{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9999681711196899,
        "class": 2
      }
    ],
    "prob": 0.9999682,
    "class": 2,
    "models": [
      {
        "m": "az",
        "prob": 0.9960997,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.99949586,
        "class": 1
      },
      {
        "m": "az/php",
        "prob": 0.9999682,
        "class": 2
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-09T11:39:41Z"
  },
  "path": "index.php",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "KO₅(C₆As₂ErDyLa₃)H₃(CmDb₆Os)MdTh",
        "k": {
          "source.imports[0]": "base64_encode",
          "source.imports[1]": "chdir",
          "source.imports[2]": "die",
          "source.imports[3]": "empty",
          "source.imports[4]": "error_reporting",
          "source.imports[5]": "getenv",
          "source.imports[6]": "ini_get",
          "source.imports[7]": "is_dir",
          "source.imports[8]": "isset",
          "source.imports[9]": "mysql_connect",
          "source.strings[0]": " \n\n\n\u003cbr\u003e\u003ctable width='100%' height='1' border='1' cellPadding=5 cellSpacing=0 borderColorDark=#666666 id='table1' style='BORDER-COLLAPSE: collapse'\u003e \n\u003ctr\u003e \n\u003ctd width='25%' height='1' valign='top' style='font-family: verdana; color: #000000; font-size: 11px'\u003e \n  \u003ccenter\u003e\u003cp\u003e\u003cstrong\u003e\u003ch2\u003eEdited By WebRooT\u003c/strong\u003e\u003c/p\u003e\u003c/h2\u003e\u003c/center\u003e\n  \u003ccenter\u003e\u003cp\u003e\u003cstrong\u003e..:: indexer V2.0 ::..\u003c/strong\u003e\u003c/p\u003e\u003c/center\u003e\n\u003cp\u003e\u003cstrong\u003e\u003c/strong\u003e\u003cbr\u003e \n\u003c/p\u003e\u003c/td\u003e \n\u003c/tr\u003e\u003c/table\u003e",
          "source.strings[1]": " WHERE ID_CAT=",
          "source.strings[2]": " WHERE cat_id=",
          "source.strings[3]": " WHERE title='FORUMHOME",
          "source.strings[4]": " WHERE title='index",
          "source.strings[5]": " WHERE title='spacer_open",
          "source.strings[6]": ", stylevars='', csscolors='', editorstyles=",
          "source.strings[7]": "\u003c/font\u003e",
          "source.strings[8]": "\u003cbody text='#FFFFFF'\u003e \n\u003ctable border='1' width='100%' id='table1' border='1' cellPadding=5 cellSpacing=0 borderColorDark=#666666 bordercolorlight='#C0C0C0'\u003e \n\u003c/table\u003e",
          "source.strings[9]": "\u003ccenter\u003e\u003cform method=POST action''\u003e\u003cinput type=submit name=vbulletin value='VB HACK.'\u003e\u003cinput type=submit name=mybulletin value='MyBB HACK.'\u003e\u003cinput type=submit name=phpbb value='  phpBB HACK.  '\u003e\u003cinput type=submit name=smf value='  SMF HACK.  '\u003e\u003c/form\u003e\u003c/center\u003e",
          "source.has_imports": true,
          "source.imports[10]": "mysql_error",
          "source.imports[11]": "mysql_query",
          "source.imports[12]": "mysql_select_db",
          "source.imports[13]": "php_uname",
          "source.imports[14]": "phpinfo",
          "source.imports[15]": "phpversion",
          "source.imports[16]": "realpath",
          "source.imports[17]": "str_replace",
          "source.imports[18]": "tempnam",
          "source.strings[10]": "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== MyBB indexer ==\u003c/font\u003e\u003c/center\u003e \n    \u003ccenter\u003e\u003cform method=POST action=''\u003e\u003cfont face='Arial' color='#000000'\u003eMysql Host\u003c/font\u003e\u003cbr\u003e\u003cinput type=text name=mybbdbh value=localhost size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eDbKullanici\u003cbr\u003e\u003c/font\u003e\u003cinput type=text name=mybbdbu size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eDbadi\u003cbr\u003e\u003c/font\u003e\u003cinput type=text name=mybbdbn size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eDbsifre\u003cbr\u003e\u003c/font\u003e\u003cinput type=password name=mybbdbp size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eindexin Yazilacagi Bolum\u003c/font\u003e\u003cbr\u003e\u003ctextarea name=mybbindex rows='19' cols='103' style='color: #000000; background-color: #FFFFFF'\u003eburaya indexiniz gelecek.?ndexi yaz postala kay gitsin.\u003c/textarea\u003e\u003cbr\u003e \n          \u003cinput type=submit value='Kay Gitsin!' \u003e\u003c/form\u003e\u003c/center\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\u003c/center\u003e",
          "source.strings[11]": "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== PHPBB indexer ==\u003c/font\u003e\u003c/center\u003e \n    \u003ccenter\u003e\u003cform method=POST action=''\u003e\u003cfont face='Arial' color='#000000'\u003eMysql Host\u003c/font\u003e\u003cbr\u003e\u003cinput type=text name=phpbbdbh value=localhost size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eDbKullanici\u003cbr\u003e\u003c/font\u003e\u003cinput type=text name=phpbbdbu size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eDbadi\u003cbr\u003e\u003c/font\u003e\u003cinput type=text name=phpbbdbn size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eDbsifre\u003cbr\u003e\u003c/font\u003e\u003cinput type=password name=phpbbdbp size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eYazi Veya  KOD\u003cbr\u003e\u003c/font\u003e\u003cinput type=text name=phpbbkat size='100' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eDegisecek KATEGORI ID si\u003cbr\u003e\u003c/font\u003e\u003cinput type=text name=katid size='100' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cinput type=submit value='Kay Gitsin!' \u003e\u003c/form\u003e\u003c/center\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\u003c/center\u003e",
