Re: PHP based defacing tool usage continue to rise

[Christopher Kunz <chrislist () de-punkt de>]

Hi,

we're seeing stuff like this too - only that it's "Defacing Tool 2.5" here. I
got my fingers on a copy and it's pretty basic yet kinda comfortable. Something
like Plesk for Blackhats.

If someone needs a phone-home free version of the tool for forensics or IDS
purposes, I have a tarball lying around.

In the meantime, setting a mod_security filter for "tool25" worked pretty well
for us, without any false negatives.

Regards,

--ck

-- 
http://www.de-punkt.de   [ chris () de-punkt de ]    http://www.stormix.de
PHP-Anwendungen sind gefährdet! SQL-Injection, XSS, Session-Angriffe,
CSRF, Commandshells, Response Splitting,... böhmische Dörfer? Dann gleich
"PHP-Sicherheit" direkt beim Verlag vorbestellen! http://www.php-sicherheit.de/

-------------------------------------------------------------------------
This List Sponsored by: Watchfire

Watchfire's AppScan is the industry's first and leading web application 
security testing suite, and the only solution to provide comprehensive 
remediation tasks at every level of the application. See for yourself. 
Download AppScan 6.0 today.

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
--------------------------------------------------------------------------