Using username "sasha".
Authenticating with public key "rsa-key-20171101"
Welcome to Ubuntu 16.04.3 LTS (GNU/Linux 4.13.0-32-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

263 packages can be updated.
138 updates are security updates.

Last login: Thu Mar 15 10:11:25 2018 from 10.2.64.83
sasha@sasha:~$ ssh -p22013 root@ptaf-kickstart-cl63.rd.ptsecurity.ru
The authenticity of host '[ptaf-kickstart-cl63.rd.ptsecurity.ru]:22013 ([10.0.212.25]:22013)' can't be established.
ECDSA key fingerprint is SHA256:+JLIQU3rjVh++J8W/+JOm8UpaNlT8FdNKJr54tzazQE.
Are you sure you want to continue connecting (yes/no)?
Host key verification failed.
sasha@sasha:~$ ssh -p22013 root@ptaf-kickstart-cl63.rd.ptsecurity.ru
The authenticity of host '[ptaf-kickstart-cl63.rd.ptsecurity.ru]:22013 ([10.0.212.25]:22013)' can't be established.
ECDSA key fingerprint is SHA256:+JLIQU3rjVh++J8W/+JOm8UpaNlT8FdNKJr54tzazQE.
Are you sure you want to continue connecting (yes/no)? y
Please type 'yes' or 'no': yes
Warning: Permanently added '[ptaf-kickstart-cl63.rd.ptsecurity.ru]:22013,[10.0.212.25]:22013' (ECDSA) to the list of known hosts.
root@ptaf-kickstart-cl63.rd.ptsecurity.ru's password:
Linux ptaf-kickstart-cl63.rd.ptsecurity.ru 3.16.0-0.bpo.4-amd64 #1 SMP Debian 3.16.39-1~bpo70+1 (2017-01-12) x86_64
Last login: Fri Mar 16 15:35:33 2018 from 10.0.70.43
root@ptaf-kickstart-cl63:~# cd
root@ptaf-kickstart-cl63:~# cd ..
root@ptaf-kickstart-cl63:/# ls
bin   home            lib32       mnt   root     srv  var
boot  initrd.img      lib64       mnt1  run      sys  vmlinuz
dev   initrd.img.old  lost+found  opt   sbin     tmp  vmlinuz.old
etc   lib             media       proc  selinux  usr
root@ptaf-kickstart-cl63:/# cd var/lo
local/ lock/  log/
root@ptaf-kickstart-cl63:/# cd var/lo
local/ lock/  log/
root@ptaf-kickstart-cl63:/# cd var/log/waf/
root@ptaf-kickstart-cl63:/var/log/waf# ls
access.log             wafd.log              waf-sync.log.2
arbor                  waf-gowaf.log         waf-sync.log.3
backups                wafml-access.log      waf-sync.log.4
deploy                 waf-passive-bots.log  waf-sync.log.5
error.log              waf-sync.log          waf-sync.log.6
forensics              waf-sync.log.1        waf-sync.log.7
reports                waf-sync.log.10       waf-sync.log.8
stats.log              waf-sync.log.11       waf-sync.log.9
taperedng.log          waf-sync.log.12       waf-sync-twistd.log
tproxy-automangle.log  waf-sync.log.13       webapp-access.log
trainer.log            waf-sync.log.14       wsc-config-commit.log
waf-active-bots.log    waf-sync.log.15       wsc-daemon.log
waf-correlator.log     waf-sync.log.16       wsc.log
waf-ddos.log           waf-sync.log.17
wafd-helper.log        waf-sync.log.18
root@ptaf-kickstart-cl63:/var/log/waf# less wafml-access.log
root@ptaf-kickstart-cl63:/var/log/waf# tmux с lua-logger: `tmux a -t lua_logger`END
ST@RT
Tue, 20 Mar 2018 12:02:14 INFO
POST /vulnbank/online/api.php HTTP/1.1
Host: 10.0.212.25
Connection: keep-alive
Content-Length: 227
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://10.0.212.25
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.146 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://10.0.212.25/vulnbank/online/login.php
Accept-Encoding: gzip, deflate
Accept-Language: en,ru-RU;q=0.9,ru;q=0.8,en-US;q=0.7
Cookie: PHPSESSID=9a2kactldm2oj8a96qrldei0f6

type=user&action=create&username=test_username&password=1111111&firstname=test_name&lastname=test_lastname&birthdate=21-03-1990&email=email%40mail.com&phone=91111111&account=DE65407695705966244289&creditcard=4556-1237-3562-7380
END
(END)
[lua_logge 0:python- 1:less*            "ptaf-kickstart-cl63.rd" 12:04 20-Mar-18