          "source.strings[12]": "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== SMF Indexer ==\u003c/font\u003e\u003c/center\u003e \n    \u003ccenter\u003e\u003cform method=POST action=''\u003e\u003cfont face='Arial' color='#000000'\u003eMysql Host\u003c/font\u003e\u003cbr\u003e\u003cinput type=text name=smfdbh value=localhost size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eDbKullanici\u003cbr\u003e\u003c/font\u003e\u003cinput type=text name=smfdbu size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eDbadi\u003cbr\u003e\u003c/font\u003e\u003cinput type=text name=smfdbn size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eDbsifre\u003cbr\u003e\u003c/font\u003e\u003cinput type=password name=smfdbp size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n                    \u003cfont face='Arial' color='#000000'\u003eYazi Yada KOD\u003cbr\u003e\u003c/font\u003e\u003cinput type=text name=smf_index size='100' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n                    \u003cfont face='Arial' color='#000000'\u003eDegisecek KATEGORI ID si \u003cbr\u003e\u003c/font\u003e\u003cinput type=text name=katid size='100' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n\n          \u003cinput type=submit value='Kay Gitsin!' \u003e\u003c/form\u003e\u003c/center\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\u003c/center\u003e",
          "source.strings[13]": "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== VB indexer ==\u003c/font\u003e\u003c/center\u003e \n    \u003ccenter\u003e\u003cform method=POST action=''\u003e\u003cfont face='Arial' color='#000000'\u003eMysql Host\u003c/font\u003e\u003cbr\u003e\u003cinput type=text name=dbh value=localhost size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eDbKullanici\u003cbr\u003e\u003c/font\u003e\u003cinput type=text name=dbu size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eDbadi\u003cbr\u003e\u003c/font\u003e\u003cinput type=text name=dbn size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n\t\t  \n          \u003cfont face='Arial' color='#000000'\u003eDbsifre\u003cbr\u003e\u003c/font\u003e\u003cinput type=password name=dbp size='50' style='font-size: 8pt; color: #000000; font-family: Tahoma; border: 1px solid #666666; background-color: #FFFFFF'\u003e\u003cbr\u003e \n          \u003cfont face='Arial' color='#000000'\u003eindexin Yazilacagi Bolum\u003c/font\u003e\u003cbr\u003e\u003ctextarea name=index rows='19' cols='103' style='color: #000000; background-color: #FFFFFF'\u003eburaya indexiniz gelecek.indexi yaz postala kay gitsin.\u003c/textarea\u003e\u003cbr\u003e \n          \u003cinput type=submit value='Kay Gitsin!' \u003e\u003c/form\u003e\u003c/center\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/table\u003e\u003c/center\u003e",
          "source.strings[14]": "\u003cfont color=green\u003eNone\u003c/font\u003e",
          "source.strings[15]": "\u003cfont color=red face='Verdana' size='1'\u003eON\u003c/font\u003e",
          "source.strings[16]": "\u003cfont color=red\u003e",
          "source.strings[17]": "\u003cfont color=red\u003e$disfunc\u003c/font\u003e",
          "source.strings[18]": "\u003cfont face='Verdana' size='1' color=green\u003eOFF\u003c/font\u003e",
          "source.strings[19]": "\u003chead\u003e \n\u003cstyle\u003e \nbody { font-size: 12px; \n\n           font-family: arial, helvetica; \n\n            scrollbar-width: 5; \n\n            scrollbar-height: 5; \n\n            scrollbar-face-color: black; \n\n            scrollbar-shadow-color: silver; \n\n            scrollbar-highlight-color: silver; \n\n            scrollbar-3dlight-color:silver; \n\n            scrollbar-darkshadow-color: silver; \n\n            scrollbar-track-color: black; \n\n            scrollbar-arrow-color: silver; \n\n    } \n\u003c/style\u003e \n\n\u003ctitle\u003eLolipop\u003c/title\u003e\u003c/head\u003e",
          "source.strings[20]": "\u003cscript\u003ealert('MyBB Hacked');\u003c/script\u003e",
          "source.strings[21]": "\u003cscript\u003ealert('PhpBB Hacked');\u003c/script\u003e",
          "source.strings[22]": "\u003cscript\u003ealert('Vb Hacked');\u003c/script\u003e",
          "source.strings[23]": "\u003cscript\u003ealert('smf Hacked');\u003c/script\u003e",
          "source.strings[24]": "\u003ctd\u003e\u003cfont color=\"#CC0000\"\u003e\u003cstrong\u003e\u003c/strong\u003e\u003c/font\u003e\u003cfont color=\"#000000\"\u003e\u003c/em\u003e\u003c/font\u003e    \u003c/tr\u003e \n",
          "source.strings[25]": "HTTP_HOST",
          "source.strings[26]": "Powered By WebRooT",
          "source.strings[27]": "REMOTE_ADDR",
          "source.strings[28]": "SCRIPT_NAME",
          "source.strings[29]": "SERVER_ADDR",
          "source.strings[30]": "SERVER_NAME",
          "source.strings[31]": "SERVER_SOFTWARE",
          "source.strings[32]": "UPDATE ",
          "source.strings[33]": "UPDATE phpbb_categories  SET cat_title=",
          "source.strings[34]": "UPDATE style SET css=",
          "source.strings[35]": "UPDATE template SET template=",
          "source.strings[36]": "\\'))}}{",
          "source.strings[37]": "\\'))}}{\\${exit()}}\u003c/textarea\u003e",
          "source.strings[38]": "categories SET name=",
          "source.strings[39]": "commander",
          "source.strings[40]": "disable_functions",
          "source.strings[41]": "echo \\\"$index\\\";",
          "source.strings[42]": "execute",
          "source.strings[43]": "header",
          "source.strings[44]": "ls -la",
          "source.strings[45]": "mybbdbh",
          "source.strings[46]": "mybbdbn",
          "source.strings[47]": "mybbdbp",
          "source.strings[48]": "mybbdbu",
          "source.strings[49]": "mybbindex",
          "source.strings[50]": "mybulletin",
          "source.strings[51]": "phpbbdbh",
          "source.strings[52]": "phpbbdbn",
          "source.strings[53]": "phpbbdbp",
          "source.strings[54]": "phpbbdbu",
          "source.strings[55]": "phpbbkat",
          "source.strings[56]": "phpinfo",
