tool

Havij S0224

Type: tool
Created: 18 April 2018
Last modified: 25 April 2025

Havij is an automatic SQL Injection tool distributed by the Iranian ITSecTeam security company. Havij has been used by penetration testers and adversaries. [1]

TechniqueBottom 5%

TacticBottom 6%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0224

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic identifies access to the /api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark endpoint, which is associated with CVE-2023-46805 and CVE-2024-21887 vulnerabilities. (...)	Generic	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2024-21887 CVE-2023-46805 CVE-2023-46085	medium	Michael Haag, Splunk	2024-01-17	2026-05-13	15838756-f425-43fa-9d88-a7f88063e81a
Splunk	The following analytic detects potential exploitation attempts against Adobe ColdFusion vulnerabilities CVE-2023-29298 and CVE-2023-26360. (...)	Anomaly	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-29298 CVE-2023-26360	medium	Michael Haag, Splunk	2023-08-23	2026-05-13	d6821c0b-fcdc-4c95-a77f-e10752fae41a
Splunk	The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read. (...)	Anomaly	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-26360	medium	Michael Haag, Splunk	2023-08-23	2026-05-13	695aceae-21db-4e7f-93ac-a52e39d02b93
	Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSel (...)	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2021-40539	high	Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems)	2021-09-20	2023-01-02	6702b13c-e421-44cc-ab33-42cc25570f11
	Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective	Emerging	test	process_creation	linux	Sysmon	Initial Access Exploit Public-Facing Application	CVE-2014-6287 CVE-2022-33891	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-20	—	c8a5f584-cdc8-42cc-8cce-0398e4265de3
	Detects attempts to exploit an apache spark server via CVE-2014-6287 from a weblogs perspective	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2014-6287 CVE-2022-33891	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-19	2023-01-02	1a9a04fd-02d1-465c-abad-d733fd409f9c
	Detects an issue in apache logs that reports threading related errors	Generic	test	-	-	Apache	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services	-	medium	Florian Roth (Nextron Systems)	2019-01-22	2021-11-27	e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c
	Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2021-20091 CVE-2021-20090	critical	Bhabesh Raj	2021-08-24	2023-01-02	f0500377-bc70-425d-ac8c-e956cd906871
	Detects attempts to exploit the Atlassian Bitbucket Command Injection CVE-2022-36804	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2022-36804	high	Nasreddine Bencherchali (Nextron Systems)	2022-09-29	2023-01-02	65c0a0ab-d675-4441-bd6b-d3db226a2685
	Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate suc (...)	Emerging	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Initial Access Exploit Public-Facing Application	CVE-2022-26134	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-03	—	7fb14105-530e-4e2e-8cfb-99f7d8700b66
	Detects suspicious requests to Cisco ASA WebVpn via proxy logs associated with CVE-2025-20333 and CVE-2025-20362 exploitation.	Emerging	experimental	proxy	-	-	Initial Access Exploit Public-Facing Application	CVE-2025-20362 CVE-2025-20333	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-20	—	15697955-6a29-47ca-92e9-0e05efae3260
	Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452 with a status code o (...)	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2020-3452	high	Florian Roth (Nextron Systems)	2021-01-07	2023-01-02	aba47adc-4847-4970-95c1-61dce62a8b29
Splunk	The following analytic identifies the potential exploitation of the Cisco IOS XE vulnerability, CVE-2023-20198, in the Web User Interface. (...)	Generic	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-20198	medium	Michael Haag, Splunk	2023-10-17	2026-05-13	07c36cda-6567-43c3-bc1a-89dff61e2cd9
Splunk	This analytic detects Cisco IOS-XE "request platform software package describe" commands containing suspicious shell-style filename patterns. (...)	Generic	stable	network_device	-	Cisco IOS · Cisco	Execution Command and Scripting Interpreter Initial Access Exploit Public-Facing Application	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	a113a8be-7386-46e0-a079-d9fd46f9631f
Splunk	This analytic detects Cisco IOS-XE WebUI authentication failure and success logs that include local port 21111. (...)	Generic	stable	network_device	-	Cisco IOS · Cisco	Initial Access Exploit Public-Facing Application Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-19	77a1751f-552f-456c-b9ae-cdb66eec3e42
Splunk	The following analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process.	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Initial Access Exploit Public-Facing Application Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali	2026-05-19	2026-09-08	f9686576-a23d-4c4d-bfad-a45499dc448a
Splunk	This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin. (...)	Generic	stable	network_connection	-	Cisco NVM · Cisco	Initial Access Exploit Public-Facing Application Command and Control Ingress Tool Transfer	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	1984f997-3b49-4d4b-a7e9-dc5dbf88370e
