[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[WEB SECURITY] What's going on about Pangolin

------=_Part_35_32403336.1206563338627
Content-Type: multipart/alternative; 
	boundary="----=_Part_34_5102872.1206563338626"

------=_Part_34_5102872.1206563338626
Content-Type: text/plain; charset="GB2312"
Content-Transfer-Encoding: 8bit

I've just read the discussion from here, seriously, I don't know what's going on. <p><p>I've coded it since 2005 and never release it until this year. And I really do not know why it be treated as a backdoor. <p><p>If you think it is a backdoor, so please do a reverse engineering on it. You can capture the network packet, you can list all the strings in it, even you can hook APIs in it. Do anything you like to make sure whether it's backdoor or not. <p><p>BTW, I packeted it through UPX to reduce the size. And some people focused on "http://www.nosec.org/web/index.txt";, which is used in ORACLE injection mode when the target database is in intranet so we can use some store-procs to make the target to visit our website then we can receive the internet address that is mapped to outside. Anybody who is good at oracle injection should know this.<p><p>Really, I wanna know why!!! 
------=_Part_34_5102872.1206563338626
Content-Type: text/html
Content-Transfer-Encoding: 8bit

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=GB2312"></head>
<body>
<!--SOHUMAIL_HTML_HEAD_END-->I've just read the discussion from here, seriously, I don't know what's going on. <p><p>I've coded it since 2005 and never release it until this year. And I really do not know why it be treated as a backdoor. <p><p>If you think it is a backdoor, so please do a reverse engineering on it. You can capture the network packet, you can list all the strings in it, even you can hook APIs in it. Do anything you like to make sure whether it's backdoor or not. <p><p>BTW, I packeted it through UPX to reduce the size. And some people focused on "http://www.nosec.org/web/index.txt";, which is used in ORACLE injection mode when the target database is in intranet so we can use some store-procs to make the target to visit our website then we can receive the internet address that is mapped to outside. Anybody who is good at oracle injection should know this.<p><p>Really, I wanna know why!!! <br><br><div class="idiograph" style="border:0px #A74A1E solid"><div class="w290"><div class="w134"></div><div class="w156"></div><div class="clear"></div></div></div><hr size=1><style type="text/css">
<!--
a {font-size:12px;color:black}
a:hover {font-size:12px;text-decoration:underline}
.b{font-family:Arial; font-size:80%; margin-bottom:2px;color:#0000CC}
.pp{font-family:Arial;font-size:10px}
-->
</style>
<table border=0>
<tr><td height=18>
<a href="http://doc.go.sohu.com/200802/5e1b674ab8183f3db8baba8ee4c6dd53.php";  target=_blank>2008年薪水翻倍技巧</a>
<tr><td height=18><a href="http://goto.mail.sohu.com/goto.php3?code=mailadt-ta"; target="_blank">*用搜狗拼音写邮件，体验更流畅的中文输入>></a>
</td></tr>
</table>
<!--SOHUMAIL_HTML_TAIL_END--></body>
</html>
------=_Part_34_5102872.1206563338626--

------=_Part_35_32403336.1206563338627--
Brought to you by http://www.webappsec.org
Search this site