
A vulnerable Boa web server detector.
यह Zeek पैकेज HTTP हेडर में Boa वेब सर्वर स्ट्रिंग का पता लगाता है। सभी Boa संस्करणों को कमजोर माना जाता है:
जब /^Boa\/.*/ सर्वर स्ट्रिंग देखी जाती है, यह पैकेज कनेक्शन के c$id$resp_h के लिए एक सूचना BoaDetector::Vulnerable_Boa_Web_Server उठाएगा।
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path notice
#open 2022-11-28-16-56-57
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions email_dest suppress_for remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] set[string] interval string string string double double
1669216431.624776 CHhAvVGS1DHFjwGM9 127.0.0.1 59213 127.0.0.1 80 - - - tcp BoaDetector::Vulnerable_Boa_Web_Server Vulnerable Boa web server header observed: Boa/0.94.14rc21 See https://www.microsoft.com/en-us/security/blog/2022/11/22/vulnerable-sdk-components-lead-to-supply-chain-risks-in-iot-and-ot-environments/ for more info. 127.0.0.1 127.0.0.1 80 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1669216442.169350 ClEkJM2Vm5giqnMf4h ::1 60096 ::1 80 - - - tcp BoaDetector::Vulnerable_Boa_Web_Server Vulnerable Boa web server header observed: Boa/0.94.14rc21 See https://www.microsoft.com/en-us/security/blog/2022/11/22/vulnerable-sdk-components-lead-to-supply-chain-risks-in-iot-and-ot-environments/ for more info. ::1 ::1 80 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
#close 2022-11-28-16-56-57