# C2 and Exploitation Paths Observed

# PLI-AS (AS51852)
/api/trpc/setup.setup -- tRPC setup endpoint targeting, POST with JSON body, port 3000
/wp-login.php -- WordPress credential enumeration, TLS, Go-http-client/1.1

# HOSTKEY (AS57043)
/ISAPI/Streaming/channels/10101 -- Hikvision camera streaming, RTSP DESCRIBE, Basic auth credential stuffing
/Streaming/Channels/10201 -- Hikvision camera streaming (alternate path)

# KPRONET (AS214940)
/.git/HEAD -- Git repository discovery, secret harvesting
/.git/index -- Git index file enumeration
/.git/config -- Git remote configuration extraction
/.env -- Environment file exfiltration (database creds, API keys, secrets)

# From prior week, still relevant:
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- PHPUnit RCE
/dana-na/auth/url_default/welcome.cgi -- Pulse Secure VPN
/global-protect/login.esp -- Palo Alto GlobalProtect
/sslvpnLogin.html -- SSL VPN portal enumeration
/guacamole/ -- Apache Guacamole RDP gateway probing