cscli scenarios install crowdsecurity/http-path-traversal-probingThe http path traversal probing scenario aims at detecting, with very little false positive chances, path traversal probing attempts.
Path traversal attempts will be detected with the presence of specific path manipulation patterns in the URI or the GET parameter such as ../ , %2Fetc%2Fpasswd ...
⚠️ This scenario is not a WAF and this scenario does not aims at replacing a WAF.
1# path traversal probing2type: leaky3#debug: true4name: crowdsecurity/http-path-traversal-probing5description: "Detect path traversal attempt"6filter: "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && any(File('http_path_traversal.txt'),{evt.Meta.http_path contains #})"7data:8 - source_url: https://hub-data.crowdsec.net/web/path_traversal.txt9 dest_file: http_path_traversal.txt10 type: string11groupby: "evt.Meta.source_ip"12distinct: "evt.Meta.http_path"13capacity: 314reprocess: true15leakspeed: 10s16blackhole: 2m17labels:18 remediation: true19 classification:20 - attack.T1595.00221 behavior: "http:exploit"22 label: "HTTP Path Traversal Exploit"23 service: http24 spoofable: 025 confidence: 326