          "source.strings[57]": "safe_mode",
          "source.strings[58]": "smf_index",
          "source.strings[59]": "smfdbh",
          "source.strings[60]": "smfdbn",
          "source.strings[61]": "smfdbp",
          "source.strings[62]": "smfdbu",
          "source.strings[63]": "source",
          "source.strings[64]": "sourcego",
          "source.strings[65]": "templates SET template=",
          "source.strings[66]": "vbulletin",
          "source.strings[67]": "xhackers.txt",
          "source.strings[68]": "{\\${eval(base64_decode(\\",
          "source.strings[69]": "{eval(base64_decode(\\",
          "source.strings[70]": "{exit()}}\u003c/textarea\u003e"
        },
        "x": 398,
        "id": 0,
        "is": [
          "error_reporting",
          "getenv",
          "php_uname",
          "ini_get",
          "ini_get",
          "phpversion",
          "realpath",
          "tempnam",
          "isset",
          "die",
          "phpinfo",
          "isset",
          "is_dir",
          "chdir",
          "realpath",
          "isset",
          "die",
          "str_replace",
          "base64_encode",
          "empty",
          "empty",
          "empty",
          "empty",
          "mysql_connect",
          "die",
          "mysql_error",
          "mysql_select_db",
          "die",
          "mysql_error",
          "mysql_query",
          "die",
          "mysql_error",
          "mysql_query",
          "die",
          "mysql_error",
          "mysql_query",
          "die",
          "mysql_error",
          "isset",
          "die",
          "empty",
          "empty",
          "empty",
          "empty",
          "mysql_connect",
          "die",
          "mysql_error",
          "mysql_select_db",
          "die",
          "mysql_error",
          "mysql_query",
          "die",
          "mysql_error",
          "isset",
          "die",
          "empty",
          "empty",
          "empty",
          "empty",
          "mysql_connect",
          "die",
          "mysql_error",
          "mysql_select_db",
          "die",
          "mysql_error",
          "mysql_query",
          "die",
          "mysql_error",
          "isset",
          "die",
          "empty",
          "empty",
          "empty",
          "empty",
          "mysql_connect",
          "die",
          "mysql_error",
          "mysql_select_db",
          "die",
          "mysql_error",
          "mysql_query",
          "die",
          "mysql_error"
        ],
        "ms": {
          "file": {
            "size": 12644.0
          },
          "text": {
            "tab_count": 2.0,
            "digit_ratio": 0.08,
            "space_count": 1583.0,
            "total_lines": 276.0,
            "char_entropy": 5.39,
            "mixed_indent": true,
            "unique_chars": 86.0,
            "import_density": 30.07,
            "lines_over_200": 23.0,
            "string_density": 0.76,
            "avg_line_length": 44.82,
            "max_line_length": 272.0,
            "empty_line_ratio": 0.18,
            "last_line_length": 3.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.15,
            "most_common_ratio": 0.05,
            "identifier_density": 0.99,
            "line_length_stddev": 64.53,
            "normalized_import_count": 5.0,
            "normalized_string_count": 12.64,
            "repeated_char_sequences": 34.0,
            "suspicious_string_ratio": 0.05,
            "max_inline_whitespace_run": 4.0,
            "trailing_whitespace_lines": 225.0,
            "suspicious_identifier_ratio": 0.01,
            "normalized_unique_identifiers": 10.98
          },
          "imports": {
            "total": 83.0,
            "unique_modules": 19.0,
            "third_party_count": 83.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 210.0,
            "avg_length": 83.07,
            "max_length": 1656.0,
            "avg_entropy": 2.77,
            "total_bytes": 17444.0,
            "entropy_stddev": 1.15,
            "very_long_strings": 8.0,
            "high_entropy_count": 10.0,
            "embedded_code_candidates": 10.0
          },
          "comments": {
            "chars": 146.0,
            "lines": 13.0,
            "total": 13.0,
            "hack_count": 3.0,
            "to_code_ratio": 0.05
          },
          "functions": {},
          "identifiers": {
            "total": 274.0,
            "avg_length": 6.4,
            "max_length": 15.0,
            "min_length": 2.0,
            "avg_entropy": 2.32,
            "reuse_ratio": 0.32,
            "unique_count": 89.0,
            "length_stddev": 2.78,
            "has_digit_ratio": 0.09,
            "all_lowercase_ratio": 0.88,
            "all_uppercase_ratio": 0.03,
            "repeated_char_names": 1.0,
            "numeric_suffix_count": 6.0,
            "underscore_prefix_count": 3.0
          }
        },
        "ss": [
          [
            169,
            "SERVER_SOFTWARE"
          ],
          [
            170,
            "SERVER_SOFTWARE"
          ],
          [
            209,
            "HTTP_HOST"
          ],
          [
            210,
            "HTTP_HOST"
          ],
          [
            245,
            "SCRIPT_NAME"
          ],
          [
            246,
            "SCRIPT_NAME"
          ],
          [
            284,
            "SERVER_NAME"
          ],
          [
            285,
            "SERVER_NAME"
          ],
          [
            348,
            "safe_mode"
          ],
          [
            349,
            "safe_mode"
          ],
          [
            386,
            "disable_functions"
          ],
          [
            387,
            "disable_functions"
          ],
          [
            432,
            "REMOTE_ADDR"
          ],
          [
            433,
