有人可以解释一下这个日志数据吗？我想分析一下

Question

AAF_BurpSuit_withlogin

Dec 12 15:16:52 osboxes aaf.alerts: Founddddd patterns,{.conf } in 192.168.56.10/passwords/web.config.bak [1576181812,HTTP,192.168.56.1,44596,172.17.0.2,80 ,]

Dec 12 15:16:52 osboxes aaf.alerts: Founddddd patterns,{/web.config.bak } in 192.168.56.10/passwords/web.config.bak [1576181812,HTTP,192.168.56.1,44596,172.17 .0.2,80,]

Dec 12 15:16:52 osboxes aaf.alerts: Founddddd patterns,{.conf } in 192.168.56.10/passwords/web.config.bak [1576181812,HTTP,192.168.56.1,44596,172.17.0.2,80 ,]

Dec 12 15:16:52 osboxes aaf.alerts: Founddddd patterns,{/web.config.bak } in 192.168.56.10/passwords/web.config.bak [1576181812,HTTP,192.168.56.1,44596,172.17 .0.2,80,]

AAF_burpsuit

[12 月 19 日 17:25:02 osboxes aaf.alerts: WAF/1:SQL 注入警报！！ : 发现模式 yXPt=1916%20AND%201%3D1%20UNION%20ALL%20SELECT%201%2CNULL%2C%27%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%27%2Ctable_name%20FROM %20information_schema.tables%20WHERE%202%3E1--%2F%2A%2A%2F%3B%20EXEC%20xp_cmdshell%28%27cat%20..%2F..%2F..%2Fetc%2Fpasswd%27%29 %23,[1576794302,HTTP,192.168.56.1,60728,192.168.56.10,80,]

[Dec 19 17:25:02 osboxes aaf.alerts: WAF/7/6:XSS/Directory Traversal Alert !! : 发现模式 yXPt=1916%20AND%201%3D1%20UNION%20ALL%20SELECT%201%2CNULL%2C%27%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E%27%2Ctable_name%20FROM %20information_schema.tables%20WHERE%202%3E1--%2F%2A%2A%2F%3B%20EXEC%20xp_cmdshell%28%27cat%20..%2F..%2F..%2Fetc%2Fpasswd%27%29 %23,[1576794302,HTTP,192.168.56.1,60728,192.168.56.10,80,]

AAF_ZAP

12 月 19 日 16:43:19 osboxes aaf.alerts：消息重复 12 次：[ Founddddd patterns,{%2F..%2F..%2F..%2F } in 192.168.56.10/images/?C= ..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F.. %2F..%2F..%2F..%2Fetc%2Fpasswd [1576791799,HTTP,192.168.56.1,57067,192.168.56.10,80,]]

12 月 19 日 16:43:19 osboxes aaf.alerts: Founddddd 模式，{%2F..%2F..%2F..%2F } in 192.168.56.10/images/?C=..%2F.. %2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F ..%2F..%2Fetc%2Fpasswd [1576791799,HTTP,192.168.56.1,57067,172.17.0.2,80,]

Answer 1

BurpSuite（PortSwigger）和 ZAP（Zed Attack Proxy，OWASP）被用作渗透测试工具。日志来自什么？操作系统？你的具体问题是什么？在我看来，使用 BurpSuite 和 ZAP 对那里列出的 IP 进行了目录遍历尝试。 第一个块说它找到了 webconfig 备份文件，第二个块表示 WAF（Web 应用程序防火墙）检测到针对该 passwd 目录的 SQL 注入漏洞（或攻击）（这是典型的目录遍历攻击）

%2F 是斜杠字符“/”的 URL 编码。因此，攻击者会以这种形式格式化他们的有效负载，这样当您的后端服务器摄取代码时，浏览器会将其解释为斜杠。

另外，（只是将来的参考和良好实践提示）请小心复制/粘贴此处的日志，因为有时它们会包含对您的组织的敏感数据，您可能无法识别它，并且可能向世界展示安全漏洞（别担心，因为IP是本地的，所以在这种情况下不是我所看到的） 但是，如果这些日志来自您自己的 WAF 或后端服务器，以上内容应该可以帮助您。