corelight/boa-detectorДетектор уязвимого веб-сервера Boa.
Этот пакет Zeek обнаруживает строку веб-сервера Boa в HTTP-заголовках. Все версии Boa считаются уязвимыми:
Когда наблюдается строка сервера /^Boa\/.*/, этот пакет выдаст
уведомление BoaDetector::Vulnerable_Boa_Web_Server для c$id$resp_h соединения.
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path notice
#open 2022-11-28-16-56-57
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions email_dest suppress_for remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude
#types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] set[string] interval string string string double double
1669216431.624776 CHhAvVGS1DHFjwGM9 127.0.0.1 59213 127.0.0.1 80 - - - tcp BoaDetector::Vulnerable_Boa_Web_Server Vulnerable Boa web server header observed: Boa/0.94.14rc21 See https://www.microsoft.com/en-us/security/blog/2022/11/22/vulnerable-sdk-components-lead-to-supply-chain-risks-in-iot-and-ot-environments/ for more info. 127.0.0.1 127.0.0.1 80 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
1669216442.169350 ClEkJM2Vm5giqnMf4h ::1 60096 ::1 80 - - - tcp BoaDetector::Vulnerable_Boa_Web_Server Vulnerable Boa web server header observed: Boa/0.94.14rc21 See https://www.microsoft.com/en-us/security/blog/2022/11/22/vulnerable-sdk-components-lead-to-supply-chain-risks-in-iot-and-ot-environments/ for more info. ::1 ::1 80 - - Notice::ACTION_LOG (empty) 3600.000000 - - - - -
#close 2022-11-28-16-56-57