1. 接口描述
接口请求域名： cwp.tencentcloudapi.com 。
查询应用防护白名单攻击类型列表
默认接口请求频率限制：20次/秒。
推荐使用 API Explorer
点击调试
API Explorer 提供了在线调用、签名验证、SDK 代码生成和快速检索接口等能力。您可查看每次调用的请求内容和返回结果以及自动生成 SDK 调用示例。
2. 输入参数
以下请求参数列表仅列出了接口请求参数和部分公共参数，完整公共参数列表见 公共请求参数。
| 参数名称 | 必选 | 类型 | 描述 |
|---|---|---|---|
| Action | 是 | String | 公共参数，本接口取值：DescribeAttackType。 |
| Version | 是 | String | 公共参数，本接口取值：2018-02-28。 |
| Region | 否 | String | 公共参数，此参数为可选参数。 |
| Filters.N | 是 | Array of Filter | 过滤条件。 示例值：[{"Source":"Name","Values":["rasp"]}] |
| Limit | 否 | Integer | 返回数量，默认为10，最大值为1000。 示例值：100 |
| Offset | 否 | Integer | 偏移量，默认为0。 示例值：0 |
| By | 否 | String | 排序字段，目前有：Id，默认按照Id排序，可以不传 示例值：Id |
| Order | 否 | String | 排序升序还是倒序，DESC有ASC、 示例值：ASC |
3. 输出参数
| 参数名称 | 类型 | 描述 |
|---|---|---|
| List | Array of RaspAttackTypeListItem | 列表内容 |
| TotalCount | Integer | 总条数 示例值：1 |
| RequestId | String | 唯一请求 ID，由服务端生成，每次请求都会返回（若请求因其他原因未能抵达服务端，则该次请求不会获得 RequestId）。定位问题时需要提供该次请求的 RequestId。 |
4. 示例
示例1 查询应用防护白名单攻击类型列表
输入示例
POST / HTTP/1.1
Host: cwp.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeAttackType
<公共请求参数>
{
"Filters": [
{
"Name": "Keywords",
"Values": [
"sda"
]
}
]
}输出示例
{
"Response": {
"List": [
{
"AttackTypeID": 18,
"AttackTypeName": "JSTL任意文件包含",
"Source": "rasp"
},
{
"AttackTypeID": 34,
"AttackTypeName": "高危方法调用",
"Source": "rasp"
},
{
"AttackTypeID": 33,
"AttackTypeName": "WebShell 后门",
"Source": "rasp"
},
{
"AttackTypeID": 31,
"AttackTypeName": "IP/URL阻断",
"Source": "rasp"
},
{
"AttackTypeID": 30,
"AttackTypeName": "恶意反射调用",
"Source": "rasp"
},
{
"AttackTypeID": 29,
"AttackTypeName": "SQL注入",
"Source": "rasp"
},
{
"AttackTypeID": 28,
"AttackTypeName": "内存马注入",
"Source": "memshell_inject"
},
{
"AttackTypeID": 27,
"AttackTypeName": "恶意Attach",
"Source": "rasp"
},
{
"AttackTypeID": 26,
"AttackTypeName": "恶意外链",
"Source": "rasp"
},
{
"AttackTypeID": 25,
"AttackTypeName": "引擎注入",
"Source": "rasp"
},
{
"AttackTypeID": 24,
"AttackTypeName": "XML实体注入",
"Source": "rasp"
},
{
"AttackTypeID": 23,
"AttackTypeName": "恶意DNS查询",
"Source": "rasp"
},
{
"AttackTypeID": 22,
"AttackTypeName": "JNI注入",
"Source": "rasp"
},
{
"AttackTypeID": 21,
"AttackTypeName": "恶意类加载",
"Source": "rasp"
},
{
"AttackTypeID": 20,
"AttackTypeName": "危险协议使用",
"Source": "rasp"
},
{
"AttackTypeID": 19,
"AttackTypeName": "线程注入",
"Source": "rasp"
},
{
"AttackTypeID": 17,
"AttackTypeName": "表达式注入",
"Source": "rasp"
},
{
"AttackTypeID": 16,
"AttackTypeName": "HTTP信息获取",
"Source": "rasp"
},
{
"AttackTypeID": 15,
"AttackTypeName": "命令执行",
"Source": "rasp"
},
{
"AttackTypeID": 14,
"AttackTypeName": "JNDI注入",
"Source": "rasp"
},
{
"AttackTypeID": 13,
"AttackTypeName": "恶意文件读写",
"Source": "rasp"
},
{
"AttackTypeID": 12,
"AttackTypeName": "任意文件删除",
"Source": "rasp"
},
{
"AttackTypeID": 11,
"AttackTypeName": "目录遍历",
"Source": "rasp"
},
{
"AttackTypeID": 10,
"AttackTypeName": "恶意文件上传",
"Source": "rasp"
},
{
"AttackTypeID": 9,
"AttackTypeName": "任意文件读取",
"Source": "rasp"
},
{
"AttackTypeID": 36,
"AttackTypeName": "XPath注入漏洞",
"Source": "rasp"
},
{
"AttackTypeID": 37,
"AttackTypeName": "URL 重定向漏洞",
"Source": "rasp"
},
{
"AttackTypeID": 38,
"AttackTypeName": "其他类型反序列化漏洞",
"Source": "rasp"
},
{
"AttackTypeID": 39,
"AttackTypeName": "JDBC漏洞",
"Source": "rasp"
},
{
"AttackTypeID": 40,
"AttackTypeName": "规则模式",
"Source": "rasp"
},
{
"AttackTypeID": 41,
"AttackTypeName": "扫描器检测",