Splunk	This analytic detects a exploitation activity attempts of targeting Cisco Catalyst SD-WAN Manager. (...)	Generic	stable	network_device	-	Cisco	Initial Access Exploit Public-Facing Application	CVE-2026-20122 CVE-2026-20128 CVE-2026-20127	medium	Nasreddine Bencherchali, Splunk	2026-03-12	2026-05-13	2f3862c6-45ff-4a02-9bd4-7e25c209fcd9
Splunk	This analytic identifies low-frequency Cisco SD-WAN control peering activity from control-connection-state-change events where "new-state:up". (...)	Anomaly	stable	network_device	-	Cisco	Initial Access Exploit Public-Facing Application	CVE-2026-20127	medium	Nasreddine Bencherchali, Splunk	2026-03-03	2026-05-13	0fe052a5-07b8-48e7-9fc8-d6a3957eb914
Splunk	This analytic detects Cisco SD-WAN `control-connection-state-change` events where a control connection transitions. (...)	Hunting	stable	network_device	-	Cisco	Initial Access Exploit Public-Facing Application	CVE-2026-20127	medium	Nasreddine Bencherchali, Splunk	2026-03-03	2026-05-13	1d192a47-4bd3-4c06-902d-5dbe2375ec6d
Splunk	This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Initial Access Exploit Public-Facing Application Execution Exploitation for Client Execution Credential Access OS Credential Dumping Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	ec99bb81-c31b-4837-8c7d-1b32aa70b337
Splunk	This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Stealth Obfuscated Files or Information Execution User Execution	-	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	96bce783-c22e-4e48-8cf1-3eb2794c5083
Splunk	This correlation rule identifies potential exploitation attempts of Oracle E-Business Suite vulnerabilities (CVE-2025-61882 and CVE-2025-61884) by correlating multiple intrusion signatures from Cisco Secure Firewall Threat Defense logs. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application	CVE-2025-61882 CVE-2025-61884	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	9e995d21-6870-43de-acd9-76f372bcf323
Splunk	This analytic detects vulnerability exploitation and post-compromise activity associated with Oracle E-Business Suite web-application vulnerabilities, CVE-2025-61882 and CVE-2025-61884. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application	CVE-2025-61882 CVE-2025-61884	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	1c077b8a-95a3-4692-980d-c72fc50e9930
Splunk	This analytic detects exploitation activity of CVE-2025-55182 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Initial Access Exploit Public-Facing Application	CVE-2025-55182 CVE-2025-66478	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-07-17	2026-05-13	d36459b1-7901-401a-a67e-44426c15b168
Splunk	This analytic detects activity associated with "Static Tundra" threat actor abuse of the Cisco Smart (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Impact Endpoint Denial of Service Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services	-	medium	Bhavin Patel, Michael Haag, Splunk	2025-04-16	2026-05-13	7e9a5a2c-2f1a-4b6a-9a4b-9e7d9c8f5a21
Splunk	This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Credential Access OS Credential Dumping LSASS Memory	CVE-2023-27532	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
Splunk	This analytic detects oversized Cisco Smart Install (SMI) protocol messages by inspecting traffic to (...)	Generic	stable	network_connection	-	Splunk Stream TCP	Initial Access Exploit Public-Facing Application	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	3b8d2b4f-4e1e-4a9e-9b43-8a7a3a9c7e21
Splunk	This analytic detects network traffic to TCP port 4786, which is used by the Cisco Smart Install protocol. (...)	Generic	stable	network_connection	-	Splunk Stream TCP	Initial Access Exploit Public-Facing Application	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	ded9f9d7-edb8-48cf-8b72-1b459eee6785
Splunk	This detection identifies potential exploitation attempts of CVE-2025-5777 (CitrixBleed 2), a memory disclosure vulnerability in Citrix NetScaler ADC and Gateway. (...)	Anomaly	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2025-5777	medium	Michael Haag, Splunk	2025-07-02	2026-05-13	bef92f3f-7dc8-413a-8989-50581039e250
Splunk	The following analytic detects attempts to exploit the Citrix Bleed vulnerability (CVE-2023-4966), which can lead to the leaking of session tokens. (...)	Generic	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-4966	medium	Michael Haag, Splunk	2023-10-24	2026-05-13	b593cac5-dd20-4358-972a-d945fefdaf17
Splunk	The following analytic identifies potential exploitation attempts against Citrix ADC related to CVE-2023-3519. (...)	Hunting	stable	webserver	-	Palo Alto	Initial Access Exploit Public-Facing Application	CVE-2023-3519	medium	Michael Haag, Splunk	2023-07-21	2026-09-01	76ac2dcb-333c-4a77-8ae9-2720cfae47a8
	Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Cit (...)	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2020-8196 CVE-2020-8195 CVE-2020-8193	critical	Florian Roth (Nextron Systems)	2020-07-10	2023-01-02	0d0d9a8a-a49e-4e27-b061-7ce4b936cfb7
