Hillstone Networks

'; } else{ echo ''; } echo 'Hillstone Networks'; } elseif ($_SERVER[HTTP_HOST] == "update1.huaantech.com.cn") { echo ''; echo 'huaantech'; } elseif ($_SERVER[HTTP_HOST] == "update1.dcnetworks.com.cn") { echo ''; echo 'dcnetworks'; } elseif ($_SERVER[HTTP_HOST] == "update1.w-ibeda.com") { if (false===strpos($_SERVER[REQUEST_URI],"/en/")) echo ''; else echo ''; echo 'w-ibeda'; } elseif ($_SERVER[HTTP_HOST] == "update1.hp-telecom.com") { echo ''; echo 'hp-telecom'; } elseif ($_SERVER[HTTP_HOST] == "update1.maipu.com") { echo ''; echo 'Maipu'; } elseif ($_SERVER[HTTP_HOST] == "update1.ncurity.com") { echo ''; echo 'Ncurity'; } elseif ($_SERVER[HTTP_HOST] == "update1.socusnetwork.com") { echo ''; echo 'Socusnetwork'; } else{ echo ''; echo 'Hillstone Networks'; } ?>

RULE（RULE ID：339588）

Rule General Information


Release Date:		2025-11-04

Rule Name:		Scanner W3af Detection

Severity:

CVE ID:

Rule Protection Details


Description:		w3af is an open-source Python-based web application vulnerability scanner that integrates vulnerability detection, exploit modules, and automated scanning capabilities to identify security flaws such as SQL injection, XSS, and file inclusion. This rule detects scanning characteristics of w3af.

Impact:		Attackers use scanners to scan targets, may find vulnerabilities in the target system, resulting in system information leakage, and then attack the system to obtain system permissions.

Affected OS:		Windows, Linux, Others

Reference:

Solutions

1. If it is determined that there is scanning behavior from an unknown IP address, it is recommended to block the IP address immediately. 2. Make sure that the file system permissions of Web servers and applications are set properly to limit access to sensitive files and directories. 3. Ensure that the system and applications have been updated to the latest version, and fix known vulnerabilities to reduce the impact on the system.