diff --git a/detections/cloud/kubernetes_nginx_ingress_lfi.yml b/detections/cloud/kubernetes_nginx_ingress_lfi.yml new file mode 100644 index 0000000000..b14e3e6ba6 --- /dev/null +++ b/detections/cloud/kubernetes_nginx_ingress_lfi.yml @@ -0,0 +1,55 @@ +name: Kubernetes Nginx Ingress LFI +id: 0f83244b-425b-4528-83db-7a88c5f66e48 +version: 1 +date: '2021-08-20' +author: Patrick Bareiss, Splunk +type: TTP +datamodel: [] +description: This search uses the Kubernetes logs from a nginx ingress controller + to detect local file inclusion attacks. +search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" + | lookup local_file_inclusion_paths local_file_inclusion_paths AS request OUTPUT + lfi_path | search lfi_path=yes | rename remote_addr AS src_ip, upstream_status as + status, proxy_upstream_name as proxy | rex field=request "^(?\S+)\s(?\S+)\s" + | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, status, + url, http_method, host, http_user_agent, proxy | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_lfi_filter`' +how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. +known_false_positives: unknown +references: +- https://github.com/splunk/splunk-connect-for-kubernetes +- https://www.offensive-security.com/metasploit-unleashed/file-inclusion-vulnerabilities/ +tags: + analytic_story: + - Dev Sec Ops + asset_type: Kubernetes + cis20: + - CIS 13 + confidence: 70 + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Local File Inclusion Attack detected on $host$ + mitre_attack_id: + - T1212 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - raw + risk_score: 49 + security_domain: network + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack.log + diff --git a/detections/cloud/kubernetes_nginx_ingress_rfi.yml b/detections/cloud/kubernetes_nginx_ingress_rfi.yml new file mode 100644 index 0000000000..9255efa4dc --- /dev/null +++ b/detections/cloud/kubernetes_nginx_ingress_rfi.yml @@ -0,0 +1,54 @@ +name: Kubernetes Nginx Ingress RFI +id: fc5531ae-62fd-4de6-9c36-b4afdae8ca95 +version: 1 +date: '2021-08-23' +author: Patrick Bareiss, Splunk +type: TTP +datamodel: [] +description: This search uses the Kubernetes logs from a nginx ingress controller + to detect remote file inclusion attacks. +search: '`kubernetes_container_controller` | rex field=_raw "^(?\S+)\s+-\s+-\s+\[(?[^\]]*)\]\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\"(?[^\"]*)\"\s\"(?[^\"]*)\"\s(?\S*)\s(?\S*)\s\[(?[^\]]*)\]\s\[(?[^\]]*)\]\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)\s(?\S*)" + | rex field=request "^(?\S+)?\s(?\S+)\s" | rex field=url "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" + | search dest_ip=* | rename remote_addr AS src_ip, upstream_status as status, proxy_upstream_name + as proxy | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, + dest_ip status, url, http_method, host, http_user_agent, proxy | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `kubernetes_nginx_ingress_rfi_filter`' +how_to_implement: You must ingest Kubernetes logs through Splunk Connect for Kubernetes. +known_false_positives: unknown +references: +- https://github.com/splunk/splunk-connect-for-kubernetes +- https://www.netsparker.com/blog/web-security/remote-file-inclusion-vulnerability/ +tags: + analytic_story: + - Dev Sec Ops + asset_type: Kubernetes + cis20: + - CIS 13 + confidence: 70 + impact: 70 + kill_chain_phases: + - Actions on Objectives + message: Remote File Inclusion Attack detected on $host$ + mitre_attack_id: + - T1212 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - raw + risk_score: 49 + security_domain: network + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log + diff --git a/lookups/local_file_inclusion_paths.csv b/lookups/local_file_inclusion_paths.csv new file mode 100644 index 0000000000..f0a0de38a5 --- /dev/null +++ b/lookups/local_file_inclusion_paths.csv @@ -0,0 +1,1009 @@ +local_file_inclusion_paths, lfi_path +*/apache2/logs/access.log*, yes +*/apache2/logs/error.log*, yes +*/apache/conf/httpd.conf*, yes +*/apache/logs/access.log*, yes +*/apache/logs/error.log*, yes +*/apache/php/php.ini*, yes +*/apachephpphp.ini*, yes +*/bin/php.ini*, yes +*/boot/grub/grub.cfg*, yes +*/boot/grub/menu.lst*, yes +*/etc/adduser.conf*, yes +*/etc/alias*, yes +*/etc/apache22/conf/httpd.conf*, yes +*/etc/apache22/httpd.conf*, yes +*/etc/apache2/apache2.conf*, yes +*/etc/apache2/apache.conf*, yes +*/etc/apache2/conf/httpd.conf*, yes +*/etc/apache2/default-server.conf*, yes +*/etc/apache2/envvars*, yes +*/etc/apache2/httpd2.conf*, yes +*/etc/apache2/httpd.conf*, yes +*/etc/apache2/mods-available/autoindex.conf*, yes +*/etc/apache2/mods-available/deflate.conf*, yes +*/etc/apache2/mods-available/dir.conf*, yes +*/etc/apache2/mods-available/mem_cache.conf*, yes +*/etc/apache2/mods-available/mime.conf*, yes +*/etc/apache2/mods-available/proxy.conf*, yes +*/etc/apache2/mods-available/setenvif.conf*, yes +*/etc/apache2/mods-available/ssl.conf*, yes +*/etc/apache2/mods-enabled/alias.conf*, yes +*/etc/apache2/mods-enabled/deflate.conf*, yes +*/etc/apache2/mods-enabled/dir.conf*, yes +*/etc/apache2/mods-enabled/mime.conf*, yes +*/etc/apache2/mods-enabled/negotiation.conf*, yes +*/etc/apache2/mods-enabled/php5.conf*, yes +*/etc/apache2/mods-enabled/status.conf*, yes +*/etc/apache2/ports.conf*, yes +*/etc/apache2/sites-available/default*, yes +*/etc/apache2/sites-available/default-ssl*, yes +*/etc/apache2/sites-enabled/000-default*, yes +*/etc/apache2/sites-enabled/default*, yes +*/etc/apache2/ssl-global.conf*, yes +*/etc/apache/access.conf*, yes +*/etc/apache/apache.conf*, yes +*/etc/apache/conf/httpd.conf*, yes +*/etc/apache/default-server.conf*, yes +*/etc/apache/httpd.conf*, yes +*/etc/apt/apt.conf*, yes +*/etc/avahi/avahi-daemon.conf*, yes +*/etc/bash.bashrc*, yes +*/etc/bluetooth/input.conf*, yes +*/etc/bluetooth/main.conf*, yes +*/etc/bluetooth/network.conf*, yes +*/etc/bluetooth/rfcomm.conf*, yes +*/etc/ca-certificates.conf*, yes +*/etc/ca-certificates.conf.dpkg-old*, yes +*/etc/casper.conf*, yes +*/etc/chkrootkit.conf*, yes +*/etc/chrootUsers*, yes +*/etc/clamav/clamd.conf*, yes +*/etc/clamav/freshclam.conf*, yes +*/etc/crontab*, yes +*/etc/crypttab*, yes +*/etc/cups/acroread.conf*, yes +*/etc/cups/cupsd.conf*, yes +*/etc/cups/cupsd.conf.default*, yes +*/etc/cups/pdftops.conf*, yes +*/etc/cups/printers.conf*, yes +*/etc/cvs-cron.conf*, yes +*/etc/cvs-pserver.conf*, yes +*/etc/debconf.conf*, yes +*/etc/debian_version*, yes +*/etc/default/grub*, yes +*/etc/deluser.conf*, yes +*/etc/dhcp3/dhclient.conf*, yes +*/etc/dhcp3/dhcpd.conf*, yes +*/etc/dhcp/dhclient.conf*, yes +*/etc/dns2tcpd.conf*, yes +*/etc/e2fsck.conf*, yes +*/etc/esound/esd.conf*, yes +*/etc/etter.conf*, yes +*/etc/exports*, yes +*/etc/fedora-release*, yes +*/etc/firewall.rules*, yes +*/etc/foremost.conf*, yes +*/etc/fstab*, yes +*/etc/ftpchroot*, yes +*/etc/ftphosts*, yes +*/etc/ftpusers*, yes +*/etc/fuse.conf*, yes +*/etc/group*, yes +*/etc/group-*, yes +*/etc/hdparm.conf*, yes +*/etc/host.conf*, yes +*/etc/hostname*, yes +*/etc/hosts*, yes +*/etc/hosts.allow*, yes +*/etc/hosts.deny*, yes +*/etc/http/conf/httpd.conf*, yes +*/etc/httpd/apache2.conf*, yes +*/etc/httpd/apache.conf*, yes +*/etc/httpd.conf*, yes +*/etc/httpd/conf*, yes +*/etc/httpd/conf/apache2.conf*, yes +*/etc/httpd/conf/apache.conf*, yes +*/etc/httpd/conf.d*, yes +*/etc/httpd/conf/httpd.conf*, yes +*/etc/httpd/extra/httpd-ssl.conf*, yes +*/etc/httpd/httpd.conf*, yes +*/etc/httpd/logs/acces.log*, yes +*/etc/httpd/logs/acces_log*, yes +*/etc/httpd/logs/access.log*, yes +*/etc/httpd/logs/access_log*, yes +*/etc/httpd/logs/error.log*, yes +*/etc/httpd/logs/error_log*, yes +*/etc/httpd/mod_php.conf*, yes +*/etc/httpd/php.ini*, yes +*/etc/http/httpd.conf*, yes +*/etc/inetd.conf*, yes +*/etc/init.d*, yes +*/etc/inittab*, yes +*/etc/ipfw.conf*, yes +*/etc/ipfw.rules*, yes +*/etc/issue*, yes +*/etc/issue.net*, yes +*/etc/kbd/config*, yes +*/etc/kernel-img.conf*, yes +*/etc/kernel-pkg.conf*, yes +*/etc/ldap/ldap.conf*, yes +*/etc/ld.so.conf*, yes +*/etc/lighttpd/lighthttpd.conf*, yes +*/etc/login.defs*, yes +*/etc/logrotate.conf*, yes +*/etc/ltrace.conf*, yes +*/etc/mail/sendmail.conf*, yes +*/etc/mandrake-release*, yes +*/etc/manpath.config*, yes +*/etc/miredo.conf*, yes +*/etc/miredo/miredo.conf*, yes +*/etc/miredo/miredo-server.conf*, yes +*/etc/miredo-server.conf*, yes +*/etc/modules*, yes +*/etc/mono/config*, yes +*/etc/motd*, yes +*/etc/mtab*, yes +*/etc/mtools.conf*, yes +*/etc/muddleftpd.com*, yes +*/etc/muddleftpd/muddleftpd.conf*, yes +*/etc/muddleftpd/muddleftpd.passwd*, yes +*/etc/muddleftpd/mudlog*, yes +*/etc/muddleftpd/mudlogd.conf*, yes +*/etc/muddleftpd/passwd*, yes +*/etc/my.cnf*, yes +*/etc/mysql/my.cnf*, yes +*/etc/networks*, yes +*/etc/nginx/nginx.conf*, yes +*/etc/openldap/ldap.conf*, yes +*/etc/os-release*, yes +*/etc/osxhttpd/osxhttpd.conf*, yes +*/etc/pam.conf*, yes +*/etc/passwd*, yes +*/etc/passwd-*, yes +*/etc/passwd~*, yes +*/etc/password.master*, yes +*/etc/php4/apache2/php.ini*, yes +*/etc/php4/apache/php.ini*, yes +*/etc/php4/cgi/php.ini*, yes +*/etc/php5/apache2/php.ini*, yes +*/etc/php5/apache/php.ini*, yes +*/etc/php5/cgi/php.ini*, yes +*/etc/php/apache2/php.ini*, yes +*/etc/php/apache/php.ini*, yes +*/etc/php/cgi/php.ini*, yes +*/etc/php.ini*, yes +*/etc/phpmyadmin/config.inc.php*, yes +*/etc/php/php4/php.ini*, yes +*/etc/php/php.ini*, yes +*/etc/postgresql/pg_hba.conf*, yes +*/etc/postgresql/postgresql.conf*, yes +*/etc/profile*, yes +*/etc/proftp.conf*, yes +*/etc/proftpd/modules.conf*, yes +*/etc/protpd/proftpd.conf*, yes +*/etc/pulse/client.conf*, yes +*/etc/pure-ftpd.conf*, yes +*/etc/pureftpd.passwd*, yes +*/etc/pureftpd.pdb*, yes +*/etc/pure-ftpd/pure-ftpd.conf*, yes +*/etc/pure-ftpd/pure-ftpd.pdb*, yes +*/etc/pure-ftpd/pureftpd.pdb*, yes +*/etc/rc.conf*, yes +*/etc/redhat-release*, yes +*/etc/resolv.conf*, yes +*/etc/samba/dhcp.conf*, yes +*/etc/samba/netlogon*, yes +*/etc/samba/private/smbpasswd*, yes +*/etc/samba/samba.conf*, yes +*/etc/samba/smb.conf*, yes +*/etc/samba/smb.conf.user*, yes +*/etc/samba/smbpasswd*, yes +*/etc/samba/smbusers*, yes +*/etc/security/access.conf*, yes +*/etc/security/environ*, yes +*/etc/security/failedlogin*, yes +*/etc/security/group*, yes +*/etc/security/group.conf*, yes +*/etc/security/lastlog*, yes +*/etc/security/limits*, yes +*/etc/security/limits.conf*, yes +*/etc/security/namespace.conf*, yes +*/etc/security/opasswd*, yes +*/etc/security/pam_env.conf*, yes +*/etc/security/passwd*, yes +*/etc/security/passwd*, yes +*/etc/security/sepermit.conf*, yes +*/etc/security/time.conf*, yes +*/etc/security/user*, yes +*/etc/sensors3.conf*, yes +*/etc/sensors.conf*, yes +*/etc/shadow*, yes +*/etc/shadow-*, yes +*/etc/shadow~*, yes +*/etc/slackware-release*, yes +*/etc/smb.conf*, yes +*/etc/smbpasswd*, yes +*/etc/smi.conf*, yes +*/etc/squirrelmail/apache.conf*, yes +*/etc/squirrelmail/config/config.php*, yes +*/etc/squirrelmail/config_default.php*, yes +*/etc/squirrelmail/config_local.php*, yes +*/etc/squirrelmail/config.php*, yes +*/etc/squirrelmail/default_pref*, yes +*/etc/squirrelmail/filters_setup.php*, yes +*/etc/squirrelmail/index.php*, yes +*/etc/squirrelmail/sqspell_config.php*, yes +*/etc/ssh/sshd_config*, yes +*/etc/sso/sso_config.ini*, yes +*/etc/stunnel/stunnel.conf*, yes +*/etc/sudoers*, yes +*/etc/SUSE-release*, yes +*/etc/sysconfig/network-scripts/ifcfg-eth0*, yes +*/etc/sysctl.conf*, yes +*/etc/syslog.conf*, yes +*/etc/timezone*, yes +*/etc/tinyproxy/tinyproxy.conf*, yes +*/etc/tor/tor-tsocks.conf*, yes +*/etc/tsocks.conf*, yes +*/etc/updatedb.conf*, yes +*/etc/updatedb.conf.BeforeVMwareToolsInstall*, yes +*/etc/utmp*, yes +*/etc/vhcs2/proftpd/proftpd.conf*, yes +*/etc/vmware-tools/config*, yes +*/etc/vmware-tools/tpvmlp.conf*, yes +*/etc/vmware-tools/vmware-tools-libraries.conf*, yes +*/etc/vsftpd.chroot_list*, yes +*/etc/vsftpd.conf*, yes +*/etc/vsftpd/vsftpd.conf*, yes +*/etc/webmin/miniserv.conf*, yes +*/etc/webmin/miniserv.users*, yes +*/etc/wicd/dhclient.conf.template.default*, yes +*/etc/wicd/manager-settings.conf*, yes +*/etc/wicd/wired-settings.conf*, yes +*/etc/wicd/wireless-settings.conf*, yes +*/etc/wu-ftpd/ftpaccess*, yes +*/etc/wu-ftpd/ftphosts*, yes +*/etc/wu-ftpd/ftpusers*, yes +*/etc/X11/xorg.conf*, yes +*/etc/X11/xorg.conf.BeforeVMwareToolsInstall*, yes +*/etc/X11/xorg.conf.orig*, yes +*/etc/X11/xorg.conf-vesa*, yes +*/etc/X11/xorg.conf-vmware*, yes +*/home2/bin/stable/apache/php.ini*, yes +*/home2binstableapachephp.ini*, yes +*/home/bin/stable/apache/php.ini*, yes +*/homebinstableapachephp.ini*, yes +*/home/postgres/data/pg_hba.conf*, yes +*/home/postgres/data/pg_ident.conf*, yes +*/home/postgres/data/PG_VERSION*, yes +*/home/postgres/data/postgresql.conf*, yes +*/home/user/lighttpd/lighttpd.conf*, yes +*/http/httpd.conf*, yes +*/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/[JBOSS]/server/default/conf/jndi.properties*, yes +*/[JBOSS]/server/default/conf/log4j.xml*, yes +*/[JBOSS]/server/default/conf/login-config.xml*, yes +*/[JBOSS]/server/default/conf/server.log.properties*, yes +*/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/[JBOSS]/server/default/log/boot.log*, yes +*/[JBOSS]/server/default/log/server.log*, yes +*/Library/WebServer/Documents/default.htm*, yes +*/Library/WebServer/Documents/default.html*, yes +*/Library/WebServer/Documents/default.php*, yes +*/Library/WebServer/Documents/.htaccess*, yes +*/Library/WebServer/Documents/index.htm*, yes +*/Library/WebServer/Documents/index.html*, yes +*/Library/WebServer/Documents/index.php*, yes +*/logs/access.log*, yes +*/logs/access_log*, yes +*/logs/error.log*, yes +*/logs/error_log*, yes +*/logs/pure-ftpd.log*, yes +*/logs/security_debug_log*, yes +*/logs/security_log*, yes +*/mysql/bin/my.ini*, yes +*/MySQL/data/{HOST}.err*, yes +*/MySQL/data/mysql-bin.index*, yes +*/MySQL/data/mysql-bin.log*, yes +*/MySQL/data/mysql.err*, yes +*/MySQL/data/mysql.log*, yes +*/MySQL/my.cnf*, yes +*/MySQL/my.ini*, yes +*/NetServer/bin/stable/apache/php.ini*, yes +*/NetServerbinstableapachephp.ini*, yes +*/opt/apache22/conf/httpd.conf*, yes +*/opt/apache2/apache2.conf*, yes +*/opt/apache2/apache.conf*, yes +*/opt/apache2/conf/apache2.conf*, yes +*/opt/apache2/conf/apache.conf*, yes +*/opt/apache2/conf/httpd.conf*, yes +*/opt/apache/apache2.conf*, yes +*/opt/apache/apache.conf*, yes +*/opt/apache/conf/apache2.conf*, yes +*/opt/apache/conf/apache.conf*, yes +*/opt/apache/conf/httpd.conf*, yes +*/opt/httpd/apache2.conf*, yes +*/opt/httpd/apache.conf*, yes +*/opt/httpd/conf/apache2.conf*, yes +*/opt/httpd/conf/apache.conf*, yes +*/opt/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/opt/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/opt/[JBOSS]/server/default/conf/jndi.properties*, yes +*/opt/[JBOSS]/server/default/conf/log4j.xml*, yes +*/opt/[JBOSS]/server/default/conf/login-config.xml*, yes +*/opt/[JBOSS]/server/default/conf/server.log.properties*, yes +*/opt/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/opt/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/opt/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/opt/[JBOSS]/server/default/log/boot.log*, yes +*/opt/[JBOSS]/server/default/log/server.log*, yes +*/opt/lampp/etc/httpd.conf*, yes +*/opt/lampp/logs/access.log*, yes +*/opt/lampp/logs/access_log*, yes +*/opt/lampp/logs/error.log*, yes +*/opt/lampp/logs/error_log*, yes +*/opt/lsws/conf/httpd_conf.xml*, yes +*/opt/lsws/logs/access.log*, yes +*/opt/lsws/logs/error.log*, yes +*/opt/tomcat/logs/catalina.err*, yes +*/opt/tomcat/logs/catalina.out*, yes +*/opt/xampp/etc/php.ini*, yes +*/opt/xampp/logs/access.log*, yes +*/opt/xampp/logs/access_log*, yes +*/opt/xampp/logs/error.log*, yes +*/opt/xampp/logs/error_log*, yes +*/private/etc/httpd/apache2.conf*, yes +*/private/etc/httpd/apache.conf*, yes +*/private/etc/httpd/httpd.conf*, yes +*/private/etc/httpd/httpd.conf.default*, yes +*/private/etc/squirrelmail/config/config.php*, yes +*/private/tmp/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/jndi.properties*, yes +*/private/tmp/[JBOSS]/server/default/conf/log4j.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/login-config.