
Webshells Hiding in .well-known Places
Ever so often, I see requests for files in .well-known recorded by our honeypots. As an example: GET /.well-known/xin1.php?p Host: [honeypot host name] The file names indicate that they are likely looking for webshells. In my opinion, the reason they are looking in .well-known is that this makes a decent place to…