            "REMOTE_ADDR"
          ],
          [
            474,
            "SERVER_ADDR"
          ],
          [
            475,
            "SERVER_ADDR"
          ],
          [
            547,
            "chdir"
          ],
          [
            548,
            "chdir"
          ],
          [
            557,
            "/"
          ],
          [
            558,
            "/"
          ],
          [
            581,
            "fdel"
          ],
          [
            582,
            "fdel"
          ],
          [
            613,
            "execute"
          ],
          [
            614,
            "execute"
          ],
          [
            644,
            "cmd"
          ],
          [
            645,
            "cmd"
          ],
          [
            677,
            "commander"
          ],
          [
            678,
            "commander"
          ],
          [
            702,
            "ls -la"
          ],
          [
            703,
            "ls -la"
          ],
          [
            734,
            "source"
          ],
          [
            735,
            "source"
          ],
          [
            766,
            "gomkf"
          ],
          [
            767,
            "gomkf"
          ],
          [
            797,
            "title"
          ],
          [
            798,
            "title"
          ],
          [
            831,
            "sourcego"
          ],
          [
            832,
            "sourcego"
          ],
          [
            858,
            "tmp"
          ],
          [
            859,
            "tmp"
          ],
          [
            894,
            "cx"
          ],
          [
            895,
            "cx"
          ],
          [
            922,
            "fcopy"
          ],
          [
            923,
            "fcopy"
          ],
          [
            953,
            "tuser"
          ],
          [
            954,
            "tuser"
          ],
          [
            983,
            "user"
          ],
          [
            984,
            "user"
          ],
          [
            1012,
            "wdir"
          ],
          [
            1013,
            "wdir"
          ],
          [
            1041,
            "tdir"
          ],
          [
            1042,
            "tdir"
          ],
          [
            1071,
            "symgo"
          ],
          [
            1072,
            "symgo"
          ],
          [
            1093,
            "xhackers.txt"
          ],
          [
            1094,
            "xhackers.txt"
          ],
          [
            1127,
            "to"
          ],
          [
            1128,
            "to"
          ],
          [
            1155,
            "sbjct"
          ],
          [
            1156,
            "sbjct"
          ],
          [
            1184,
            "msg"
          ],
          [
            1185,
            "msg"
          ],
          [
            1207,
            "From:"
          ],
          [
            1208,
            "From:"
          ],
          [
            1222,
            "header"
          ],
          [
            1223,
            "header"
          ],
          [
            1264,
            "phpinfo"
          ],
          [
            1265,
            "phpinfo"
          ],
          [
            1352,
            "\u003cfont color=red face='Verdana' size='1'\u003eON\u003c/font\u003e"
          ],
          [
            1353,
            "\u003cfont color=red face='Verdana' size='1'\u003eON\u003c/font\u003e"
          ],
          [
            1429,
            "\u003cfont face='Verdana' size='1' color=green\u003eOFF\u003c/font\u003e"
          ],
          [
            1430,
            "\u003cfont face='Verdana' size='1' color=green\u003eOFF\u003c/font\u003e"
          ],
          [
            1548,
            "\u003cfont color=green\u003eNone\u003c/font\u003e"
          ],
          [
            1549,
            "\u003cfont color=green\u003eNone\u003c/font\u003e"
          ],
          [
            1605,
            "\u003cfont color=red\u003e$disfunc\u003c/font\u003e"
          ],
          [
            1606,
            "\u003cfont color=red\u003e"
          ],
          [
            1630,
            "\u003c/font\u003e"
          ],
          [
            1677,
            "dir"
          ],
          [
            1678,
            "dir"
          ],
          [
            1701,
            "dir"
          ],
          [
            1702,
            "dir"
          ],
          [
            1727,
            "dir"
          ],
          [
            1728,
            "dir"
          ],
          [
            1763,
            "chdir"
          ],
          [
            1764,
            "chdir"
          ],
          [
            1773,
            "/"
          ],
          [
            1774,
            "/"
          ],
          [
            1795,
            "\u003chead\u003e \n\u003cstyle\u003e \nbody { font-size: 12px; \n\n           font-family: arial, helvetica; \n\n            scrollbar-width: 5; \n\n       "
          ],
          [
            1796,
            "\u003chead\u003e \n\u003cstyle\u003e \nbody { font-size: 12px; \n\n           font-family: arial, helvetica; \n\n            scrollbar-width: 5; \n\n       "
          ],
          [
            2344,
            "\u003cbody text='#FFFFFF'\u003e \n\u003ctable border='1' width='100%' id='table1' border='1' cellPadding=5 cellSpacing=0 borderColorDark=#666666"
          ],
          [
            2345,
            "\u003cbody text='#FFFFFF'\u003e \n\u003ctable border='1' width='100%' id='table1' border='1' cellPadding=5 cellSpacing=0 borderColorDark=#666666"
          ],
          [
