Re: Advisory 2006-03-12 Gay Slut Overflow CRITICAL dismallest in Immunitysec Dave Aitel

[Michael Mohr <m.mohr () laposte net>]

The messages all had a Received header with www.c0replay.net in it.  In addition, they all had the same types of 
subject lines.  So it was an easy task to filter by the header and quickly scan the subject lines while mass-deleting.  
This is no reason to have the list moderated.

On Sun, 12 Mar 2006 16:58:18 -0500
"Stan Bubrouski" <stan.bubrouski () gmail com> wrote:

> Not to mention all the messages come through www.c0replay.net assuming
> that part of the headersare accurate.  If you'll recall the same
> domain was used to spoof a message from Steven Rakick on March 4th. 
> Seems some little kiddie in the UK (assumption warning!) is going to
> be paying some fines.  I wouldn't exactly call it smart to slander
> dozens of people... and moderation has never seemed more necessary.
>
> -sb
>
> On 3/12/06, Nicob <nicob () nicob net> wrote:
> > Le dimanche 12 mars 2006 à 01:08 -0800, dismallest dismallest a écrit :
> > > APPENDIX B. - References
> > > http://bantown.com/banforge/release.rar
> >
> > http://bantown.com/ : "Our website was recently hacked [...]"
> >
> > and
> >
> > http://64.233.179.104/search?q=cache:1F21krhKFHEJ:bantown.com/banforge/
> >
> > Index of /banforge
> >
> >  Parent Directory         23-Feb-2006 22:51      -
> >  BPL.txt                  20-Aug-2005 15:08     4k
> >  LJiggaboo1.0.1rc2.tgz    21-Jan-2006 13:10   142k
> >  Ljflooder2.pl            07-Aug-2005 05:07     5k
> >  PhpBBreg-FIXEDLOL.py     08-Aug-2005 23:11     1k
> >  banbot.pl                16-Aug-2005 11:36    15k
> >  fla.sh                   16-Aug-2005 11:22     2k
> >  flu.shot                 19-Aug-2005 11:04     3k
> >  gaffler3.tar.gz          09-Aug-2005 02:30   123k
> >  phpBBroke-0.1.tar.gz     09-Oct-2005 13:35   383k
> >  phpBBroke/               27-Sep-2005 16:47      -
> >  phpbb_captcha.c          24-Jan-2006 03:16    21k
> >  pw-lolercaust-0.2.tar.gz 10-Oct-2005 03:38     2k
> >  rsshithead.tgz
> >
> >
> > Nicob
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/