wordpot: support next event schema and payload spooling#20
Open
t3chn0m4g3 wants to merge 1 commit into
Open
Conversation
Read Wordpot's new JSONL event format, forward the expanded event metadata as AdditionalData, and submit stored request bodies from the payload spool. Update default and Docker config paths to use wordpot.json and the new payloads directory.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@trixam @elivlo : Please review and test
Read Wordpot's new JSONL event format, forward the expanded event metadata as AdditionalData, and submit stored request bodies from the payload spool.
Update default and Docker config paths to use wordpot.json and the new payloads directory.
Log example:
{"browser_family": "Other", "component_slug": "wp-json", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "device_family": "Other", "headers_subset": {"User-Agent": "wordpot-container-smoke/1.0"}, "method": "GET", "os_family": "Other", "path": "/wp-json/", "payload_size": 0, "payload_stored": false, "profile_id": "modern-business", "request_id": "72949ae4-9088-4173-8bef-d9ad7eb5a618", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 38498, "technique": "rest_index", "timestamp": "2026-06-19T14:36:00.125272+00:00", "url": "http://127.0.0.1/wp-json/", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "wp/v2/users", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "device_family": "Other", "headers_subset": {"User-Agent": "wordpot-container-smoke/1.0"}, "method": "GET", "os_family": "Other", "path": "/wp-json/wp/v2/users", "payload_size": 0, "payload_stored": false, "profile_id": "modern-business", "request_id": "eba7bfd4-ad5c-4410-8259-f446ee8f80a3", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 38508, "technique": "rest_user_enumeration", "timestamp": "2026-06-19T14:36:00.126525+00:00", "url": "http://127.0.0.1/wp-json/wp/v2/users", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "xmlrpc.php", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "device_family": "Other", "headers_subset": {"User-Agent": "wordpot-container-smoke/1.0"}, "method": "GET", "os_family": "Other", "path": "/xmlrpc.php", "payload_size": 0, "payload_stored": false, "profile_id": "modern-business", "request_id": "4e574cb8-0c18-4dc6-9a0f-9df8014adcbf", "response_status": 405, "src_ip": "172.18.0.1", "src_port": 38510, "technique": "xmlrpc_probe", "timestamp": "2026-06-19T14:36:00.128076+00:00", "url": "http://127.0.0.1/xmlrpc.php", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "wp-login.php", "component_type": "core", "credentials_observed": {"log": "admin", "pwd": "wordpot-smoke"}, "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"action": "login"}, "device_family": "Other", "headers_subset": {"Content-Type": "application/x-www-form-urlencoded", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "password": "wordpot-smoke", "path": "/wp-login.php", "payload_excerpt": "log=admin&pwd=wordpot-smoke", "payload_path": "/opt/wordpot/logs/payloads/35/353060c3378469891d882010b6c9410ba38094c1997750ae361061099447cc42.bin", "payload_ref": "35/353060c3378469891d882010b6c9410ba38094c1997750ae361061099447cc42.bin", "payload_sha256": "353060c3378469891d882010b6c9410ba38094c1997750ae361061099447cc42", "payload_size": 27, "payload_stored": true, "profile_id": "modern-business", "request_id": "8581aa39-71d9-4fd4-af65-875b99a45b82", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 38512, "technique": "credential_attempt", "timestamp": "2026-06-19T14:36:00.129357+00:00", "url": "http://127.0.0.1/wp-login.php", "user_agent": "wordpot-container-smoke/1.0", "username": "admin"} {"browser_family": "Other", "component_slug": "admin-ajax.php", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"action": "wordpot_smoke_test", "lure_params": {"file": "http://169.254.169.254/"}}, "device_family": "Other", "headers_subset": {"Content-Type": "application/x-www-form-urlencoded", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "path": "/wp-admin/admin-ajax.php", "payload_excerpt": "action=wordpot_smoke_test&file=http%3A%2F%2F169.254.169.254%2F", "payload_path": "/opt/wordpot/logs/payloads/43/43606b3cc424fae79a28f174576c575b6bd1377c9db10fad886e54c8c641dccd.bin", "payload_ref": "43/43606b3cc424fae79a28f174576c575b6bd1377c9db10fad886e54c8c641dccd.bin", "payload_sha256": "43606b3cc424fae79a28f174576c575b6bd1377c9db10fad886e54c8c641dccd", "payload_size": 