['flow', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'http', 'fileinfo', 'http', 'fileinfo', 'http', 'fileinfo']
src_ip: 172.16.0.1, src_port: 44464, dest_ip: 192.168.10.50, dest_port: 80, event_type: flow, proto: TCP, app_proto: http, flow_pkts_toserver: 28, flow_pkts_toclient: 17, flow_bytes_toserver: 6657, flow_bytes_toclient: 18174, flow_age: 4, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1b, tcp_tcp_flags_ts: 1b, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; pcap_cnt: 2490573, event_type: http, proto: TCP, tx_id: 0, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: ../../login.php, http_length: 0 ; pcap_cnt: 2490579, event_type: http, proto: TCP, tx_id: 1, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 698 ; pcap_cnt: 2490580, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 698, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1523, fileinfo_tx_id: 1 ; pcap_cnt: 2490581, event_type: http, proto: TCP, tx_id: 2, http_hostname: 205.174.165.68, http_url: /dv/dvwa/css/login.css, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/css, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 406 ; pcap_cnt: 2490584, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/dvwa/css/login.css, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/css, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 406, app_proto: http, fileinfo_filename: /dv/dvwa/css/login.css, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 842, fileinfo_tx_id: 2 ; pcap_cnt: 2490646, event_type: http, proto: TCP, tx_id: 3, http_hostname: 205.174.165.68, http_url: /dv/dvwa/images/login_logo.png, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: image/png, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 9088 ; pcap_cnt: 2490646, event_type: http, proto: TCP, tx_id: 4, http_hostname: 205.174.165.68, http_url: /favicon.ico, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 404, http_length: 289 ; pcap_cnt: 2490681, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/dvwa/images/login_logo.png, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: image/png, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 9088, app_proto: http, fileinfo_filename: /dv/dvwa/images/login_logo.png, fileinfo_gaps: True, fileinfo_state: TRUNCATED, fileinfo_stored: False, fileinfo_size: 9088, fileinfo_tx_id: 3 ; pcap_cnt: 2490681, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /favicon.ico, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 404, http_length: 289, app_proto: http, fileinfo_filename: /favicon.ico, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 289, fileinfo_tx_id: 4 ; pcap_cnt: 2490682, event_type: http, proto: TCP, tx_id: 5, http_hostname: 205.174.165.68, http_url: /favicon.ico, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 404, http_length: 289 ; pcap_cnt: 2491390, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /favicon.ico, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 404, http_length: 289, app_proto: http, fileinfo_filename: /favicon.ico, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 289, fileinfo_tx_id: 5 ; pcap_cnt: 2491391, event_type: http, proto: TCP, tx_id: 6, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 302, http_redirect: login.php, http_length: 0 ; pcap_cnt: 2491391, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 302, http_redirect: login.php, http_length: 0, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 130, fileinfo_tx_id: 6 ; pcap_cnt: 2491404, event_type: http, proto: TCP, tx_id: 7, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 716 ; pcap_cnt: 2492257, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 716, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1562, fileinfo_tx_id: 7 ; pcap_cnt: 2492258, event_type: http, proto: TCP, tx_id: 8, http_hostname: 205.174.165.68, http_url: /dv/vulnerabilities/xss_r/, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 302, http_redirect: ../../login.php, http_length: 0 ; pcap_cnt: 2492351, event_type: http, proto: TCP, tx_id: 9, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 699 ; pcap_cnt: 2492853, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 699, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1523, fileinfo_tx_id: 9 ; pcap_cnt: 2492854, event_type: http, proto: TCP, tx_id: 10, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 302, http_redirect: login.php, http_length: 0 ; pcap_cnt: 2492854, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: POST, http_protocol: HTTP/1.1, http_status: 302, http_redirect: login.php, http_length: 0, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 130, fileinfo_tx_id: 10 ; pcap_cnt: 2492975, event_type: http, proto: TCP, tx_id: 11, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 715 ; pcap_cnt: 2494986, event_type: fileinfo, proto: TCP, http_hostname: 205.174.165.68, http_url: /dv/login.php, http_http_user_agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0, http_http_content_type: text/html, http_http_refer: http://205.174.165.68/dv/login.php, http_http_method: GET, http_protocol: HTTP/1.1, http_status: 200, http_length: 715, app_proto: http, fileinfo_filename: /dv/login.php, fileinfo_gaps: False, fileinfo_state: CLOSED, fileinfo_stored: False, fileinfo_size: 1562, fileinfo_tx_id: 11
The network event indicates a Web Attack - Brute Force. Web attack brute force involves attempting numerous login attempts on a web application. Typically, the logs show multiple login requests from the same source IP to a web server, often with varied credentials, aiming to discover valid username and password combinations. Frequent redirects back to the login page and the consistent user-agent across multiple requests indicate automated attack behavior.
classification: Attack
justification: The network event indicates a Web Attack - Brute Force. Web attack brute force involves attempting numerous login attempts on a web application. Typically, the logs show multiple login requests from the same source IP to a web server, often with varied credentials, aiming to discover valid username and password combinations. Frequent redirects back to the login page and the consistent user-agent across multiple requests indicate automated attack behavior.