['flow', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http']
src_ip: 172.16.0.1, src_port: 44634, dest_ip: 192.168.10.50, dest_port: 80, event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 84, flow_pkts_toclient: 44, flow_bytes_toserver: 22547, flow_bytes_toclient: 39891, flow_age: 20, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1b, tcp_tcp_flags_ts: 1b, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; pcap_cnt: 2826987, event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: ../../login.php, http_length: 0 ; pcap_cnt: 2826990, event_type: http, proto: TCP, tx_id: 1, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 698 ; pcap_cnt: 2826991, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 698, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1523, fileinfo_tx_id: 1 ; pcap_cnt: 2826992, event_type: http, proto: TCP, tx_id: 2, http_hostname: 205.174.165.68, http_url: /dv/dvwa/css/login.css, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/css, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 406 ; pcap_cnt: 2826995, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/dvwa/css/login.css, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/css, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 406, app_proto: http, fileinfo_filename: /dv/dvwa/css/login.css, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 842, fileinfo_tx_id: 2 ; pcap_cnt: 2827003, event_type: http, proto: TCP, tx_id: 3, http_hostname: 205.174.165.68, http_url: /dv/dvwa/images/login_logo.png, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 404, http_length: 289 ; pcap_cnt: 2827008, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/dvwa/images/login_logo.png, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 404, http_length: 289, app_proto: http, fileinfo_filename: /dv/dvwa/images/login_logo.png, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 289, fileinfo_tx_id: 3 ; pcap_cnt: 2827009, event_type: http, proto: TCP, tx_id: 4, http_hostname: 205.174.165.68, http_url: /favicon.ico, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 404, http_length: 289 ; pcap_cnt: 2827045, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /favicon.ico, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 404, http_length: 289, app_proto: http, fileinfo_filename: /favicon.ico, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 289, fileinfo_tx_id: 4 ; pcap_cnt: 2827046, event_type: http, proto: TCP, tx_id: 5, http_hostname: 205.174.165.68, http_url: /favicon.ico, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: login.php, http_length: 0 ; pcap_cnt: 2827046, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_length: 0, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 130, fileinfo_tx_id: 6 ; pcap_cnt: 2827050, event_type: http, proto: TCP, tx_id: 6, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 716 ; pcap_cnt: 2827146, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 716, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1562, fileinfo_tx_id: 6 ; pcap_cnt: 2827147, event_type: http, proto: TCP, tx_id: 7, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: ../../login.php, http_length: 0 ; pcap_cnt: 2827151, event_type: http, proto: TCP, tx_id: 8, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 698 ; pcap_cnt: 2827181, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 698, app_proto: http, fileinfo_filename: /dv/vulnerabilities/xss_r/, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1523, fileinfo_tx_id: 8 ; pcap_cnt: 2827182, event_type: http, proto: TCP, tx_id: 9, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: login.php, http_length: 0 ; pcap_cnt: 2827182, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_length: 0, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 130, fileinfo_tx_id: 10 ; pcap_cnt: 2827185, event_type: http, proto: TCP, tx_id: 10, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 717 ; pcap_cnt: 2827293, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 717, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1562, fileinfo_tx_id: 10 ; pcap_cnt: 2827294, event_type: http, proto: TCP, tx_id: 11, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: ../../login.php, http_length: 0 ; pcap_cnt: 2827297, event_type: http, proto: TCP, tx_id: 12, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 700 ; pcap_cnt: 2827316, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 700, app_proto: http, fileinfo_filename: /dv/vulnerabilities/xss_r/, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1523, fileinfo_tx_id: 12 ; pcap_cnt: 2827317, event_type: http, proto: TCP, tx_id: 13, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: login.php, http_length: 0 ; pcap_cnt: 2827317, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_length: 0, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 130, fileinfo_tx_id: 14 ; pcap_cnt: 2827322, event_type: http, proto: TCP, tx_id: 14, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 717 ; pcap_cnt: 2827851, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 717, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1562, fileinfo_tx_id: 14 ; pcap_cnt: 2827852, event_type: http, proto: TCP, tx_id: 15, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: ../../login.php, http_length: 0 ; pcap_cnt: 2827857, event_type: http, proto: TCP, tx_id: 16, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 700 ; pcap_cnt: 2827860, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 700, app_proto: http, fileinfo_filename: /dv/vulnerabilities/xss_r/, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1523, fileinfo_tx_id: 16 ; pcap_cnt: 2827861, event_type: http, proto: TCP, tx_id: 17, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: login.php, http_length: 0 ; pcap_cnt: 2827861, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_length: 0, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 130, fileinfo_tx_id: 18 ; pcap_cnt: 2827865, event_type: http, proto: TCP, tx_id: 18, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 716 ; pcap_cnt: 2828009, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 716, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1562, fileinfo_tx_id: 18 ; pcap_cnt: 2828010, event_type: http, proto: TCP, tx_id: 19, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: ../../login.php, http_length: 0 ; pcap_cnt: 2828015, event_type: http, proto: TCP, tx_id: 20, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 700 ; pcap_cnt: 2828030, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 700, app_proto: http, fileinfo_filename: /dv/vulnerabilities/xss_r/, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1523, fileinfo_tx_id: 20 ; pcap_cnt: 2828031, event_type: http, proto: TCP, tx_id: 21, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: login.php, http_length: 0 ; pcap_cnt: 2828031, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_length: 0, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 130, fileinfo_tx_id: 22 ; pcap_cnt: 2828038, event_type: http, proto: TCP, tx_id: 22, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 717 ; pcap_cnt: 2828149, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 717, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1562, fileinfo_tx_id: 22 ; pcap_cnt: 2828150, event_type: http, proto: TCP, tx_id: 23, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: ../../login.php, http_length: 0 ; pcap_cnt: 2828155, event_type: http, proto: TCP, tx_id: 24, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 699 ; pcap_cnt: 2828175, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 699, app_proto: http, fileinfo_filename: /dv/vulnerabilities/xss_r/, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1523, fileinfo_tx_id: 24 ; pcap_cnt: 2828176, event_type: http, proto: TCP, tx_id: 25, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: login.php, http_length: 0 ; pcap_cnt: 2828176, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_length: 0, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 130, fileinfo_tx_id: 26 ; pcap_cnt: 2828183, event_type: http, proto: TCP, tx_id: 26, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 716 ; pcap_cnt: 2828474, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 716, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1562, fileinfo_tx_id: 26 ; pcap_cnt: 2828475, event_type: http, proto: TCP, tx_id: 27, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: ../../login.php, http_length: 0 ; pcap_cnt: 2828479, event_type: http, proto: TCP, tx_id: 28, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 699 ; pcap_cnt: 2828498, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 699, app_proto: http, fileinfo_filename: /dv/vulnerabilities/xss_r/, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1523, fileinfo_tx_id: 28 ; pcap_cnt: 2828499, event_type: http, proto: TCP, tx_id: 29, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: login.php, http_length: 0 ; pcap_cnt: 2828499, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_length: 0, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 130, fileinfo_tx_id: 30 ; pcap_cnt: 2828502, event_type: http, proto: TCP, tx_id: 30, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 715 ; pcap_cnt: 2828639, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 715, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1562, fileinfo_tx_id: 30 ; pcap_cnt: 2828640, event_type: http, proto: TCP, tx_id: 31, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: ../../login.php, http_length: 0 ; pcap_cnt: 2828643, event_type: http, proto: TCP, tx_id: 32, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 700 ; pcap_cnt: 2828652, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 700, app_proto: http, fileinfo_filename: /dv/vulnerabilities/xss_r/, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1523, fileinfo_tx_id: 32 ; pcap_cnt: 2828653, event_type: http, proto: TCP, tx_id: 33, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: login.php, http_length: 0 ; pcap_cnt: 2828653, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_length: 0, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 130, fileinfo_tx_id: 34 ; pcap_cnt: 2828658, event_type: http, proto: TCP, tx_id: 34, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 716 ; pcap_cnt: 2828740, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 716, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1562, fileinfo_tx_id: 34 ; pcap_cnt: 2828741, event_type: http, proto: TCP, tx_id: 35, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: ../../login.php, http_length: 0 ; pcap_cnt: 2828747, event_type: http, proto: TCP, tx_id: 36, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 699 ; pcap_cnt: 2828761, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 699, app_proto: http, fileinfo_filename: /dv/vulnerabilities/xss_r/, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1523, fileinfo_tx_id: 36 ; pcap_cnt: 2828762, event_type: http, proto: TCP, tx_id: 37, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: login.php, http_length: 0 ; pcap_cnt: 2828762, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_length: 0, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 130, fileinfo_tx_id: 38 ; pcap_cnt: 2828765, event_type: http, proto: TCP, tx_id: 38, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 716 ; pcap_cnt: 2828810, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 200, http_length: 716, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1562, fileinfo_tx_id: 38 ; pcap_cnt: 2828813, event_type: http, proto: TCP, tx_id: 39, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_length: 0
The network event indicates a Web Attack - Brute Force. Web attack brute force involves attempting numerous login attempts on a web application. Typically, the logs show multiple login requests from the same source IP to a web server, often with varied credentials, aiming to discover valid username and password combinations. Frequent redirects back to the login page and the consistent user-agent across multiple requests indicate automated attack behavior.
classification: Attack
justification: The network event indicates a Web Attack - Brute Force. Web attack brute force involves attempting numerous login attempts on a web application. Typically, the logs show multiple login requests from the same source IP to a web server, often with varied credentials, aiming to discover valid username and password combinations. Frequent redirects back to the login page and the consistent user-agent across multiple requests indicate automated attack behavior.