62, "payload_stored": true, "profile_id": "modern-business", "request_id": "0fa111fc-5eb7-44fc-adbf-cd5160973087", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 38516, "technique": "admin_ajax_action", "timestamp": "2026-06-19T14:36:00.133250+00:00", "url": "http://127.0.0.1/wp-admin/admin-ajax.php", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "2026/06/smoke.php", "component_type": "upload", "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"lure_params": {}}, "device_family": "Other", "headers_subset": {"Content-Type": "application/octet-stream", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "path": "/wp-content/uploads/2026/06/smoke.php", "payload_excerpt": "<?php echo 'smoke'; ?>", "payload_path": "/opt/wordpot/logs/payloads/43/43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5.bin", "payload_ref": "43/43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5.bin", "payload_sha256": "43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5", "payload_size": 22, "payload_stored": true, "profile_id": "modern-business", "request_id": "aa8c489b-951f-4dde-b879-74e85a44a992", "src_ip": "172.18.0.1", "src_port": 38526, "technique": "uploads_probe", "timestamp": "2026-06-19T14:36:00.134340+00:00", "url": "http://127.0.0.1/wp-content/uploads/2026/06/smoke.php", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "2026/06/smoke.php", "component_type": "upload", "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"lure_params": {}}, "device_family": "Other", "headers_subset": {"Content-Type": "application/octet-stream", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "path": "/wp-content/uploads/2026/06/smoke.php", "payload_excerpt": "<?php echo 'smoke'; ?>", "payload_path": "/opt/wordpot/logs/payloads/43/43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5.bin", "payload_ref": "43/43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5.bin", "payload_sha256": "43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5", "payload_size": 22, "payload_stored": true, "profile_id": "modern-business", "request_id": "aa8c489b-951f-4dde-b879-74e85a44a992", "response_status": 404, "src_ip": "172.18.0.1", "src_port": 38526, "technique": "upload_lure_payload", "timestamp": "2026-06-19T14:36:00.134517+00:00", "url": "http://127.0.0.1/wp-content/uploads/2026/06/smoke.php", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "admin-ajax.php", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"action": "wordpot_smoke_payload", "lure_params": {"file": "http://169.254.169.254/latest/meta-data/"}}, "device_family": "Other", "headers_subset": {"Content-Type": "application/x-www-form-urlencoded", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "path": "/wp-admin/admin-ajax.php", "payload_excerpt": "action=wordpot_smoke_payload&marker=wordpot-smoke-087894b55de74bd599860fc50f0a3eb5&file=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2F", "payload_path": "/opt/wordpot/logs/payloads/e3/e388a88ffffbce6b7ec66363b12d55498de450d999672c2a215a69152c8b7e94.bin", "payload_ref": "e3/e388a88ffffbce6b7ec66363b12d55498de450d999672c2a215a69152c8b7e94.bin", "payload_sha256": "e388a88ffffbce6b7ec66363b12d55498de450d999672c2a215a69152c8b7e94", "payload_size": 140, "payload_stored": true, "profile_id": "modern-business", "request_id": "4131a197-de82-4e60-bfd8-72c13c93903b", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 38528, "technique": "admin_ajax_action", "timestamp": "2026-06-19T14:36:00.136270+00:00", "url": "http://127.0.0.1/wp-admin/admin-ajax.php", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Firefox", "browser_version": "151.0", "component_slug": "wpforms-lite", "component_type": "plugin", "dest_ip": "172.20.254.112", "dest_port": 80, "details": {"subpath": "assets/css/wpforms-full.min.css"}, "device_family": "Mac", "headers_subset": {"Accept": "text/css,*/*;q=0.1", "Referer": "http://172.20.254.112/", "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0"}, "method": "GET", "os_family": "Mac OS X", "os_version": "10.15", "path": "/wp-content/plugins/wpforms-lite/assets/css/wpforms-full.min.css", "payload_size": 0, "payload_stored": false, "profile_id": "modern-business", "query": "ver=1.10.2", "request_id": "a23471a4-78a0-4a9f-9136-173957405f1a", "src_ip": "172.20.254.158", "src_port": 