Skip to content
Threat Feed
Subscribe

Tag

Vulnerability-Scanning

3 briefs RSS
medium threat

Detection of sqlmap Automated Tool Usage via User-Agent

This brief covers the detection of the sqlmap automated penetration testing tool, which is frequently used by adversaries to perform reconnaissance and exploit SQL injection vulnerabilities in web applications.

exploited reconnaissance vulnerability-scanning web-application apm sqlmap
1r 1t
low advisory

Web Server Error Response Spike Indicating Reconnaissance

An unusual spike in web server error codes (500, 502, 503, 504) may indicate reconnaissance activities like vulnerability scanning or fuzzing, where attackers probe for weaknesses, potentially leading to exploitation of server-side issues.

Nginx +4 web-server reconnaissance vulnerability-scanning fuzzing
2r 2t
low advisory

Web Server Reconnaissance via Unusual User Agents

Detection of unusual spikes in web server requests with uncommon or suspicious user-agent strings indicative of reconnaissance attempts to identify web application vulnerabilities or brute-force attacks.

Nginx +4 web-server reconnaissance vulnerability-scanning user-agent
2r 4t