{
"@timestamp": 1618894722217,
"app_id": "88cce00aa5a5207f2d13250f892bdcb96c46f080",
"app_name": "Demo App",
"attack_count": 2,
"attack_location": {
"latitude": 0,
"location_en": "-",
"location_zh_cn": "-",
"longitude": 0
},
"attack_params": {
"command": "cmd /c calc",
"env": [],
"stack": [
"java.base/java.lang.ProcessImpl.<init>(ProcessImpl.java)",
"java.base/java.lang.ProcessImpl.start(ProcessImpl.java:244)",
"java.base/java.lang.ProcessBuilder.start(ProcessBuilder.java:1109)",
"java.base/java.lang.ProcessBuilder.start(ProcessBuilder.java:1073)",
"java.base/java.lang.Runtime.exec(Runtime.java:590)",
"java.base/java.lang.Runtime.exec(Runtime.java:414)",
"java.base/java.lang.Runtime.exec(Runtime.java:311)",
"org.apache.jsp._004_002dcommand_002d1_jsp._jspService(_004_002dcommand_002d1_jsp.java:136)",
"org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)",
"javax.servlet.http.HttpServlet.service(HttpServlet.java:741)",
"org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:476)",
"org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:386)",
"org.apache.jasper.servlet.JspServlet.service(JspServlet.java:330)",
"javax.servlet.http.HttpServlet.service(HttpServlet.java:741)",
"org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)",
"org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)",
"org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)",
"org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)",
"org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)",
"org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199)",
"org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)",
"org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:490)",
"org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)",
"org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)",
"org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:668)",
"org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)",
"org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)",
"org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)",
"org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)",
"org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:834)",
"org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1417)",
"org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)",
"java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130)",
"java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)",
"org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)",
"java.base/java.lang.Thread.run(Thread.java:831)"
]
},
"attack_source": "127.0.0.1",
"attack_type": "command",
"body": "",
"client_ip": "",
"event_level": "critical",
"event_time": "2021-04-20T12:58:42+0800",
"event_type": "attack",
"header": {
"accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
"accept-encoding": "gzip, deflate, br",
"accept-language": "en,zh-CN;q=0.9,zh;q=0.8,la;q=0.7",
"connection": "keep-alive",
"cookie": "JSESSIONID=FA7196A1FDE61D1795DCEB3280890E14",
"dnt": "1",
"host": "127.0.0.1:8080",
"referer": "http://127.0.0.1:8080/vulns/004-command-1.jsp",
"upgrade-insecure-requests": "1",
"user-agent": "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0"
},
"id": "5f425ea2234ca4d4bcd991108affff8c",
"intercept_state": "log",
"parameter": {
"form": "{\"cmd\":[\"cmd /c calc\"]}",
"json": "{}",
"multipart": "[]"
},
"path": "/vulns/004-command-1.jsp",
"plugin_algorithm": "command_other",
"plugin_confidence": 90,
"plugin_message": "Command execution - Logging all command execution by default, command is cmd /c calc",
"plugin_name": "official",
"rasp_id": "520d19c523509c53025d66e67e394ab2",
"rasp_version": "1.3.6",
"request_id": "c7229f3f91e34e95902c7ada3b17865d",
"request_method": "get",
"server_hostname": "YOUR_COMPUTER",
"server_ip": "127.0.0.1",
"server_nic": [
{
"ip": "192.168.154.1",
"name": "vmnet8"
},
{
"ip": "172.16.177.1",
"name": "vmnet1"
},
{
"ip": "172.24.172.41",
"name": "en0"
}
],
"server_type": "tomcat",
"server_version": "9.0.14.0",
"source_code": "",
"stack_md5": "c0eccc0d41f14fcef3f0a6d7521d0875",
"target": "127.0.0.1",
"upsert_id": "5f425ea2234ca4d4bcd991108affff8c",
"url": "http://127.0.0.1:8080/vulns/004-command-1.jsp?cmd=cmd+/c+calc"
}