51472, "technique": "plugin_probe", "timestamp": "2026-06-19T14:36:15.685643+00:00", "url": "http://172.20.254.112/wp-content/plugins/wpforms-lite/assets/css/wpforms-full.min.css?ver=1.10.2", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0"} {"browser_family": "Firefox", "browser_version": "151.0", "component_slug": "elementor", "component_type": "plugin", "dest_ip": "172.20.254.112", "dest_port": 80, "details": {"subpath": "assets/css/frontend.min.css"}, "device_family": "Mac", "headers_subset": {"Accept": "text/css,*/*;q=0.1", "Referer": "http://172.20.254.112/", "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0"}, "method": "GET", "os_family": "Mac OS X", "os_version": "10.15", "path": "/wp-content/plugins/elementor/assets/css/frontend.min.css", "payload_size": 0, "payload_stored": false, "profile_id": "modern-business", "query": "ver=4.1.3", "request_id": "b2290347-9a0c-4b53-88f7-a13216251754", "src_ip": "172.20.254.158", "src_port": 51470, "technique": "plugin_probe", "timestamp": "2026-06-19T14:36:15.686436+00:00", "url": "http://172.20.254.112/wp-content/plugins/elementor/assets/css/frontend.min.css?ver=4.1.3", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0"} {"browser_family": "Firefox", "browser_version": "151.0", "component_slug": "contact-form-7", "component_type": "plugin", "dest_ip": "172.20.254.112", "dest_port": 80, "details": {"subpath": "includes/css/styles.css"}, "device_family": "Mac", "headers_subset": {"Accept": "text/css,*/*;q=0.1", "Referer": "http://172.20.254.112/", "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0"}, "method": "GET", "os_family": "Mac OS X", "os_version": "10.15", "path": "/wp-content/plugins/contact-form-7/includes/css/styles.css", "payload_size": 0, "payload_stored": false, "profile_id": "modern-business", "query": "ver=6.1.6", "request_id": "55298be1-572a-4227-8960-787a77a774f3", "src_ip": "172.20.254.158", "src_port": 51471, "technique": "plugin_probe", "timestamp": "2026-06-19T14:36:15.693657+00:00", "url": "http://172.20.254.112/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.6", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0"} {"browser_family": "Firefox", "browser_version": "151.0", "component_slug": "twentytwentyfive", "component_type": "theme", "dest_ip": "172.20.254.112", "dest_port": 80, "details": {"subpath": "style.css"}, "device_family": "Mac", "headers_subset": {"Accept": "text/css,*/*;q=0.1", "Referer": "http://172.20.254.112/", "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0"}, "method": "GET", "os_family": "Mac OS X", "os_version": "10.15", "path": "/wp-content/themes/twentytwentyfive/style.css", "payload_size": 0, "payload_stored": false, "profile_id": "modern-business", "query": "ver=7.0", "request_id": "626235c3-d2f7-454b-8937-3ceb45194bdc", "src_ip": "172.20.254.158", "src_port": 51468, "technique": "theme_probe", "timestamp": "2026-06-19T14:36:15.694240+00:00", "url": "http://172.20.254.112/wp-content/themes/twentytwentyfive/style.css?ver=7.0", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:151.0) Gecko/20100101 Firefox/151.0"} {"browser_family": "Other", "component_slug": "wp-json", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "device_family": "Other", "headers_subset": {"User-Agent": "wordpot-container-smoke/1.0"}, "method": "GET", "os_family": "Other", "path": "/wp-json/", "payload_size": 0, "payload_stored": false, "profile_id": "maintenance-lag", "request_id": "fcefb5db-9c86-4712-96b2-318637aff53b", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 58778, "technique": "rest_index", "timestamp": "2026-06-19T14:43:40.172264+00:00", "url": "http://127.0.0.1/wp-json/", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "wp/v2/users", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "device_family": "Other", "headers_subset": {"User-Agent": "wordpot-container-smoke/1.0"}, "method": "GET", "os_family": "Other", "path": "/wp-json/wp/v2/users", "payload_size": 0, "payload_stored": false, "profile_id": "maintenance-lag", "request_id": "88a1fd7e-8b7d-40bd-9fa2-dd3ce61c824d", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 58792, "technique": "rest_user_enumeration", "timestamp": "2026-06-19T14:43:40.173814+00:00", "url": "http://127.0.0.1/wp-json/wp/v2/users", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "xmlrpc.php", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "device_family": "Other", "headers_subset": {"User-Agent": "wordpot-container-smoke/1.0"}, "method": "GET", "os_family": "Other", "path": "/xmlrpc.php", "payload_size": 