            2520,
            "\u003ctd\u003e\u003cfont color=\"#CC0000\"\u003e\u003cstrong\u003e\u003c/strong\u003e\u003c/font\u003e\u003cfont color=\"#000000\"\u003e\u003c/em\u003e\u003c/font\u003e    \u003c/tr\u003e \n"
          ],
          [
            2521,
            "\u003ctd\u003e\u003cfont color=\"#CC0000\"\u003e\u003cstrong\u003e\u003c/strong\u003e\u003c/font\u003e\u003cfont color=\"#000000\"\u003e\u003c/em\u003e\u003c/font\u003e    \u003c/tr\u003e \n"
          ],
          [
            2642,
            "\u003ccenter\u003e\u003cform method=POST action''\u003e\u003cinput type=submit name=vbulletin value='VB HACK.'\u003e\u003cinput type=submit name=mybulletin value='"
          ],
          [
            2643,
            "\u003ccenter\u003e\u003cform method=POST action''\u003e\u003cinput type=submit name=vbulletin value='VB HACK.'\u003e\u003cinput type=submit name=mybulletin value='"
          ],
          [
            2939,
            "vbulletin"
          ],
          [
            2940,
            "vbulletin"
          ],
          [
            2963,
            "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== VB indexer ==\u003c/font\u003e\u003c/center\u003e \n  "
          ],
          [
            2964,
            "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== VB indexer ==\u003c/font\u003e\u003c/center\u003e \n  "
          ],
          [
            4387,
            "Powered By WebRooT"
          ],
          [
            4388,
            "Powered By WebRooT"
          ],
          [
            4424,
            "dbh"
          ],
          [
            4425,
            "dbh"
          ],
          [
            4447,
            "dbu"
          ],
          [
            4448,
            "dbu"
          ],
          [
            4470,
            "dbn"
          ],
          [
            4471,
            "dbn"
          ],
          [
            4493,
            "dbp"
          ],
          [
            4494,
            "dbp"
          ],
          [
            4518,
            "index"
          ],
          [
            4519,
            "index"
          ],
          [
            4548,
            "\\"
          ],
          [
            4549,
            "\\"
          ],
          [
            4581,
            "{\\${eval(base64_decode(\\"
          ],
          [
            4582,
            "{"
          ],
          [
            4585,
            "{eval(base64_decode(\\"
          ],
          [
            4640,
            "echo \\\"$index\\\";"
          ],
          [
            4641,
            "echo "
          ],
          [
            4656,
            ";"
          ],
          [
            4678,
            "\\'))}}{\\${exit()}}\u003c/textarea\u003e"
          ],
          [
            4679,
            "\\'))}}{"
          ],
          [
            4688,
            "{exit()}}\u003c/textarea\u003e"
          ],
          [
            4895,
            "UPDATE template SET template="
          ],
          [
            4896,
            "UPDATE template SET template="
          ],
          [
            4951,
            " WHERE title='spacer_open"
          ],
          [
            4952,
            " WHERE title='spacer_open"
          ],
          [
            4992,
            "UPDATE template SET template="
          ],
          [
            4993,
            "UPDATE template SET template="
          ],
          [
            5048,
            " WHERE title='FORUMHOME"
          ],
          [
            5049,
            " WHERE title='FORUMHOME"
          ],
          [
            5087,
            "UPDATE style SET css="
          ],
          [
            5088,
            "UPDATE style SET css="
          ],
          [
            5135,
            ", stylevars='', csscolors='', editorstyles="
          ],
          [
            5136,
            ", stylevars='', csscolors='', editorstyles="
          ],
          [
            5356,
            "\u003cscript\u003ealert('Vb Hacked');\u003c/script\u003e"
          ],
          [
            5357,
            "\u003cscript\u003ealert('Vb Hacked');\u003c/script\u003e"
          ],
          [
            5431,
            "mybulletin"
          ],
          [
            5432,
            "mybulletin"
          ],
          [
            5456,
            "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== MyBB indexer ==\u003c/font\u003e\u003c/center\u003e \n"
          ],
          [
            5457,
            "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== MyBB indexer ==\u003c/font\u003e\u003c/center\u003e \n"
          ],
          [
            6907,
            "mybbdbh"
          ],
          [
            6908,
            "mybbdbh"
          ],
          [
            6939,
            "mybbdbu"
          ],
          [
            6940,
            "mybbdbu"
          ],
          [
            6971,
            "mybbdbn"
          ],
          [
            6972,
            "mybbdbn"
          ],
          [
            7003,
            "mybbdbp"
          ],
          [
            7004,
            "mybbdbp"
          ],
          [
            7037,
            "mybbindex"
          ],
          [
            7038,
            "mybbindex"
          ],
          [
            7273,
            "mybb_"
          ],
          [
            7274,
            "mybb_"
          ],
          [
            7292,
            "UPDATE "
          ],
          [
            7293,
            "UPDATE "
          ],
          [
            7310,
            "templates SET template="
          ],
          [
            7311,
            "templates SET template="
          ],
          [
            7349,
            " WHERE title='index"
          ],
          [
            7350,