"Source": "rasp"
},
{
"AttackTypeID": 52,
"AttackTypeName": "Spring 框架反射型文件下载漏洞 (CVE-2020-5421)",
"Source": "rasp"
},
{
"AttackTypeID": 44,
"AttackTypeName": "Apache Flink 任意文件读取漏洞 (CVE-2020-17519)",
"Source": "rasp"
},
{
"AttackTypeID": 43,
"AttackTypeName": "Openfire 身份认证绕过漏洞(CVE-2023-32315)",
"Source": "rasp"
},
{
"AttackTypeID": 45,
"AttackTypeName": "GeoServer Jiffle 远程代码执行漏洞(CVE-2022-24816)",
"Source": "rasp"
},
{
"AttackTypeID": 46,
"AttackTypeName": "OpenTSDB 命令注入漏洞（CVE-2020-35476）",
"Source": "rasp"
},
{
"AttackTypeID": 47,
"AttackTypeName": "Bitbucket Server 命令注入漏洞（CVE-2022-36804）",
"Source": "rasp"
},
{
"AttackTypeID": 48,
"AttackTypeName": "Atlassian Crowd和Atlassian Crowd Data Center 输入验证错误漏洞(CVE-2019-11580)",
"Source": "rasp"
},
{
"AttackTypeID": 49,
"AttackTypeName": "Apache Tomcat拒绝服务漏洞（CVE-2020-13935）",
"Source": "rasp"
},
{
"AttackTypeID": 50,
"AttackTypeName": "Atlassian Confluence Data Center and Server 访问控制漏洞(CVE-2023-22515)",
"Source": "rasp"
},
{
"AttackTypeID": 51,
"AttackTypeName": "Atlassian Confluence Data Center and Server 权限绕过漏洞(CVE-2023-22518)",
"Source": "rasp"
},
{
"AttackTypeID": 1,
"AttackTypeName": "Log4shell漏洞",
"Source": "rasp"
},
{
"AttackTypeID": 42,
"AttackTypeName": "JetBrains TeamCity 安全漏洞",
"Source": "rasp"
},
{
"AttackTypeID": 35,
"AttackTypeName": "Springboot Actuator未授权访问漏洞",
"Source": "rasp"
},
{
"AttackTypeID": 32,
"AttackTypeName": "Tomcat AJP 任意文件读取/包含漏洞（CVE-2020-1938）",
"Source": "rasp"
},
{
"AttackTypeID": 8,
"AttackTypeName": "Apache Kafka Connect JNDI注入漏洞",
"Source": "rasp"
},
{
"AttackTypeID": 7,
"AttackTypeName": "Spring4Shell远程代码执行漏洞(CVE-2022-22965)",
"Source": "rasp"
},
{
"AttackTypeID": 6,
"AttackTypeName": "Apache RocketMQ远程代码执行漏洞（CVE-2023-33246）",
"Source": "rasp"
},
{
"AttackTypeID": 5,
"AttackTypeName": "Jenkins Remoting任意文件读取漏洞",
"Source": "rasp"
},
{
"AttackTypeID": 4,
"AttackTypeName": "Java反序列化漏洞",
"Source": "rasp"
},
{
"AttackTypeID": 3,
"AttackTypeName": "XStream反序列化漏洞",
"Source": "rasp"
},
{
"AttackTypeID": 2,
"AttackTypeName": "FastJson反序列化漏洞",
"Source": "rasp"
}
],
"RequestId": "21342534-5a16-40e1-8f59-60d2f378ee7d",
"TotalCount": 52
}
}5. 开发者资源
腾讯云 API 平台
腾讯云 API 平台 是综合 API 文档、错误码、API Explorer 及 SDK 等资源的统一查询平台，方便您从同一入口查询及使用腾讯云提供的所有 API 服务。
API Inspector
用户可通过 API Inspector 查看控制台每一步操作关联的 API 调用情况，并自动生成各语言版本的 API 代码，也可前往 API Explorer 进行在线调试。
SDK
云 API 3.0 提供了配套的开发工具集（SDK），支持多种编程语言，能更方便的调用 API。
- Tencent Cloud SDK 3.0 for Python: CNB, GitHub, Gitee
- Tencent Cloud SDK 3.0 for Java: CNB, GitHub, Gitee
- Tencent Cloud SDK 3.0 for PHP: CNB, GitHub, Gitee
- Tencent Cloud SDK 3.0 for Go: CNB, GitHub, Gitee
- Tencent Cloud SDK 3.0 for Node.js: CNB, GitHub, Gitee
- Tencent Cloud SDK 3.0 for .NET: CNB, GitHub, Gitee
- Tencent Cloud SDK 3.0 for C++: CNB, GitHub, Gitee
- Tencent Cloud SDK 3.0 for Ruby: CNB, GitHub, Gitee
命令行工具
6. 错误码
以下仅列出了接口业务逻辑相关的错误码，其他错误码详见 公共错误码。
| 错误码 | 描述 |
|---|---|
| InternalError | 内部错误。 |
| InvalidParameter | 参数错误。 |
| InvalidParameter.DateRange | 时间区间格式错误。 |
| InvalidParameter.IllegalRequest | 非法请求。 |
| InvalidParameter.InvalidFormat | 参数格式错误。 |
| InvalidParameter.MissingParameter | 参数缺失。 |
| InvalidParameter.ParsingError | 参数解析错误。 |
| InvalidParameter.RegexRuleError | 正则参数格式错误。 |
| InvalidParameterValue | 参数取值错误。 |
| LimitExceeded.AreaQuota | 超出批量添加数量。 |
| MissingParameter | 缺少参数错误。 |
| ResourceNotFound | 资源不存在。 |
