename( function", "e": [ "rename(" ], "i": "objectives/impact/ransom/tactics::rename-fn", "l": 1 }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 3 }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Very long embedded string", "e": [ "strings.max_length = 585.00" ], "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string", "l": 1 }, { "d": "password keyword", "e": [ "password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "d": "overflow keyword", "e": [ "overflow" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Exactly one line exceeds 1000 chars", "e": [ "text.lines_over_1000 = 1.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "l": 1, "m": "B0032" }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via exec()", "e": [ "exec" ], "i": "micro-behaviors/process/create/shell/lang::exec-dup", "l": 3, "m": "E1059" }, { "c": 0.8199999928474426, "d": "fopen() with w/x/c overwrite mode", "e": [ "fopen($t, 'w'" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP POST parameter access ($_POST)", "e": [ "$_POST" ], "i": "micro-behaviors/communications/http/request/params::post-dup", "l": 3 }, { "a": "T1505.003", "c": 0.8199999928474426, "d": "Content-Disposition download response", "e": [ "Content-Disposition: attachment; filename" ], "i": "objectives/command-and-control/backdoor/webshell/stager::content-disposition-download", "l": 1 }, { "c": 0.8999999761581421, "d": "shell_exec fallback function name", "e": [ "shell_exec" ], "i": "objectives/command-and-control/backdoor/webshell/exec::fallback-shell-exec-name", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Interactive shell references (/bin/sh -i)", "e": [ "/bin/sh -i" ], "i": "micro-behaviors/process/create/shell/invoke::bin-sh-interactive", "l": 3 }, { "c": 0.8500000238418579, "d": "PHP socket_connect function", "e": [ "socket_connect" ], "i": "micro-behaviors/communications/socket/connect::php-socket-connect", "l": 3 }, { "a": "T1505.003", "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "ini_get('disable_functions" ], "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-2", "l": 1, "m": "B0030" }, { "a": "T1021.004", "c": 0.4000000059604645, "d": "ssh string", "e": [ "ssh" ], "i": "micro-behaviors/communications/ssh/connect::ssh-string", "l": 2 }, { "c": 0.8399999737739563, "d": "\"upload\" string-literal token", "e": [ "file_uploads" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11", "l": 1 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via passthru()", "e": [ "passthru" ], "i": "micro-behaviors/process/create/shell/lang::passthru", "l": 3, "m": "E1059" }, { "c": 0.75, "d": "Session variable access ($_SESSION)", "e": [ "$_SESSION" ], "i": "micro-behaviors/communications/http/request/params::session", "l": 3 }, { "a": "T1082", "d": "Accesses SERVER_NAME variable", "e": [ "$_SERVER['SERVER_NAME']" ], "i": "objectives/discovery/system/fingerprint/info::server-name-access", "l": 3, "m": "E1082" }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Variable input reaches alt exec functions", "e": [ "passthru($" ], "i": "micro-behaviors/process/create/shell/lang::exec-user-input-func-alt", "l": 3, "m": "E1059" }, { "a": "T1027", "c": 0.75, "d": "Many short functions (deobfuscation layers)", "e": [ "functions.one_liners = 43.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-many-short-functions", "l": 4, "m": "B0032" }, { "a": "T1069", "c": 0.800000011920929, "d": "/etc/group group database", "e": [ "/etc/group" ], "i": "micro-behaviors/fs/path/config/groups::etc-group", "l": 3 }, { "a": "T1027", "c": 0.8500000238418579, "d": "High function density", "e": [ "functions.density_per_100_lines = 2150.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/functions::high-function-density", "l": 2, "m": "B0032" }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "passwd')){$a=file" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "a": "T1071.001", "d": "listen() socket call", "e": [ "listen" ], "i": "micro-behaviors/communications/http/server/listener::listen-keyword", "l": 3, "m": "C0002" }, { "a": "T1027", "c": 0.699999988079071, "d": "Low identifier reuse ratio", "e": [ "identifiers.reuse_ratio = 0.10" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::low-identifier-reuse", "l": 2, "m": "B0032" }, { "a": "T1082", "c": 0.699999988079071, "d": "Accesses SERVER_SOFTWARE variable", "e": [ "$_SERVER['SERVER_SOFTWARE']" ], "i": "objectives/discovery/system/fingerprint/info::server-software-access", "l": 3, "m": "E1082" }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "multipart/form-data content type", "e": [ "multipart/form-data" ], "i": "micro-behaviors/communications/http/post::multipart-form", "l": 1, "m": "C0002" }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Variable input reaches core exec