Assuming that my Weblogic server is compromised by this vulnerability, what would the traffic pattern look like?
I'm assuming I would see HTTP requests attempting to make connections directly from WebLogic back to the Internet. Could someone provide insight? It is possible that I would see t3 traffic? I don't think an exploited server would attempt to communicate back out using t3.