            " WHERE title='index"
          ],
          [
            7437,
            "\u003cscript\u003ealert('MyBB Hacked');\u003c/script\u003e"
          ],
          [
            7438,
            "\u003cscript\u003ealert('MyBB Hacked');\u003c/script\u003e"
          ],
          [
            7509,
            "phpbb"
          ],
          [
            7510,
            "phpbb"
          ],
          [
            7529,
            "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== PHPBB indexer ==\u003c/font\u003e\u003c/center\u003e "
          ],
          [
            7530,
            "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== PHPBB indexer ==\u003c/font\u003e\u003c/center\u003e "
          ],
          [
            9209,
            "phpbbdbh"
          ],
          [
            9210,
            "phpbbdbh"
          ],
          [
            9243,
            "phpbbdbu"
          ],
          [
            9244,
            "phpbbdbu"
          ],
          [
            9277,
            "phpbbdbn"
          ],
          [
            9278,
            "phpbbdbn"
          ],
          [
            9311,
            "phpbbdbp"
          ],
          [
            9312,
            "phpbbdbp"
          ],
          [
            9345,
            "phpbbkat"
          ],
          [
            9346,
            "phpbbkat"
          ],
          [
            9378,
            "katid"
          ],
          [
            9379,
            "katid"
          ],
          [
            9620,
            "UPDATE phpbb_categories  SET cat_title="
          ],
          [
            9621,
            "UPDATE phpbb_categories  SET cat_title="
          ],
          [
            9674,
            " WHERE cat_id="
          ],
          [
            9675,
            " WHERE cat_id="
          ],
          [
            9774,
            "\u003cscript\u003ealert('PhpBB Hacked');\u003c/script\u003e"
          ],
          [
            9775,
            "\u003cscript\u003ealert('PhpBB Hacked');\u003c/script\u003e"
          ],
          [
            9849,
            "smf"
          ],
          [
            9850,
            "smf"
          ],
          [
            9867,
            "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== SMF Indexer ==\u003c/font\u003e\u003c/center\u003e \n "
          ],
          [
            9868,
            "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== SMF Indexer ==\u003c/font\u003e\u003c/center\u003e \n "
          ],
          [
            11557,
            "smfdbh"
          ],
          [
            11558,
            "smfdbh"
          ],
          [
            11587,
            "smfdbu"
          ],
          [
            11588,
            "smfdbu"
          ],
          [
            11617,
            "smfdbn"
          ],
          [
            11618,
            "smfdbn"
          ],
          [
            11647,
            "smfdbp"
          ],
          [
            11648,
            "smfdbp"
          ],
          [
            11679,
            "smf_index"
          ],
          [
            11680,
            "smf_index"
          ],
          [
            11712,
            "katid"
          ],
          [
            11713,
            "katid"
          ],
          [
            11936,
            "smf_"
          ],
          [
            11937,
            "smf_"
          ],
          [
            11955,
            "UPDATE "
          ],
          [
            11956,
            "UPDATE "
          ],
          [
            11973,
            "categories SET name="
          ],
          [
            11974,
            "categories SET name="
          ],
          [
            12008,
            " WHERE ID_CAT="
          ],
          [
            12009,
            " WHERE ID_CAT="
          ],
          [
            12107,
            "\u003cscript\u003ealert('smf Hacked');\u003c/script\u003e"
          ],
          [
            12108,
            "\u003cscript\u003ealert('smf Hacked');\u003c/script\u003e"
          ],
          [
            12172,
            " \n\n\n\u003cbr\u003e\u003ctable width='100%' height='1' border='1' cellPadding=5 cellSpacing=0 borderColorDark=#666666 id='table1' style='BORDER-"
          ],
          [
            12173,
            " \n\n\n\u003cbr\u003e\u003ctable width='100%' height='1' border='1' cellPadding=5 cellSpacing=0 borderColorDark=#666666 id='table1' style='BORDER-"
          ]
        ],
        "sz": 12644,
        "ts": [
          {
            "c": 0.6000000238418579,
            "d": "Generates HTML tags",
            "e": [
              "\u003cbody"
            ],
            "i": "micro-behaviors/data/format/html::html-generator-tags",
            "l": 3
          },
          {
            "d": "UPDATE SQL keyword",
            "e": [
              "UPDATE template SET"
            ],
            "i": "micro-behaviors/data/db/conn/sql::sql-update",
            "l": 3
          },
          {
            "a": "T1027",
            "c": 0.699999988079071,
            "d": "base64_encode function call for encoding payloads",
            "e": [
              "base64_encode"
            ],
            "i": "objectives/anti-static/obfuscation/encoding/xor::base64-encode-call",
            "l": 4,
            "m": "B0032"
          },
          {
            "c": 0.8199999928474426,
            "d": "Generic weak-login username marker",
            "e": [
              "'user']"
            ],
            "i": "objectives/lateral-movement/brute-force/ssh::weak-login-pair-set--rx-5",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.8999999761581421,
            "d": "Single-file admin shell metrics",
            "e": [
              "index.php"
            ],