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/server.log.properties*, yes +*/private/tmp/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/private/tmp/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/private/tmp/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/private/tmp/[JBOSS]/server/default/log/boot.log*, yes +*/private/tmp/[JBOSS]/server/default/log/server.log*, yes +*/proc/cpuinfo*, yes +*/proc/devices*, yes +*/proc/meminfo*, yes +*/proc/net/tcp*, yes +*/proc/net/udp*, yes +*/proc/self/cmdline*, yes +*/proc/self/environ*, yes +*/proc/self/mounts*, yes +*/proc/self/stat*, yes +*/proc/self/status*, yes +*/proc/version*, yes +*/Program Files/Apache Group/Apache2/conf/apache2.conf*, yes +*/Program Files/Apache Group/Apache2/conf/apache.conf*, yes +*/Program Files/Apache Group/Apache2/conf/httpd.conf*, yes +*/Program FilesApache GroupApache2confhttpd.conf*, yes +*/Program Files/Apache Group/Apache/apache2.conf*, yes +*/Program Files/Apache Group/Apache/apache.conf*, yes +*/Program Files/Apache Group/Apache/conf/apache2.conf*, yes +*/Program Files/Apache Group/Apache/conf/apache.conf*, yes +*/Program Files/Apache Group/Apache/conf/httpd.conf*, yes +*/Program FilesApache GroupApacheconfhttpd.conf*, yes +*/Program Files/Apache Group/Apache/logs/access.log*, yes +*/Program FilesApache GroupApachelogsaccess.log*, yes +*/Program Files/Apache Group/Apache/logs/error.log*, yes +*/Program FilesApache GroupApachelogserror.log*, yes +*/Program Files/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/jndi.properties*, yes +*/Program Files/[JBOSS]/server/default/conf/log4j.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/login-config.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/server.log.properties*, yes +*/Program Files/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/Program Files/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/Program Files/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/Program Files/[JBOSS]/server/default/log/boot.log*, yes +*/Program Files/[JBOSS]/server/default/log/server.log*, yes +*/Program Files/MySQL/data/{HOST}.err*, yes +*/Program Files/MySQL/data/mysql-bin.index*, yes +*/Program Files/MySQL/data/mysql-bin.log*, yes +*/Program Files/MySQL/data/mysql.err*, yes +*/Program Files/MySQL/data/mysql.log*, yes +*/Program Files/MySQL/my.cnf*, yes +*/Program Files/MySQL/my.ini*, yes +*/Program Files/Vidalia Bundle/Polipo/polipo.conf*, yes +*/Program Files/xampp/apache/conf/apache2.conf*, yes +*/Program Files/xampp/apache/conf/apache.conf*, yes +*/Program Files/xampp/apache/conf/httpd.conf*, yes +*/Program Filesxamppapacheconfhttpd.conf*, yes +*/root/.bash_config*, yes +*/root/.bash_history*, yes +*/root/.bash_logout*, yes +*/root/.bashrc*, yes +*/root/.ksh_history*, yes +*/root/.Xauthority*, yes +*/srv/www/htdos/squirrelmail/config/config.php*, yes +*/tmp/access.log*, yes +*/tmp/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/tmp/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/tmp/[JBOSS]/server/default/conf/jndi.properties*, yes +*/tmp/[JBOSS]/server/default/conf/log4j.xml*, yes +*/tmp/[JBOSS]/server/default/conf/login-config.xml*, yes +*/tmp/[JBOSS]/server/default/conf/server.log.properties*, yes +*/tmp/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/tmp/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/tmp/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/tmp/[JBOSS]/server/default/log/boot.log*, yes +*/tmp/[JBOSS]/server/default/log/server.log*, yes +*/usr/apache2/conf/httpd.conf*, yes +*/usr/apache/conf/httpd.conf*, yes +*/usr/etc/pure-ftpd.conf*, yes +*/usr/home/user/lighttpd/lighttpd.conf*, yes +*/usr/home/user/var/log/apache.log*, yes +*/usr/home/user/var/log/lighttpd.error.log*, yes +*/usr/internet/pgsql/data/pg_hba.conf*, yes +*/usr/internet/pgsql/data/postmaster.log*, yes +*/usr/lib/cron/log*, yes +*/usr/lib/php.ini*, yes +*/usr/lib/php/php.ini*, yes +*/usr/lib/security/mkuser.default*, yes +*/usr/local/apache22/conf/httpd.conf*, yes +*/usr/local/apache22/httpd.conf*, yes +*/usr/local/apache2/apache2.conf*, yes +*/usr/local/apache2/apache.conf*, yes +*/usr/local/apache2/conf/apache2.conf*, yes +*/usr/local/apache2/conf/apache.conf*, yes +*/usr/local/apache2/conf/extra/httpd-ssl.conf*, yes +*/usr/local/apache2/conf/httpd.conf*, yes +*/usr/local/apache2/conf/modsec.conf*, yes +*/usr/local/apache2/conf/ssl.conf*, yes +*/usr/local/apache2/conf/vhosts.conf*, yes +*/usr/local/apache2/conf/vhosts-custom.conf*, yes +*/usr/local/apache2/httpd.conf*, yes +*/usr/local/apache2/logs/access.log*, yes +*/usr/local/apache2/logs/access_log*, yes +*/usr/local/apache2/logs/audit_log*, yes +*/usr/local/apache2/logs/error.log*, yes +*/usr/local/apache2/logs/error_log*, yes +*/usr/local/apache2/logs/lighttpd.error.log*, yes +*/usr/local/apache2/logs/lighttpd.log*, yes +*/usr/local/apache/apache2.conf*, yes +*/usr/local/apache/apache.conf*, yes +*/usr/local/apache/conf/access.conf*, yes +*/usr/local/apache/conf/apache2.conf*, yes +*/usr/local/apache/conf/apache.conf*, yes +*/usr/local/apache/conf/httpd.conf*, yes +*/usr/local/apache/conf/httpd.conf.default*, yes +*/usr/local/apache/conf/modsec.conf*, yes +*/usr/local/apache/conf/php.ini*, yes +*/usr/local/apache/conf/vhosts.conf*, yes +*/usr/local/apache/conf/vhosts-custom.conf*, yes +*/usr/local/apache/httpd.conf*, yes +*/usr/local/apache/logs/access.log*, yes +*/usr/local/apache/logs/access_log*, yes +*/usr/local/apache/logs/audit_log*, yes +*/usr/local/apache/logs/error.log*, yes +*/usr/local/apache/logs/error_log*, yes +*/usr/local/apache/logs/lighttpd.error.log*, yes +*/usr/local/apache/logs/lighttpd.log*, yes +*/usr/local/apache/logs/mod_jk.log*, yes +*/usr/local/apps/apache22/conf/httpd.conf*, yes +*/usr/local/apps/apache2/conf/httpd.conf*, yes +*/usr/local/apps/apache/conf/httpd.conf*, yes +*/usr/local/cpanel/logs*, yes +*/usr/local/cpanel/logs/access_log*, yes +*/usr/local/cpanel/logs/error_log*, yes +*/usr/local/cpanel/logs/license_log*, yes +*/usr/local/cpanel/logs/login_log*, yes +*/usr/local/cpanel/logs/stats_log*, yes +*/usr/local/etc/apache22/conf/httpd.conf*, yes +*/usr/local/etc/apache22/httpd.conf*, yes +*/usr/local/etc/apache2/conf/httpd.conf*, yes +*/usr/local/etc/apache2/httpd.conf*, yes +*/usr/local/etc/apache2/vhosts.conf*, yes +*/usr/local/etc/apache/conf/httpd.conf*, yes +*/usr/local/etc/apache/httpd.conf*, yes +*/usr/local/etc/apache/vhosts.conf*, yes +*/usr/local/etc/httpd/conf*, yes +*/usr/local/etc/httpd/conf/httpd.conf*, yes +*/usr/local/etc/lighttpd.conf*, yes +*/usr/local/etc/lighttpd.conf.new*, yes +*/usr/local/etc/nginx/nginx.conf*, yes +*/usr/local/etc/php.ini*, yes +*/usr/local/etc/pure-ftpd.conf*, yes +*/usr/local/etc/pureftpd.pdb*, yes +*/usr/local/etc/smb.conf*, yes +*/usr/local/etc/webmin/miniserv.conf*, yes +*/usr/local/etc/webmin/miniserv.users*, yes +*/usr/local/httpd/conf/httpd.conf*, yes +*/usr/local/jakarta/dist/tomcat/conf/context.xml*, yes +*/usr/local/jakarta/dist/tomcat/conf/jakarta.conf*, yes +*/usr/local/jakarta/dist/tomcat/conf/logging.properties*, yes +*/usr/local/jakarta/dist/tomcat/conf/server.xml*, yes +*/usr/local/jakarta/dist/tomcat/conf/workers.properties*, yes +*/usr/local/jakarta/dist/tomcat/logs/mod_jk.log*, yes +*/usr/local/jakarta/tomcat/conf/context.xml*, yes +*/usr/local/jakarta/tomcat/conf/jakarta.conf*, yes +*/usr/local/jakarta/tomcat/conf/logging.properties*, yes +*/usr/local/jakarta/tomcat/conf/server.xml*, yes +*/usr/local/jakarta/tomcat/conf/workers.properties*, yes +*/usr/local/jakarta/tomcat/logs/catalina.err*, yes +*/usr/local/jakarta/tomcat/logs/catalina.out*, yes +*/usr/local/jakarta/tomcat/logs/mod_jk.log*, yes +*/usr/local/[JBOSS]/server/default/conf/jboss-minimal.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/jboss-service.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/jndi.properties*, yes +*/usr/local/[JBOSS]/server/default/conf/log4j.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/login-config.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/server.log.properties*, yes +*/usr/local/[JBOSS]/server/default/conf/standardjaws.xml*, yes +*/usr/local/[JBOSS]/server/default/conf/standardjboss.xml*, yes +*/usr/local/[JBOSS]/server/default/deploy/jboss-logging.xml*, yes +*/usr/local/[JBOSS]/server/default/log/boot.log*, yes +*/usr/local/[JBOSS]/server/default/log/server.log*, yes +*/usr/local/lib/php.ini*, yes +*/usr/local/lighttpd/conf/lighttpd.conf*, yes +*/usr/local/lighttpd/log/access.log*, yes +*/usr/local/lighttpd/log/lighttpd.error.log*, yes +*/usr/local/logs/access.log*, yes +*/usr/local/logs/samba.log*, yes +*/usr/local/lsws/conf/httpd_conf.xml*, yes +*/usr/local/lsws/logs/error.log*, yes +*/usr/local/mysql/data/{HOST}.err*, yes +*/usr/local/mysql/data/mysql-bin.index*, yes +*/usr/local/mysql/data/mysql-bin.log*, yes +*/usr/local/mysql/data/mysqlderror.log*, yes +*/usr/local/mysql/data/mysql.err*, yes +*/usr/local/mysql/data/mysql.log*, yes +*/usr/local/mysql/data/mysql-slow.log*, yes +*/usr/local/nginx/conf/nginx.conf*, yes +*/usr/local/pgsql/bin/pg_passwd*, yes +*/usr/local/pgsql/data/passwd*, yes +*/usr/local/pgsql/data/pg_hba.conf*, yes +*/usr/local/pgsql/data/pg_log*, yes +*/usr/local/pgsql/data/postgresql.conf*, yes +*/usr/local/pgsql/data/postgresql.log*, yes +*/usr/local/php4/apache2.conf*, yes +*/usr/local/php4/apache2.conf.php*, yes +*/usr/local/php4/apache.conf*, yes +*/usr/local/php4/apache.conf.php*, yes +*/usr/local/php4/httpd.conf*, yes +*/usr/local/php4/httpd.conf.php*, yes +*/usr/local/php4/lib/php.ini*, yes +*/usr/local/php5/apache2.conf*, yes +*/usr/local/php5/apache2.conf.php*, yes +*/usr/local/php5/apache.conf*, yes +*/usr/local/php5/apache.conf.php*, yes +*/usr/local/php5/httpd.conf*, yes +*/usr/local/php5/httpd.conf.php*, yes +*/usr/local/php5/lib/php.ini*, yes +*/usr/local/php/apache2.conf*, yes +*/usr/local/php/apache2.conf.php*, yes +*/usr/local/php/apache.conf*, yes +*/usr/local/php/apache.conf.php*, yes +*/usr/local/php/httpd.conf*, yes +*/usr/local/php/httpd.conf.php*, yes +*/usr/local/php/lib/php.ini*, yes +*/usr/local/psa/admin/conf/php.ini*, yes +*/usr/local/psa/admin/conf/site_isolation_settings.ini*, yes +*/usr/local/psa/admin/htdocs/domains/databases/phpMyAdmin/libraries/config.default.php*, yes +*/usr/local/psa/admin/logs/httpsd_access_log*, yes +*/usr/local/psa/admin/logs/panel.log*, yes +*/usr/local/pureftpd/etc/pure-ftpd.conf*, yes +*/usr/local/pureftpd/etc/pureftpd.pdb*, yes +*/usr/local/pureftpd/sbin/pure-config.pl*, yes +*/usr/local/samba/lib/log.user*, yes +*/usr/local/samba/lib/smb.conf.user*, yes +*/usr/local/sb/config*, yes +*/usr/local/Zend/etc/php.ini*, yes +*/usr/local/zeus/web/global.cfg*, yes +*/usr/local/zeus/web/log/errors*, yes +*/usr/pkg/etc/httpd/httpd.conf*, yes +*/usr/pkg/etc/httpd/httpd-default.conf*, yes +*/usr/pkg/etc/httpd/httpd-vhosts.conf*, yes +*/usr/pkgsrc/net/pureftpd/*, yes +*/usr/pkgsrc/net/pureftpd/pure-ftpd.conf*, yes +*/usr/pkgsrc/net/pureftpd/pureftpd.passwd*, yes +*/usr/pkgsrc/net/pureftpd/pureftpd.pdb*, yes +*/usr/ports/contrib/pure-ftpd/*, yes +*/usr/ports/contrib/pure-ftpd/pure-ftpd.conf*, yes +*/usr/ports/contrib/pure-ftpd/pureftpd.passwd*, yes +*/usr/ports/contrib/pure-ftpd/pureftpd.pdb*, yes +*/usr/ports/ftp/pure-ftpd/*, yes +*/usr/ports/ftp/pure-ftpd/pure-ftpd.conf*, yes +*/usr/ports/ftp/pure-ftpd/pureftpd.passwd*, yes +*/usr/ports/ftp/pure-ftpd/pureftpd.pdb*, yes +*/usr/ports/net/pure-ftpd/*, yes +*/usr/ports/net/pure-ftpd/pure-ftpd.conf*, yes +*/usr/ports/net/pure-ftpd/pureftpd.passwd*, yes +*/usr/ports/net/pure-ftpd/pureftpd.pdb*, yes +*/usr/sbin/mudlogd*, yes +*/usr/sbin/mudpasswd*, yes +*/usr/sbin/pure-config.pl*, yes +*/usr/share/adduser/adduser.conf*, yes +*/usr/share/logs/catalina.err*, yes +*/usr/share/logs/catalina.out*, yes +*/usr/share/squirrelmail/config/config.php*, yes +*/usr/share/squirrelmail/plugins/squirrel_logger/setup.php*, yes +*/usr/share/tomcat6/conf/context.xml*, yes +*/usr/share/tomcat6/conf/logging.properties*, yes +*/usr/share/tomcat6/conf/server.xml*, yes +*/usr/share/tomcat6/conf/workers.properties*, yes +*/usr/share/tomcat6/logs/catalina.err*, yes +*/usr/share/tomcat6/logs/catalina.out*, yes +*/usr/share/tomcat/logs/catalina.err*, yes +*/usr/share/tomcat/logs/catalina.out*, yes +*/usr/spool/lp/log*, yes +*/usr/spool/mqueue/syslog*, yes +*/var/adm/acct/sum/loginlog*, yes +*/var/adm/aculog*, yes +*/var/adm/aculogs*, yes +*/var/adm/crash/unix*, yes +*/var/adm/crash/vmcore*, yes +*/var/adm/cron/log*, yes +*/var/adm/dtmp*, yes +*/var/adm/lastlog/username*, yes +*/var/adm/log/asppp.log*, yes +*/var/adm/loginlog*, yes +*/var/adm/log/xferlog*, yes +*/var/adm/lp/lpd-errs*, yes +*/var/adm/messages*, yes +*/var/adm/pacct*, yes +*/var/adm/qacct*, yes +*/var/adm/ras/bootlog*, yes +*/var/adm/ras/errlog*, yes +*/var/adm/sulog*, yes +*/var/adm/SYSLOG*, yes +*/var/adm/utmp*, yes +*/var/adm/utmpx*, yes +*/var/adm/vold.log*, yes +*/var/adm/wtmp*, yes +*/var/adm/wtmpx*, yes +*/var/adm/X0msgs*, yes +*/var/apache/conf/httpd.conf*, yes +*/var/cpanel/cpanel.config*, yes +*/var/cpanel/tomcat.options*, yes +*/var/cron/log*, yes +*/var/data/mysql-bin.index*, yes +*/var/lib/mysql/my.cnf*, yes +*/var/lib/pgsql/data/postgresql.conf*, yes +*/var/lib/squirrelmail/prefs/squirrelmail.log*, yes +*/var/lighttpd.log*, yes +*/var/local/www/conf/php.ini*, yes +*/var/log/access.log*, yes +*/var/log/access_log*, yes +*/var/log/apache2/access.log*, yes +*/var/log/apache2/access_log*, yes +*/var/log/apache2/error.log*, yes +*/var/log/apache2/error_log*, yes +*/var/log/apache2/squirrelmail.err.log*, yes +*/var/log/apache2/squirrelmail.log*, yes +*/var/log/apache/access.log*, yes +*/var/log/apache/access_log*, yes +*/var/log/apache/error.log*, yes +*/var/log/apache/error_log*, yes +*/var/log/auth.log*, yes +*/var/log/authlog*, yes +*/var/log/boot.log*, yes +*/var/log/cron/var/log/postgres.log*, yes +*/var/log/daemon.log*, yes +*/var/log/daemon.log.1*, yes +*/var/log/data/mysql-bin.index*, yes +*/var/log/dmessage*, yes +*/var/log/error.log*, yes +*/var/log/error_log*, yes +*/var/log/exim/mainlog*, yes +*/var/log/exim_mainlog*, yes +*/var/log/exim/paniclog*, yes +*/var/log/exim_paniclog*, yes +*/var/log/exim/rejectlog*, yes +*/var/log/exim_rejectlog*, yes +*/var/log/ftplog*, yes +*/var/log/ftp-proxy*, yes +*/var/log/ftp-proxy/ftp-proxy.log*, yes +*/var/log/httpd-access.log*, yes +*/var/log/httpd/access.log*, yes +*/var/log/httpd/access_log*, yes +*/var/log/httpd/error.log*, yes +*/var/log/httpd/error_log*, yes +*/var/log/ipfw*, yes +*/var/log/ipfw/ipfw.log*, yes +*/var/log/ipfw.log*, yes +*/var/log/ipfw.today*, yes +*/var/log/kern.log*, yes +*/var/log/kern.log.1*, yes +*/var/log/lighttpd/*, yes +*/var/log/lighttpd.access.log*, yes +*/var/log/lighttpd/access.log*, yes +*/var/log/lighttpd/access.www.log*, yes +*/var/log/lighttpd/{DOMAIN}/access.log*, yes +*/var/log/lighttpd/{DOMAIN}/error.log*, yes +*/var/log/lighttpd.error.log*, yes +*/var/log/lighttpd/error.log*, yes +*/var/log/lighttpd/error.www.log*, yes +*/var/log/log.smb*, yes +*/var/log/mail.err*, yes +*/var/log/mail.info*, yes +*/var/log/mail.log*, yes +*/var/log/maillog*, yes +*/var/log/mail.warn*, yes +*/var/log/messages*, yes +*/var/log/messages.1*, yes +*/var/log/muddleftpd*, yes +*/var/log/muddleftpd.conf*, yes +*/var/log/mysql-bin.index*, yes +*/var/log/mysql/data/mysql-bin.index*, yes +*/var/log/mysqlderror.log*, yes +*/var/log/mysql.err*, yes +*/var/log/mysql.log*, yes +*/var/log/mysql/mysql-bin.index*, yes +*/var/log/mysql/mysql-bin.log*, yes +*/var/log/mysql/mysql.log*, yes +*/var/log/mysql/mysql-slow.log*, yes +*/var/log/news.all*, yes +*/var/log/news/news.all*, yes +*/var/log/news/news.crit*, yes +*/var/log/news/news.err*, yes +*/var/log/news/news.notice*, yes +*/var/log/news/suck.err*, yes +*/var/log/news/suck.notice*, yes +*/var/log/nginx.access_log*, yes +*/var/log/nginx/access.log*, yes +*/var/log/nginx/access_log*, yes +*/var/log/nginx.error_log*, yes +*/var/log/nginx/error.log*, yes +*/var/log/nginx/error_log*, yes +*/var/log/pgsql8.log*, yes +*/var/log/pgsql_log*, yes +*/var/log/pgsql/pgsql.log*, yes +*/var/log/pm-powersave.log*, yes +*/var/log/POPlog*, yes +*/var/log/postgres/pg_backup.log*, yes +*/var/log/postgres/postgres.log*, yes +*/var/log/postgresql.log*, yes +*/var/log/postgresql/main.log*, yes +*/var/log/postgresql/postgres.log*, yes +*/var/log/postgresql/postgresql-8.1-main.log*, yes +*/var/log/postgresql/postgresql-8.3-main.log*, yes +*/var/log/postgresql/postgresql-8.4-main.log*, yes +*/var/log/postgresql/postgresql-9.0-main.log*, yes +*/var/log/postgresql/postgresql-9.1-main.log*, yes +*/var/log/postgresql/postgresql.log*, yes +*/var/log/proftpd*, yes +*/var/log/proftpd.access_log*, yes +*/var/log/proftpd.xferlog*, yes +*/var/log/proftpd/xferlog.legacy*, yes +*/var/log/pureftpd.log*, yes +*/var/log/pure-ftpd/pure-ftpd.log*, yes +*/var/logs/access.log*, yes +*/var/log/samba.log*, yes +*/var/log/samba.log1*, yes +*/var/log/samba.log2*, yes +*/var/log/samba/log.nmbd*, yes +*/var/log/samba/log.smbd*, yes +*/var/log/squirrelmail.log*, yes +*/var/log/sso/sso.log*, yes +*/var/log/sw-cp-server/error_log*, yes +*/var/log/syslog*, yes +*/var/log/syslog.1*, yes +*/var/log/tomcat6/catalina.out*, yes +*/var/log/ufw.log*, yes +*/var/log/user.log*, yes +*/var/log/user.log.1*, yes +*/var/log/vmware/hostd-1.log*, yes +*/var/log/vmware/hostd.log*, yes +*/var/log/vsftpd.log*, yes +*/var/log/webmin/miniserv.log*, yes +*/var/log/xferlog*, yes +*/var/log/Xorg.0.log*, yes +*/var/lp/logs/lpNet*, yes +*/var/lp/logs/lpsched*, yes +*/var/lp/logs/requests*, yes +*/var/mail/root*, yes +*/var/mysql-bin.index*, yes +*/var/mysql.log*, yes +*/var/nm2/postgresql.conf*, yes +*/var/postgresql/db/postgresql.conf*, yes +*/var/postgresql/log/postgresql.log*, yes +*/var/saf/_log*, yes +*/var/saf/port/log*, yes +*/var/spool/cron/crontabs/root*, yes +*/var/spool/cron/crontabs/root*, yes +*/var/www/conf*, yes +*/var/www/conf/httpd.conf*, yes +*/var/www/html/squirrelmail/config/config.php*, yes +*/var/www/.lighttpdpassword*, yes +*/var/www/logs/access.log*, yes +*/var/www/logs/access_log*, yes +*/var/www/logs/error.log*, yes +*/var/www/logs/error_log*, yes +*/var/www/squirrelmail/config/config.php*, yes +*/Volumes/Macintosh_HD1/opt/apache2/conf/httpd.conf*, yes +*/Volumes/Macintosh_HD1/opt/apache/conf/httpd.conf*, yes +*/Volumes/Macintosh_HD1/opt/httpd/conf/httpd.conf*, yes +*/Volumes/Macintosh_HD1/usr/local/php4/httpd.conf.php*, yes +*/Volumes/Macintosh_HD1/usr/local/php5/httpd.conf.php*, yes +*/Volumes/Macintosh_HD1/usr/local/php/httpd.conf.php*, yes +*/Volumes/Macintosh_HD1/usr/local/php/lib/php.ini*, yes +*/Volumes/webBackup/opt/apache2/conf/httpd.conf*, yes +*/Volumes/webBackup/private/etc/httpd/httpd.conf*, yes +*/Volumes/webBackup/private/etc/httpd/httpd.conf.default*, yes +*/wamp/bin/apache/apache2.2.21/conf/httpd.conf*, yes +*/wamp/bin/apache/apache2.2.21/logs/access.log*, yes +*/wamp/bin/apache/apache2.2.21/logs/error.log*, yes +*/wamp/bin/apache/apache2.2.21/wampserver.conf*, yes +*/wamp/bin/apache/apache2.2.22/conf/httpd.conf*, yes +*/wamp/bin/apache/apache2.2.22/conf/wampserver.conf*, yes +*/wamp/bin/apache/apache2.2.22/logs/access.log*, yes +*/wamp/bin/apache/apache2.2.22/logs/error.log*, yes +*/wamp/bin/apache/apache2.2.22/wampserver.conf*, yes +*/wamp/bin/mysql/mysql5.5.16/data/mysql-bin.index*, yes +*/wamp/bin/mysql/mysql5.5.16/my.ini*, yes +*/wamp/bin/mysql/mysql5.5.16/wampserver.conf*, yes +*/wamp/bin/mysql/mysql5.5.24/data/mysql-bin.index*, yes +*/wamp/bin/mysql/mysql5.5.24/my.ini*, yes +*/wamp/bin/mysql/mysql5.5.24/wampserver.conf*, yes +*/wamp/logs/access.log*, yes +*/wamp/logs/apache_error.log*, yes +*/wamp/logs/genquery.log*, yes +*/wamp/logs/mysql.log*, yes +*/wamp/logs/slowquery.log*, yes +*/web/conf/php.ini*, yes +*/WINDOWS/php.ini*, yes +*/WINDOWSphp.ini*, yes +*/WINDOWS/system32/logfiles/MSFTPSVC*, yes +*/WINDOWS/system32/logfiles/MSFTPSVC1*, yes +*/WINDOWS/system32/logfiles/MSFTPSVC2*, yes +*/WINDOWS/system32/logfiles/SMTPSVC*, yes +*/WINDOWS/system32/logfiles/SMTPSVC1*, yes +*/WINDOWS/system32/logfiles/SMTPSVC2*, yes +*/WINDOWS/system32/logfiles/SMTPSVC3*, yes +*/WINDOWS/system32/logfiles/SMTPSVC4*, yes +*/WINDOWS/system32/logfiles/SMTPSVC5*, yes +*/WINDOWS/system32/logfiles/W3SVC1/inetsvn1.log*, yes +*/WINDOWS/system32/logfiles/W3SVC2/inetsvn1.log*, yes +*/WINDOWS/system32/logfiles/W3SVC3/inetsvn1.log*, yes +*/WINDOWS/system32/logfiles/W3SVC/inetsvn1.log*, yes +*/WINNT/php.ini*, yes +*/WINNTphp.ini*, yes +*/WINNT/system32/logfiles/MSFTPSVC*, yes +*/WINNT/system32/logfiles/MSFTPSVC1*, yes +*/WINNT/system32/logfiles/MSFTPSVC2*, yes +*/WINNT/system32/logfiles/SMTPSVC*, yes +*/WINNT/system32/logfiles/SMTPSVC1*, yes +*/WINNT/system32/logfiles/SMTPSVC2*, yes +*/WINNT/system32/logfiles/SMTPSVC3*, yes +*/WINNT/system32/logfiles/SMTPSVC4*, yes +*/WINNT/system32/logfiles/SMTPSVC5*, yes +*/WINNT/system32/logfiles/W3SVC1/inetsvn1.log*, yes +*/WINNT/system32/logfiles/W3SVC2/inetsvn1.log*, yes +*/WINNT/system32/logfiles/W3SVC3/inetsvn1.log*, yes +*/WINNT/system32/logfiles/W3SVC/inetsvn1.log*, yes +*/www/apache/conf/httpd.conf*, yes +*/www/conf/httpd.conf*, yes +*/www/logs/freebsddiary-access_log*, yes +*/www/logs/freebsddiary-error.log*, yes +*/www/logs/proftpd.system.log*, yes +*/xampp/apache/bin/php.ini*, yes +*/xamppapachebinphp.ini*, yes +*/xampp/apache/conf/httpd.conf*, yes +*/xampp/apache/logs/access.log*, yes +*/xampp/apache/logs/error.log*, yes +*/xampp/FileZillaFTP/FileZilla Server.xml*, yes +*/xampp/htdocs/aca.txt*, yes +*/xampp/htdocs/admin.php*, yes +*/xampp/htdocs/leer.txt*, yes +*/xampp/MercuryMail/mercury.ini*, yes +*/xampp/mysql/data/{HOST}.err*, yes +*/xampp/mysql/data/mysql-bin.index*, yes +*/xampp/mysql/data/mysql.err*, yes +*/xampp/phpMyAdmin/config.inc.php*, yes +*/xampp/php/php.ini*, yes +*/xampp/sendmail/sendmail.ini*, yes +*/xampp/sendmail/sendmail.log*, yes +*/xampp/webalizer/webalizer.conf*, yes +*/proc/self/fd/0*, yes +*/proc/self/fd/1*, yes +*/proc/self/fd/2*, yes +*/proc/self/fd/3*, yes +*/proc/self/fd/4*, yes +*/proc/self/fd/5*, yes +*/proc/self/fd/6*, yes +*/proc/self/fd/7*, yes +*/proc/self/fd/8*, yes +*/proc/self/fd/9*, yes +*/proc/self/fd/10*, yes +*/proc/self/fd/11*, yes +*/proc/self/fd/12*, yes +*/proc/self/fd/13*, yes +*/proc/self/fd/14*, yes +*/proc/self/fd/15*, yes +*/proc/self/fd/16*, yes +*/proc/self/fd/17*, yes +*/proc/self/fd/18*, yes +*/proc/self/fd/19*, yes +*/proc/self/fd/20*, yes +*/proc/self/fd/21*, yes +*/proc/self/fd/22*, yes +*/proc/self/fd/23*, yes +*/proc/self/fd/24*, yes +*/proc/self/fd/25*, yes +*/proc/self/fd/26*, yes +*/proc/self/fd/27*, yes +*/proc/self/fd/28*, yes +*/proc/self/fd/29*, yes +*/proc/self/fd/30*, yes +*/proc/self/fd/31*, yes +*/proc/self/fd/32*, yes +*/proc/self/fd/33*, yes +*/proc/self/fd/34*, yes +*/proc/self/fd/35*, yes +*/proc/self/fd/36*, yes +*/proc/self/fd/37*, yes +*/proc/self/fd/38*, yes +*/proc/self/fd/39*, yes +*/proc/self/fd/40*, yes +*/proc/self/fd/41*, yes +*/proc/self/fd/42*, yes +*/proc/self/fd/43*, yes +*/proc/self/fd/44*, yes +*/proc/self/fd/45*, yes +*/proc/self/fd/46*, yes +*/proc/self/fd/47*, yes +*/proc/self/fd/48*, yes +*/proc/self/fd/49*, yes +*/proc/self/fd/50*, yes +*/proc/self/fd/51*, yes +*/proc/self/fd/52*, yes +*/proc/self/fd/53*, yes +*/proc/self/fd/54*, yes +*/proc/self/fd/55*, yes +*/proc/self/fd/56*, yes +*/proc/self/fd/57*, yes +*/proc/self/fd/58*, yes +*/proc/self/fd/59*, yes +*/proc/self/fd/60*, yes +*/proc/self/fd/61*, yes +*/proc/self/fd/62*, yes +*/proc/self/fd/63*, yes +*/proc/self/fd/64*, yes +*/proc/self/fd/65*, yes +*/proc/self/fd/66*, yes +*/proc/self/fd/67*, yes +*/proc/self/fd/68*, yes +*/proc/self/fd/69*, yes +*/proc/self/fd/70*, yes +*/proc/self/fd/71*, yes +*/proc/self/fd/72*, yes +*/proc/self/fd/73*, yes +*/proc/self/fd/74*, yes +*/proc/self/fd/75*, yes +*/proc/self/fd/76*, yes +*/proc/self/fd/77*, yes +*/proc/self/fd/78*, yes +*/proc/self/fd/79*, yes +*/proc/self/fd/80*, yes +*/proc/self/fd/81*, yes +*/proc/self/fd/82*, yes +*/proc/self/fd/83*, yes +*/proc/self/fd/84*, yes +*/proc/self/fd/85*, yes +*/proc/self/fd/86*, yes +*/proc/self/fd/87*, yes +*/proc/self/fd/88*, yes +*/proc/self/fd/89*, yes +*/proc/self/fd/90*, yes +*/proc/self/fd/91*, yes +*/proc/self/fd/92*, yes +*/proc/self/fd/93*, yes +*/proc/self/fd/94*, yes +*/proc/self/fd/95*, yes +*/proc/self/fd/96*, yes +*/proc/self/fd/97*, yes +*/proc/self/fd/98*, yes +*/proc/self/fd/99*, yes +*/proc/self/fd/100*, yes \ No newline at end of file diff --git a/lookups/local_file_inclusion_paths.yml b/lookups/local_file_inclusion_paths.yml new file mode 100644 index 0000000000..e08394bf85 --- /dev/null +++ b/lookups/local_file_inclusion_paths.yml @@ -0,0 +1,7 @@ +description: A list of interesting files in a local file inclusion attack +filename: local_file_inclusion_paths.csv +name: local_file_inclusion_paths +default_match: 'false' +match_type: WILDCARD(local_file_inclusion_paths) +min_matches: 1 +case_sensitive_match: 'false' \ No newline at end of file diff --git a/macros/kubernetes_container_controller.yml b/macros/kubernetes_container_controller.yml new file mode 100644 index 0000000000..29793801b8 --- /dev/null +++ b/macros/kubernetes_container_controller.yml @@ -0,0 +1,3 @@ +definition: sourcetype=kube:container:controller +description: customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data. Replace the macro definition with configurations for your Splunk Environmnent. +name: kubernetes_container_controller diff --git a/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml b/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml new file mode 100644 index 0000000000..756ad99e29 --- /dev/null +++ b/tests/cloud/kubernetes_nginx_ingress_lfi.test.yml @@ -0,0 +1,12 @@ +name: Kubernetes Nginx Ingress LFI Unit Test +tests: +- name: Kubernetes Nginx Ingress LFI + file: cloud/kubernetes_nginx_ingress_lfi.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-365d' + latest_time: 'now' + attack_data: + - file_name: kubernetes_nginx_lfi_attack.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kubernetes_nginx_lfi_attack/kubernetes_nginx_lfi_attack.log + sourcetype: kube:container:controller + source: kubernetes diff --git a/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml b/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml new file mode 100644 index 0000000000..792162624c --- /dev/null +++ b/tests/cloud/kubernetes_nginx_ingress_rfi.test.yml @@ -0,0 +1,12 @@ +name: Kubernetes Nginx Ingress RFI Unit Test +tests: +- name: Kubernetes Nginx Ingress RFI + file: cloud/kubernetes_nginx_ingress_rfi.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-365d' + latest_time: 'now' + attack_data: + - file_name: kubernetes_nginx_rfi_attack.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1212/kuberntest_nginx_rfi_attack/kubernetes_nginx_rfi_attack.log + sourcetype: kube:container:controller + source: kubernetes