One Day Sec

How do I find OpCodes with a response type of 2 in the Sophos XG Firewall database?

The original analysis incorrectly stated the field name; the correct query uses `requesttype = 2` instead of `responsetype`. Run the PostgreSQL command `psql -U pgrouser -d corporate -c "select opcode, mode, requesttype from tblcrevent where requesttype=2;"` to retrieve approximately 160 modes, including OpCodes for sensitive operations like `login`, `download_backup`, and `ccc_login`. This method is outlined in the Sophos XG Firewall Authentication Bypass Vulnerability (CVE-2022-1040) Exploitation Analysis.
OpCoderequesttypePostgreSQLtblcreventSophos XG Firewall

Browse all Q&A →