            "i": "well-known/malware/webshell/zaco::single-file-webshell-metrics",
            "l": 3,
            "m": "B0030"
          },
          {
            "a": "T1491",
            "c": 0.75,
            "d": "\"hacked\" intimidation phrase",
            "e": [
              "Hacked"
            ],
            "i": "micro-behaviors/data/text/malware/lockscreen::hacked-phrase",
            "l": 2
          },
          {
            "c": 0.75,
            "d": "Hardcoded localhost network host",
            "e": [
              "localhost"
            ],
            "i": "micro-behaviors/communications/ip/literal::localhost-source",
            "l": 2
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "ini_get('safe_mode"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-1",
            "l": 1,
            "m": "B0030"
          },
          {
            "d": "password keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::password",
            "l": 1
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== MyBB indexer ==\u003c/font\u003e\u003c/center\u003e \n",
              "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== VB indexer ==\u003c/font\u003e\u003c/center\u003e \n  ",
              "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== PHPBB indexer ==\u003c/font\u003e\u003c/center\u003e ",
              "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== SMF Indexer ==\u003c/font\u003e\u003c/center\u003e \n "
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-6",
            "l": 1
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "$_SERVER["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.8500000238418579,
            "d": "PHP mysql_connect database handle",
            "e": [
              "mysql_connect"
            ],
            "i": "micro-behaviors/data/db/conn/mysql::php-mysql-connect",
            "l": 3
          },
          {
            "a": "T1059",
            "c": 0.8500000238418579,
            "d": "HTTP GET parameter access ($_GET)",
            "e": [
              "$_GET"
            ],
            "i": "micro-behaviors/communications/http/request/params::get-dup",
            "l": 3
          },
          {
            "c": 0.8399999737739563,
            "d": "password/token/api_key field keyword",
            "e": [
              "password"
            ],
            "i": "micro-behaviors/data/text/keywords/credential::credential-field",
            "l": 1
          },
          {
            "a": "T1505.003",
            "d": "PHP open tag",
            "e": [
              "\u003c?php"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-tag",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.75,
            "d": "Generic $_SERVER superglobal access",
            "e": [
              "$_SERVER"
            ],
            "i": "micro-behaviors/communications/http/request/params::server-dup",
            "l": 3
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 276.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "PHP mysql query execution APIs",
            "e": [
              "mysql_query"
            ],
            "i": "micro-behaviors/data/db/conn/mysql::php-mysql-query",
            "l": 3
          },
          {
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "method="
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-3",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.800000011920929,
            "d": "PHP mysql_select_db database selection",
            "e": [
              "mysql_select_db"
            ],
            "i": "micro-behaviors/data/db/conn/mysql::php-mysql-select-db",
            "l": 3
          },
          {
            "c": 0.8399999737739563,
            "d": "Regex component marker",
            "e": [
              "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== PHPBB indexer ==\u003c/font\u003e\u003c/center\u003e ",
              "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== SMF Indexer ==\u003c/font\u003e\u003c/center\u003e \n ",
              "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== VB indexer ==\u003c/font\u003e\u003c/center\u003e \n  ",
              "\u003ccenter\u003e\u003ctable border=0 width='100%'\u003e \n\u003ctr\u003e\u003ctd\u003e \n\u003ccenter\u003e\u003cfont face='Arial' color='#000000'\u003e== MyBB indexer ==\u003c/font\u003e\u003c/center\u003e \n"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-send-action-cond-4--inline-11750",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.8500000238418579,
            "d": "PHP request superglobal access",
            "e": [
              "$_POST"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/upload::php-request-variadic-function-call",
            "l": 3,
            "m": "B0030"
          },
          {
            "c": 0.20000000298023224,
            "d": "command keyword",
            "e": [
              "command"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::command-dup",
            "l": 1
          },
          {
            "a": "T1059",
            "c": 0.8500000238418579,
            "d": "HTTP POST parameter access ($_POST)",
            "e": [
              "$_POST"
            ],
            "i": "micro-behaviors/communications/http/request/params::post-dup",
            "l": 3
          },
          {
            "a": "T1562.001",
            "c": 0.699999988079071,
            "d": "Reads safe_mode setting",
            "e": [
              "ini_get('safe_mode"
            ],
            "i": "objectives/evasion/security-bypass/runtime::ini-get-safe-mode",
            "l": 4,
            "m": "B0032"
          },
          {
            "c": 0.949999988079071,
            "d": "Disables error reporting (error_reporting(0))",
            "e": [
              "error_reporting(0)"
            ],
            "i": "micro-behaviors/os/stdio::error-reporting-off",