	Detects CVE-2019-19781 exploitation attempt against Citrix Netscaler, Application Delivery Controlle (...)	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2019-19781	critical	Arnim Rupp, Florian Roth	2020-01-02	2023-01-02	ac5a6409-8c89-44c2-8d64-668c29a2d756
Splunk	The following analytic detects potentially malicious file upload attempts to Citrix ShareFile via specific suspicious URLs and the HTTP POST method. (...)	Hunting	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-24489	medium	Michael Haag, Splunk	2023-07-26	2026-05-13	172c59f2-5fae-45e5-8e51-94445143e93f
	Detects the use of argument injection in the Commvault qlogin command - potential exploitation for CVE-2025-57791. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Exploit Public-Facing Application	CVE-2025-57791	high	X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)	2025-10-20	—	ff0225a0-1d9a-4bae-ab26-6038b18bb6d4
Splunk	The following analytic identifies potential exploitation attempts of the Confluence CVE-2023-22515 vulnerability. (...)	Generic	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-22515	medium	Michael Haag, Splunk	2023-10-04	2026-05-13	630ea8b2-2800-4f5d-9cbc-d65c567349b0
Splunk	The following analytic identifies potential exploitation attempts on a known vulnerability in Atlassian Confluence, specifically targeting the /setup/.action URL pattern. (...)	Generic	stable	webserver	-	Nginx	Initial Access Exploit Public-Facing Application	CVE-2023-22518 CVE-2023-22515	medium	Michael Haag, Splunk	2023-10-04	2026-05-13	115bebac-0976-4f7d-a3ec-d1fb45a39a11
	Detects the exploitation of the Confluence vulnerability described in CVE-2019-3398	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2019-3398	critical	Florian Roth (Nextron Systems)	2020-05-26	2023-01-02	e9bc39ae-978a-4e49-91ab-5bd481fc668b
Splunk	The following analytic identifies attempts to exploit a critical template injection vulnerability (CVE-2023-22527) in outdated Confluence Data Center and Server versions. (...)	Generic	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2023-22527	medium	Michael Haag, Splunk	2024-01-24	2026-05-13	f56936c0-ae6f-4eeb-91ff-ecc1448c6105
Splunk	The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence. (...)	Generic	stable	webserver	-	Palo Alto	Initial Access Exploit Public-Facing Application Initial Access, Persistence External Remote Services Persistence Server Software Component	CVE-2022-26134	medium	Michael Haag, Splunk	2022-06-03	2026-05-13	fcf4bd3f-a79f-4b7a-83bf-2692d60b859c
Splunk	The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows attackers to bypass authentication via an alternate path or channel. (...)	Generic	stable	webserver	-	Suricata	Initial Access Exploit Public-Facing Application	CVE-2024-1709 CVE-2024-1708	medium	Michael Haag, Splunk	2024-02-22	2026-05-13	d3f7a803-e802-448b-8eb2-e796b223bfff
Splunk	The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability, which allows path traversal attacks by manipulating file_path and file_name parameters in the URL. (...)	Generic	stable	file_event	windows	Sysmon	Initial Access Exploit Public-Facing Application	CVE-2024-1709 CVE-2024-1708	medium	Michael Haag, Splunk	2024-02-22	2026-05-13	56a3ac65-e747-41f7-b014-dff7423c1dda
Splunk	The following analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1708 vulnerability using Windows SACL EventCode 4663. (...)	Generic	stable	file_event	windows	WinEventLog Security	Initial Access Exploit Public-Facing Application	CVE-2024-1709 CVE-2024-1708	medium	Michael Haag, Splunk	2024-02-22	2026-05-13	4e127857-1fc9-4c95-9d69-ba24c91d52d7
Splunk	The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)	Generic	stable	file_event	-	CrushFTP	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2025-31161	medium	Michael Haag, Splunk	2025-04-14	2026-09-08	82eb7f64-d219-4e21-acfe-956de84c1a35
Splunk	This analytic is designed to identify attempts to exploit a server-side template injection vulnerability in CrushFTP, designated as CVE-2024-4040. (...)	Generic	stable	file_event	-	CrushFTP	Initial Access Exploit Public-Facing Application	CVE-2024-4040	medium	Michael Haag, Splunk	2024-06-05	2026-05-13	ccf6b7a3-bd39-4bc9-a949-143a8d640dbc
	MODx manager - Local File Inclusion:Directory traversal vulnerability in manager/controllers/default (...)	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2010-5278	critical	Subhash Popuri (@pbssubhash)	2021-08-25	2023-01-02	a4a899e8-fd7a-49dd-b5a8-7044def72d61
	Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2020-0688	critical	Florian Roth (Nextron Systems)	2020-02-29	2023-01-02	fce2c2e2-0fb5-41ab-a14c-5391e1fd70a5
	Detects CVE-2020-0688 Exploitation attempts	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application	CVE-2020-0688	high	NVISO	2020-02-27	2023-01-02	7c64e577-d72e-4c3d-9d75-8de6d1f9146a
	Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688	Emerging	test	-	windows	WinEventLog Application	Initial Access Exploit Public-Facing Application	CVE-2020-0688 CVE-2021-24085 CVE-2020-16875	high	Florian Roth (Nextron Systems), wagga	2020-02-29	2022-12-25	d6266bf5-935e-4661-b477-78772735a7cb

Title

Description

Havij S0224

Havij MITRE reference S0224

Standing S0224

Reach

Coverage

Havij detections S0224