# SPDX-License-Identifier: AGPL-3.0-only
# GENERATED by bin/gen-http-lists.py — edit the data file and
# regenerate, never this file.
#
# A refused request for a path only an exploit asks for — the
# hub's list of URIs from actively-probed CVEs (33 of
# them).
# Data from the CrowdSec hub (MIT), matched the way its scenario
# matches: on a 404 or 403 only. What answered 200 is the operator's
# own service, not a probe.
parser: http-cve-probe
log: http
prefilter: '" 4'
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*(?:/_ignition/execute\-solution|/_layouts/15/toolpane\.aspx|/api/fabric/device/status|/api/v2\.0/cmdb/system/admin%3f/\.\./\.\./\.\./\.\./\.\./cgi\-bin/fwbcgi|/cgi/networkdiag\.cgi|/cgi\-bin/nas_sharing\.cgi|/clients/mycrl|/developmentserver/metadatauploader|/global\-protect/login\.esp|/goanywhere/images/\.\.|/goanywhere/lic/accept|/gsb/datetime\.php|/guestaccess\.aspx|/hedwig\.cgi|/helpdesk/WebObjects/Helpdesk\.woa/ajax/2\.0\.7\.1\.1\.1|/helpdesk/WebObjects/Helpdesk\.woa/ajax/9\.7\.43\.0\.0\.0\.4\.3\.7\.0\.7\.1\.1\.1|/helpdesk/WebObjects/Helpdesk\.woa/wo/|/hnap1/|/mdm/checkin|/nf/auth/startwebview\.do|/p/u/doauthentication\.do|/remote/saml/login|/reports/data/opt/data/containers/config/data\-collection\-agent/\.dca|/rpc2_login|/server/node_upgrade_srv\.js|/setup\.cgi|/sitecore/api/ssc/auth/login|/unauth/%252e%252e/php/|/webinterface/|/webinterface/login\.html|/wp\-json/batch/v1|\?%ad|index\.php%3f\.php/)[^ "?]*)(?:\?[^ "]*)? [^"]*" (?:404|403) '
time_field: time
time_format: nginx