            "l": 3
          },
          {
            "a": "T1562.001",
            "c": 0.699999988079071,
            "d": "Reads disable_functions setting",
            "e": [
              "ini_get('disable_functions"
            ],
            "i": "objectives/evasion/security-bypass/runtime::ini-get-disable-functions",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1027",
            "c": 0.9200000166893005,
            "d": "Regex component marker",
            "e": [
              "HOST"
            ],
            "i": "objectives/anti-static/obfuscation/payload/config::url-component-concat--rx-12",
            "l": 1,
            "m": "B0032"
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Very long embedded string",
            "e": [
              "strings.max_length = 1656.00"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/stager::very-long-string",
            "l": 1
          },
          {
            "a": "T1505.003",
            "c": 0.949999988079071,
            "d": "Regex component marker",
            "e": [
              "eval(base64_decode("
            ],
            "i": "objectives/command-and-control/backdoor/webshell/decoder::eval-decoder-chain--rx-1",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.4000000059604645,
            "d": "PHP $_GET parameter access",
            "e": [
              "$_GET["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-get",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.8600000143051147,
            "d": "Regex component marker",
            "e": [
              "ini_get('disable_functions"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/config::php-security-setting-probe--rx-2",
            "l": 1,
            "m": "B0030"
          },
          {
            "a": "T1505.003",
            "c": 0.4000000059604645,
            "d": "PHP $_POST parameter access",
            "e": [
              "$_POST["
            ],
            "i": "objectives/command-and-control/backdoor/webshell/request::php-post",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.699999988079071,
            "d": "AJAX request handler pattern",
            "e": [
              "$_POST['gomkf']",
              "$_POST['tdir']",
              "$_POST['fcopy']",
              "$_POST['cmd']",
              "$_GET['chdir']",
              "$_POST['symgo']",
              "$_POST['to']",
              "$_POST['wdir']",
              "$_POST['source']",
              "$_POST['tuser']",
              "$_POST['title']",
              "$_GET['fdel']",
              "$_POST['commander']",
              "$_POST['user']",
              "$_POST['sourcego']",
              "$_POST['execute']"
            ],
            "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler",
            "l": 4,
            "m": "B0030"
          },
          {
            "a": "T1082",
            "c": 0.699999988079071,
            "d": "Accesses SERVER_SOFTWARE variable",
            "e": [
              "$_SERVER['SERVER_SOFTWARE']"
            ],
            "i": "objectives/discovery/system/fingerprint/info::server-software-access",
            "l": 3,
            "m": "E1082"
          },
          {
            "a": "T1082",
            "d": "Accesses SERVER_NAME variable",
            "e": [
              "$_SERVER['SERVER_NAME']"
            ],
            "i": "objectives/discovery/system/fingerprint/info::server-name-access",
            "l": 3,
            "m": "E1082"
          },
          {
            "a": "T1110.001",
            "c": 0.8500000238418579,
            "d": "Service account mysql",
            "e": [
              "mysql"
            ],
            "i": "objectives/lateral-movement/brute-force/password::service-account-mysql",
            "l": 1,
            "m": "E1110"
          },
          {
            "c": 0.75,
            "d": "Inline password token in lure",
            "e": [
              "password name=dbp"
            ],
            "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token",
            "l": 1
          },
          {
            "a": "T1562.001",
            "c": 0.800000011920929,
            "d": "Reads multiple PHP security restrictions",
            "e": [
              "ini_get('disable_functions",
              "ini_get('safe_mode"
            ],
            "i": "objectives/evasion/security-bypass/runtime::security-restriction-probe",
            "l": 4,
            "m": "B0032"
          },
          {
            "a": "T1505.003",
            "c": 0.9700000286102295,
            "d": "PHP decoder eval webshell",
            "e": [
              "$_GET",
              "$_POST",
              "eval(base64_decode("
            ],
            "i": "objectives/command-and-control/backdoor/webshell/decoder::php-decoder-eval-webshell",
            "l": 5,
            "m": "B0030"
          },
          {
            "c": 0.8999999761581421,
            "d": "PHP Webshells Github Archive - file lolipop.php",
            "e": [
              "$sourcego = $_POST['sourcego']; ",
              "$commander = $_POST['commander']; ",
              "$result = mysql_query($loli12) or die (mysql_error()); "
            ],
            "i": "third_party/SigBase/Webshell/Php/Webshells/Lolipop",
            "l": 5
          },
          {
            "c": 0.8999999761581421,
            "d": "PHP webshell which directly eval()s obfuscated string",
            "e": [
              "\u003c?",
              "eval(base64_decode(",
              "\u003c?php"
            ],
            "i": "third_party/SigBase/WEBSHELL/PHP/Gzinflated",
            "l": 5
          }
        ],
        "sha": "ed2011a38727ef4ce4d2706ddade51dd14181a2936fedb34a65d38d68c294f48",
        "path": "index.php",
        "type": "php"
      }
    ],
    "tv": "0a4d2"
  }
}