Monday, July 25, 2011

"NeoSploit" URI patterns - Work In Progress

I'm digging through my samples as well as looking for more to at least collect as many variations and I can glean. Here are some of what I have so far:

/5cm1zrkq/?4d07c159b49b5ccf5e05420c5203020f015c0b0e5a080e08075407025405010007
/5cm1zrkq/?7fd0e2bb0d480b96521e010b54005554025e5f095c0b5953045653055206565b04
/5cm1zrkq/?4a7109d554a1854e5e155a0a010b530301590c0809005f0407510004070d500c07
/5cm1zrkq/?4d07c159b49b5ccf5e05420c5203020f015c0b0e5a080e08075407025405010007
/5cm1zrkq/?4a7109d554a1854e5e155a0a010b530301590c0809005f0407510004070d500c07
/5cm1zrkq/?0a5864250d480b96551950030706050305590e010f0d09040351020d0100060c03
/5cm1zrkq/?04ee3e0fab7472aa4343035e02570750050c5e5c0a5c0b57030452500451045f03
/9s1hjngl/?3319fe7979403dfa5f5a5302545e05080a0204095d5155090807555f5600070803
/9s1hjngl/?684928607837bcf753405102000304010f090109090c54000d0c505f025d060106
/9s1hjngl/?0cabed07c1e4ebae5a021359575f0206095254525e5052070b5705045501000600
/9s1hjngl/?1d1fb22a7837bcf7541c545d5009005008550456590650510a5055005257025001
/9s1hjngl/?1d1fb22a7837bcf7541c545d5009005008550456590650510a5055005257025001
/9s1hjngl/?684928607837bcf753405102000304010f090109090c54000d0c505f025d060106
/9s1hjngl/?0cabed07c1e4ebae5a021359575f0206095254525e5052070b5705045501000600
/9s1hjngl/?1d1fb22a7837bcf7541c545d5009005008550456590650510a5055005257025001
/9s1hjngl/?3e51deaa21de322f5911580a565e53500a5400015f510351085151575400515003
/9s1hjngl/?3319fe7979403dfa5f5a5302545e05080a0204095d5155090807555f5600070803
/9s1hjngl/?7125bd83de0bc5cb4446540e505f0a020e00070559505a030c0556535201080207
/ea0gux4t/?76d8457b84d3cfc25d420903050e005001075003005707590353555c57010657
/ea0gux4t/?555aac175e4e5b1b4642535a505806050304015a5501010c0150040502570002
/ea0gux4t/?12e7d21c6be350c85b53170c550906510703510c505001580557545307060056
/t6ryfisw/?356c4ffd1392a5f159544458075d5f53010d0d5756565d5057530457005305
/t6ryfisw/?2a19647f0b318cd941165702050f0e5100590a0d54040c525607030d020154
/t6ryfisw/?0200123d400de24c554a550b02090a53020a0b045302085054540204050750
/t6ryfisw/?013a3faa400de24c5549565a005d58560209085551565a5554570155075302
/t6ryfisw/?013a3faa400de24c5549565a005d58560209085551565a5554570155075302
/t6ryfisw/?165ab5c3f61d85b25b42585a510e5a04030e0e550005580755500755560000

URI Queries:
/?3319fe7979403dfa5f5a5302545e05080a0204095d5155090807555f5600070803
/?684928607837bcf753405102000304010f090109090c54000d0c505f025d060106;1;1
/?0cabed07c1e4ebae5a021359575f0206095254525e5052070b5705045501000600
/?1d1fb22a7837bcf7541c545d5009005008550456590650510a5055005257025001;1;8
/?1d1fb22a7837bcf7541c545d5009005008550456590650510a5055005257025001;1;8;1
/?684928607837bcf753405102000304010f090109090c54000d0c505f025d060106;1;1
/?0cabed07c1e4ebae5a021359575f0206095254525e5052070b5705045501000600
/?1d1fb22a7837bcf7541c545d5009005008550456590650510a5055005257025001;1;8
/?3e51deaa21de322f5911580a565e53500a5400015f510351085151575400515003
/?3319fe7979403dfa5f5a5302545e05080a0204095d5155090807555f5600070803
/?7125bd83de0bc5cb4446540e505f0a020e00070559505a030c0556535201080207
/?4d07c159b49b5ccf5e05420c5203020f015c0b0e5a080e08075407025405010007
/?7fd0e2bb0d480b96521e010b54005554025e5f095c0b5953045653055206565b04;1;8
/?4a7109d554a1854e5e155a0a010b530301590c0809005f0407510004070d500c07
/?4d07c159b49b5ccf5e05420c5203020f015c0b0e5a080e08075407025405010007
/?4a7109d554a1854e5e155a0a010b530301590c0809005f0407510004070d500c07
/?0a5864250d480b96551950030706050305590e010f0d09040351020d0100060c03;1;6
/?04ee3e0fab7472aa4343035e02570750050c5e5c0a5c0b57030452500451045f03
/?76d8457b84d3cfc25d420903050e005001075003005707590353555c57010657
/?555aac175e4e5b1b4642535a505806050304015a5501010c0150040502570002
/?12e7d21c6be350c85b53170c550906510703510c505001580557545307060056

Variant:
/?356c4ffd1392a5f159544458075d5f53010d0d5756565d5057530457005305
/?2a19647f0b318cd941165702050f0e5100590a0d54040c525607030d020154
/?0200123d400de24c554a550b02090a53020a0b045302085054540204050750;1;8
/?013a3faa400de24c5549565a005d58560209085551565a5554570155075302;1;1
/?013a3faa400de24c5549565a005d58560209085551565a5554570155075302;1;1;1
/?165ab5c3f61d85b25b42585a510e5a04030e0e550005580755500755560000

Will be updating this as I go and find more, and will post more content and context as well.

No comments:

Post a Comment