functions", "e": [ "exec($" ], "i": "micro-behaviors/process/create/shell/lang::exec-user-input-func-core", "l": 3, "m": "E1059" }, { "c": 0.699999988079071, "d": "Remove execution time limit", "e": [ "set_time_limit" ], "i": "micro-behaviors/process/control/signal::set-time-limit", "l": 3 }, { "a": "T1059.004", "c": 0.6000000238418579, "d": "References /bin/sh (Bourne shell)", "e": [ "/bin/sh -i", "/bin/sh" ], "i": "micro-behaviors/process/create/shell/invoke::bin-sh", "l": 3, "m": "E1059.004" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_POST['fc']", "$_POST['fdwa']", "$_POST['cd']", "$_POST['sdd']", "$_POST['fdw']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "d": ".exe extension reference", "e": [ ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1082", "c": 0.6000000238418579, "d": "Windows platform detection marker", "e": [ "Windows-1251" ], "i": "objectives/discovery/system/fingerprint/os::os-check-windows", "l": 2, "m": "B0012" }, { "a": "T1027", "c": 0.8999999761581421, "d": "PHP source contains very long line", "e": [ "text.max_line_length = 59513.00" ], "i": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "l": 4, "m": "B0032" }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account mysql", "e": [ "mysql" ], "i": "objectives/lateral-movement/brute-force/password::service-account-mysql", "l": 1, "m": "E1110" }, { "c": 0.9800000190734863, "d": "ALFA create_function fragment", "e": [ "create_fun" ], "i": "well-known/malware/webshell/alfa::alfa-create-function-fragment", "l": 4 }, { "c": 0.699999988079071, "d": "perl interpreter keyword (beyond shebang)", "e": [ "perl" ], "i": "micro-behaviors/process/interpreter/perl::perl-keyword", "l": 3 }, { "a": "T1033", "c": 0.800000011920929, "d": "/etc/passwd user database", "e": [ "/etc/passwd" ], "i": "micro-behaviors/fs/path/config/accounts::etc-passwd", "l": 2 }, { "c": 0.4000000059604645, "d": "cmd.exe Windows command shell reference", "e": [ "cmd.exe" ], "i": "objectives/execution/interpreter/script/shell::cmd-exe-dup", "l": 1 }, { "c": 0.8999999761581421, "d": "PHP MySQL administration surface", "e": [ "mysql_connect", "SHOW CREATE TABLE", "mysql_query", "SHOW TABLES" ], "i": "micro-behaviors/data/db/conn/mysql::php-mysql-admin-surface", "l": 3 }, { "c": 0.949999988079071, "d": "Falls back through multiple PHP execution functions", "e": [ "system", "shell_exec" ], "i": "objectives/command-and-control/backdoor/webshell/exec::php-execution-fallback-chain", "l": 4, "m": "B0030" }, { "d": "SQL statement keywords", "e": [ "CREATE TABLE", "INSERT INTO", "SELECT * FROM" ], "i": "micro-behaviors/data/db/conn/sql::sql-keywords", "l": 3 }, { "a": "T1562.001", "c": 0.800000011920929, "d": "Reads multiple PHP security restrictions", "e": [ "ini_get('safe_mode", "ini_get('disable_functions", "ini_get('open_basedir" ], "i": "objectives/evasion/security-bypass/runtime::security-restriction-probe", "l": 4, "m": "B0032" }, { "a": "T1505.003", "c": 0.9700000286102295, "d": "PHP administrative webshell UI", "e": [ "ini_restore('safe_mode", "ini_get('disable_functions", "/etc/passwd" ], "i": "objectives/command-and-control/backdoor/webshell/ui::php-admin-webshell-ui", "l": 5, "m": "B0030" }, { "c": 0.9200000166893005, "d": "PHP unlink near file recreate", "e": [ "rename", "copy" ], "i": "objectives/impact/infect/script::php-unlink-recreate-pattern", "l": 1 }, { "a": "T1566.002", "c": 0.8500000238418579, "d": "PHP script writing POST data to local file", "e": [ "$_POST" ], "i": "objectives/credential-access/phishing/tactics::php-credential-exfiltration", "l": 4, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Decoded unicode-escape content", "e": [ "/* bd166d03f880 */@ini_set('log_errors_m \u003cunicode-escape\u003e" ], "i": "metadata/encoded-payload/unicode-escape", "l": 2 }, { "c": 0.8999999761581421, "d": "php webshell having some kind of input and some kind of payload. restricted to small files or big ones including suspicious strings", "e": [ "\u003c?", "\u003c?php", "addslashes" ], "i": "third_party/SigBase/EXT/WEBSHELL/PHP/Generic", "l": 5 }, { "c": 0.8999999761581421, "d": "php webshell having some kind of input and using a callback to execute the payload. restricted to small files or would give lots of false positives", "e": [ "($_POST)", "_SERVER['HTTP_", "_POST[" ], "i": "third_party/SigBase/WEBSHELL/PHP/Generic/Callback", "l": 5 }, { "c": 0.8999999761581421, "d": "PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k", "e": [ "\u003c?php", "$f($", "eval(", "\u003c?", "$f()" ], "i": "third_party/SigBase/WEBSHELL/PHP/Dynamic/Big", "l": 5 } ], "sha": "665b43b09a9883313a66b5c0d6852e901e217a2f3914ff9c3ff79938846dc48c", "path": "/data/samples/bad/datasets/php-malware-analysis/webshells/tbl_status.php/dc2.php", "type": "php" } ], "tv": "87c42" } }