0, "payload_stored": false, "profile_id": "maintenance-lag", "request_id": "ce54c6e9-ef1f-4125-b82e-ca795af22eef", "response_status": 405, "src_ip": "172.18.0.1", "src_port": 58796, "technique": "xmlrpc_probe", "timestamp": "2026-06-19T14:43:40.174890+00:00", "url": "http://127.0.0.1/xmlrpc.php", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "wp-login.php", "component_type": "core", "credentials_observed": {"log": "admin", "pwd": "wordpot-smoke"}, "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"action": "login"}, "device_family": "Other", "headers_subset": {"Content-Type": "application/x-www-form-urlencoded", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "password": "wordpot-smoke", "path": "/wp-login.php", "payload_excerpt": "log=admin&pwd=wordpot-smoke", "payload_path": "/opt/wordpot/logs/payloads/35/353060c3378469891d882010b6c9410ba38094c1997750ae361061099447cc42.bin", "payload_ref": "35/353060c3378469891d882010b6c9410ba38094c1997750ae361061099447cc42.bin", "payload_sha256": "353060c3378469891d882010b6c9410ba38094c1997750ae361061099447cc42", "payload_size": 27, "payload_stored": true, "profile_id": "maintenance-lag", "request_id": "0e3705c9-4f99-4445-9c85-2a3739067138", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 58810, "technique": "credential_attempt", "timestamp": "2026-06-19T14:43:40.176424+00:00", "url": "http://127.0.0.1/wp-login.php", "user_agent": "wordpot-container-smoke/1.0", "username": "admin"} {"browser_family": "Other", "component_slug": "admin-ajax.php", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"action": "wordpot_smoke_test", "lure_params": {"file": "http://169.254.169.254/"}}, "device_family": "Other", "headers_subset": {"Content-Type": "application/x-www-form-urlencoded", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "path": "/wp-admin/admin-ajax.php", "payload_excerpt": "action=wordpot_smoke_test&file=http%3A%2F%2F169.254.169.254%2F", "payload_path": "/opt/wordpot/logs/payloads/43/43606b3cc424fae79a28f174576c575b6bd1377c9db10fad886e54c8c641dccd.bin", "payload_ref": "43/43606b3cc424fae79a28f174576c575b6bd1377c9db10fad886e54c8c641dccd.bin", "payload_sha256": "43606b3cc424fae79a28f174576c575b6bd1377c9db10fad886e54c8c641dccd", "payload_size": 62, "payload_stored": true, "profile_id": "maintenance-lag", "request_id": "4be4dedb-7d7d-46f8-9cfe-863a1e14f011", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 58816, "technique": "admin_ajax_action", "timestamp": "2026-06-19T14:43:40.181296+00:00", "url": "http://127.0.0.1/wp-admin/admin-ajax.php", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "2026/06/smoke.php", "component_type": "upload", "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"lure_params": {}}, "device_family": "Other", "headers_subset": {"Content-Type": "application/octet-stream", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "path": "/wp-content/uploads/2026/06/smoke.php", "payload_excerpt": "<?php echo 'smoke'; ?>", "payload_path": "/opt/wordpot/logs/payloads/43/43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5.bin", "payload_ref": "43/43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5.bin", "payload_sha256": "43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5", "payload_size": 22, "payload_stored": true, "profile_id": "maintenance-lag", "request_id": "ce00b440-82de-4ab3-ad34-9c1f938550be", "src_ip": "172.18.0.1", "src_port": 58830, "technique": "uploads_probe", "timestamp": "2026-06-19T14:43:40.182776+00:00", "url": "http://127.0.0.1/wp-content/uploads/2026/06/smoke.php", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "2026/06/smoke.php", "component_type": "upload", "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"lure_params": {}}, "device_family": "Other", "headers_subset": {"Content-Type": "application/octet-stream", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "path": "/wp-content/uploads/2026/06/smoke.php", "payload_excerpt": "<?php echo 'smoke'; ?