diff options
| author | Toni <matzeton@googlemail.com> | 2024-04-10 15:36:54 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-04-10 15:36:54 +0200 |
| commit | 1d0be6c4f4a87e7c6d29aa35e383f7f2ba62a967 (patch) | |
| tree | 7443f01b978b3b998681c0f34062d20fb485ef07 /tests/cfgs/default/result | |
| parent | 54517d8e04f2ae07f338d09d7fea3db5e26b8fbc (diff) | |
Add Shellscript risk detection. (#2375)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Diffstat (limited to 'tests/cfgs/default/result')
| -rw-r--r-- | tests/cfgs/default/result/shell.pcap.out | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/tests/cfgs/default/result/shell.pcap.out b/tests/cfgs/default/result/shell.pcap.out new file mode 100644 index 000000000..75afae9c5 --- /dev/null +++ b/tests/cfgs/default/result/shell.pcap.out @@ -0,0 +1,35 @@ +DPI Packets (TCP): 16 (8.00 pkts/flow) +DPI Packets (UDP): 2 (1.00 pkts/flow) +Confidence Unknown : 4 (flows) +Num dissector calls: 572 (143.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/12/0 (insert/search/found) +LRU cache zoom: 0/0/0 (insert/search/found) +LRU cache stun: 0/0/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/4/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache stun_zoom: 0/2/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 0/0 (search/found) +Patricia risk mask IPv6: 0/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia risk IPv6: 0/0 (search/found) +Patricia protocols: 8/0 (search/found) +Patricia protocols IPv6: 0/0 (search/found) + +Unknown 18 13422 4 + +Unrated 18 13422 4 + + + +Undetected flows: + 1 TCP 127.0.0.1:54970 <-> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][DPI packets: 8][5 pkts/5526 bytes <-> 3 pkts/206 bytes][Goodput ratio: 94/0][1.26 sec][bytes ratio: 0.928 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 315/0 1259/0 545/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 1105/69 5254/74 2074/4][Risk: ** Possible Exploit Attempt **][Risk Score: 150][Risk Info: Shellscript found][PLAIN TEXT ( /bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100] + 2 UDP 127.0.0.1:58538 -> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/5230 bytes -> 0 pkts/0 bytes][Goodput ratio: 99/0][< 1 sec][Risk: ** Possible Exploit Attempt **** Unidirectional Traffic **][Risk Score: 160][Risk Info: No server to client traffic / Shellscript found][PLAIN TEXT ( /bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100] + 3 TCP 127.0.0.1:47638 <-> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][DPI packets: 8][4 pkts/1209 bytes <-> 4 pkts/272 bytes][Goodput ratio: 77/0][4.14 sec][bytes ratio: 0.633 (Upload)][IAT c2s/s2c min/avg/max/stddev: 4140/0 1380/0 4140/0 1952/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 302/68 1003/74 405/3][Risk: ** Possible Exploit Attempt **][Risk Score: 150][Risk Info: Shellscript found][PLAIN TEXT (/bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 4 UDP 127.0.0.1:54112 -> 127.0.0.1:33333 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][DPI packets: 1][1 pkts/979 bytes -> 0 pkts/0 bytes][Goodput ratio: 96/0][< 1 sec][Risk: ** Possible Exploit Attempt **** Unidirectional Traffic **][Risk Score: 160][Risk Info: No server to client traffic / Shellscript found][PLAIN TEXT (/bin/sh)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] |