Web

← All KQL categories

Platform

Web

5 queries tagged with this platform.

• Analytics Rules Detect Nextjs Middleware Authorization Bypass

  Next.js middleware authorization-bypass pattern — successful requests to authenticated routes without going through the expected auth path.

• Hunting Hunt Cloud Metadata Ssrf Normalized Forms

  Cloud instance-metadata SSRF across every string-form the attacker can write — dotted, dotless, octal, hex, IPv6, dashed hostnames, encoded slashes. Normalizes before matching.

• Hunting / Web Tier Hunt Spring Boot Heapdump Exfiltration Asim

  Hunts Spring Boot Actuator heap-dump exfiltration in ASIM Web Session data by matching the endpoint ID as a path segment (position-independent) instead of hardcoding `/actuator/heapdump`. Recovers the real base path from traffic and ranks by response-size verdict.

• Hunting / Web Tier Hunt Spring Boot Heapdump Exfiltration Commonsecuritylog

  Non-ASIM (`CommonSecurityLog`) variant of the heap-dump hunt. Uses correct CEF field names (`ReceivedBytes` / `SentBytes`) and carries both byte directions because CEF doesn't tell you which side is the response.

• Posture Inventory Exposed Spring Boot Actuator Endpoints

  Inventory of Spring Boot Actuator endpoints that answer 200 anywhere in your estate — flips the entity from "who scanned us" (infinite) to "which of my services answer" (finite and fixable). Recovers the real management base path from traffic.