>", "payload_path": "/opt/wordpot/logs/payloads/43/43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5.bin", "payload_ref": "43/43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5.bin", "payload_sha256": "43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5", "payload_size": 22, "payload_stored": true, "profile_id": "maintenance-lag", "request_id": "ce00b440-82de-4ab3-ad34-9c1f938550be", "response_status": 404, "src_ip": "172.18.0.1", "src_port": 58830, "technique": "upload_lure_payload", "timestamp": "2026-06-19T14:43:40.183017+00:00", "url": "http://127.0.0.1/wp-content/uploads/2026/06/smoke.php", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "admin-ajax.php", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"action": "wordpot_smoke_payload", "lure_params": {"file": "http://169.254.169.254/latest/meta-data/"}}, "device_family": "Other", "headers_subset": {"Content-Type": "application/x-www-form-urlencoded", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "path": "/wp-admin/admin-ajax.php", "payload_excerpt": "action=wordpot_smoke_payload&marker=wordpot-smoke-65bbf4440582444bb58b8bafec2b5a92&file=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2F", "payload_path": "/opt/wordpot/logs/payloads/f5/f5a7f7a433c6077951da7d9948507360457328474d4d1d97816efe60350128fd.bin", "payload_ref": "f5/f5a7f7a433c6077951da7d9948507360457328474d4d1d97816efe60350128fd.bin", "payload_sha256": "f5a7f7a433c6077951da7d9948507360457328474d4d1d97816efe60350128fd", "payload_size": 140, "payload_stored": true, "profile_id": "maintenance-lag", "request_id": "04749d9b-b408-4fe4-a88d-57dd78b0a4fb", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 58840, "technique": "admin_ajax_action", "timestamp": "2026-06-19T14:43:40.185410+00:00", "url": "http://127.0.0.1/wp-admin/admin-ajax.php", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "wp-json", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "device_family": "Other", "headers_subset": {"User-Agent": "wordpot-container-smoke/1.0"}, "method": "GET", "os_family": "Other", "path": "/wp-json/", "payload_size": 0, "payload_stored": false, "profile_id": "commerce", "request_id": "9c661322-d219-4a75-b7ba-e6b7ff1d9fe5", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 58588, "technique": "rest_index", "timestamp": "2026-06-19T14:46:40.850796+00:00", "url": "http://127.0.0.1/wp-json/", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "wp/v2/users", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "device_family": "Other", "headers_subset": {"User-Agent": "wordpot-container-smoke/1.0"}, "method": "GET", "os_family": "Other", "path": "/wp-json/wp/v2/users", "payload_size": 0, "payload_stored": false, "profile_id": "commerce", "request_id": "2c3414a9-b15a-4acf-a8c2-d97324556606", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 58590, "technique": "rest_user_enumeration", "timestamp": "2026-06-19T14:46:40.851982+00:00", "url": "http://127.0.0.1/wp-json/wp/v2/users", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "xmlrpc.php", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "device_family": "Other", "headers_subset": {"User-Agent": "wordpot-container-smoke/1.0"}, "method": "GET", "os_family": "Other", "path": "/xmlrpc.php", "payload_size": 0, "payload_stored": false, "profile_id": "commerce", "request_id": "4e3ccdcf-9de7-4e06-852b-1cf6dbae0d94", "response_status": 405, "src_ip": "172.18.0.1", "src_port": 58592, "technique": "xmlrpc_probe", "timestamp": "2026-06-19T14:46:40.853022+00:00", "url": "http://127.0.0.1/xmlrpc.php", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "wp-login.php", "component_type": "core", "credentials_observed": {"log": "admin", "pwd": "wordpot-smoke"}, "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"action": "login"}, "device_family": "Other", "headers_subset": {"Content-Type": "application/x-www-form-urlencoded", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "password": "wordpot-smoke", "path": "/wp-login.php", "payload_excerpt": "log=admin&pwd=wordpot-smoke", "payload_path": "/opt/wordpot/logs/payloads/35/353060c3378469891d882010b6c9410ba38094c1997750ae361061099447cc42.bin", "payload_ref": "35/353060c3378469891d882010b6c9410ba38094c1997750ae361061099447cc42.bin", "payload_sha256": "353060c3378469891d882010b6c9410ba38094c1997750ae361061099447cc42", "payload_size": 27, "payload_stored": true, "profile_id": "commerce", "request_id": "44902062-e3e2-443a-9904-d54226237cb7", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 58604, "technique": "credential_attempt", "timestamp": "2026-06-19T14:46:40.854206+00:00", "url": "http://127.0.0.1/wp-login.php", "user_agent": "wordpot-container-smoke/1.0", "username": "admin"} {"browser_family": "Other", "component_slug": "admin-ajax.php", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"action": "wordpot_smoke_test", "lure_params": {"file": "http://169.254.169.254/"}}, "device_family": "Other", "headers_subset": {"Content-Type": "application/x-www-form-urlencoded", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "path": "/wp-admin/admin-ajax.php", "payload_excerpt": "action=wordpot_smoke_test&file=http%3A%2F%2F169.254.169.254%2F", "payload_path": "/opt/wordpot/logs/payloads/43/43606b3cc424fae79a28f174576c575b6bd1377c9db10fad886e54c8c641dccd.bin", "payload_ref": "43/43606b3cc424fae79a28f174576c575b6bd1377c9db10fad886e54c8c641dccd.bin", "payload_sha256": "43606b3cc424fae79a28f174576c575b6bd1377c9db10fad886e54c8c641dccd", "payload_size": 62, "payload_stored": true, "profile_id": "commerce", "request_id": "7e4d4468-acca-4d1b-8d04-e71a3f59d257", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 58614, "technique": "admin_ajax_action", "timestamp": "2026-06-19T14:46:40.856988+00:00", "url": "http://127.0.0.1/wp-admin/admin-ajax.php", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "2026/06/smoke.php", "component_type": "upload", "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"lure_params": {}}, "device_family": "Other", "headers_subset": {"Content-Type": "application/octet-stream", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "path": "/wp-content/uploads/2026/06/smoke.php", "payload_excerpt": "<?php echo 'smoke'; ?>", "payload_path": "/opt/wordpot/logs/payloads/43/43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5.bin", "payload_ref": "43/43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5.bin", "payload_sha256": "43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5", "payload_size": 22, "payload_stored": true, "profile_id": "commerce", "request_id": "2c580532-7210-4f3c-84c5-142c41f6149e", "src_ip": "172.18.0.1", "src_port": 58626, "technique": "uploads_probe", "timestamp": "2026-06-19T14:46:40.858077+00:00", "url": "http://127.0.0.1/wp-content/uploads/2026/06/smoke.php", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "2026/06/smoke.php", "component_type": "upload", "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"lure_params": {}}, "device_family": "Other", "headers_subset": {"Content-Type": "application/octet-stream", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "path": "/wp-content/uploads/2026/06/smoke.php", "payload_excerpt": "<?php echo 'smoke'; ?>", "payload_path": "/opt/wordpot/logs/payloads/43/43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5.bin", "payload_ref": "43/43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5.bin", "payload_sha256": "43f446c1ce0a4d2ada84e7d80b7402543d4d861d85b54cb5aafe45818ca47cc5", "payload_size": 22, "payload_stored": true, "profile_id": "commerce", "request_id": "2c580532-7210-4f3c-84c5-142c41f6149e", "response_status": 404, "src_ip": "172.18.0.1", "src_port": 58626, "technique": "upload_lure_payload", "timestamp": "2026-06-19T14:46:40.858236+00:00", "url": "http://127.0.0.1/wp-content/uploads/2026/06/smoke.php", "user_agent": "wordpot-container-smoke/1.0"} {"browser_family": "Other", "component_slug": "admin-ajax.php", "component_type": "core", "dest_ip": "127.0.0.1", "dest_port": 80, "details": {"action": "wordpot_smoke_payload", "lure_params": {"file": "http://169.254.169.254/latest/meta-data/"}}, "device_family": "Other", "headers_subset": {"Content-Type": "application/x-www-form-urlencoded", "User-Agent": "wordpot-container-smoke/1.0"}, "method": "POST", "os_family": "Other", "path": "/wp-admin/admin-ajax.php", "payload_excerpt": "action=wordpot_smoke_payload&marker=wordpot-smoke-9f0af2d440e74da5825054f3ec7e72a9&file=http%3A%2F%2F169.254.169.254%2Flatest%2Fmeta-data%2F", "payload_path": "/opt/wordpot/logs/payloads/31/316dedec674be59be7f809d5aa67fed9d78dd8caad38940d048fb7b39d40d0bb.bin", "payload_ref": "31/316dedec674be59be7f809d5aa67fed9d78dd8caad38940d048fb7b39d40d0bb.bin", "payload_sha256": "316dedec674be59be7f809d5aa67fed9d78dd8caad38940d048fb7b39d40d0bb", "payload_size": 140, "payload_stored": true, "profile_id": "commerce", "request_id": "0d756331-fd70-484b-877f-c6ee78bcb6ee", "response_status": 200, "src_ip": "172.18.0.1", "src_port": 58628, "technique": "admin_ajax_action", "timestamp": "2026-06-19T14:46:40.860699+00:00", "url": "http://127.0.0.1/wp-admin/admin-ajax.php", "user_agent": "wordpot-container-smoke/1.0"}