{ "name": "webbackdoor", "author": "Aung Khant, http://yehg.net", "version": "0.1", "description": "Detect common web doors (asp,jsp,php,jsp,pl,cgi) using fuzz-db list and others", "website": null, "matches": [ { "string": "michaeldaw.org backdoor collection", "text": "" }, { "string": "backdoor kit collection", "text": "" }, { "string": "jsp-reverse.jsp", "regexp": "(?-mix:

JSP Backdoor Reverse Shell<\\/h1>)" }, { "string": "browser.jsp", "url": "browser.jsp", "regexp": "(?-mix:|jsp File Browser version)" }, { "string": "cmd.jsp", "url": "cmd.jsp", "tagpattern": "html,body,form,input,input,/form,pre,/pre,/body,/html" }, { "string": "cmd.jsp", "url": "cmd.jsp", "regexp": "(?-mix:
(\\r\\n|\\n)(\\r\\n|\\n))" }, { "string": "cmdjsp.jsp", "url": "cmdjsp.jsp", "regexp": "(?-mix:(\\r\\n|\\n)(\\r\\n|\\n)(\\r\\n|\\n)<\\/FORM>)" }, { "string": "jsp-reverse.jsp", "url": "jsp-reverse.jsp", "regexp": "(?-mix:

JSP Backdoor Reverse Shell<\\/h1>)" }, { "string": "jsp-reverse.jsp", "url": "jsp-reverse.jsp", "regexp": "(?-mix:(\\r\\n|\\n)IP Address(\\r\\n|\\n)(\\r\\n|\\n)Port(\\r\\n|\\n)(\\r\\n|\\n)(\\r\\n|\\n))" }, { "string": "list.jsp", "url": "list.jsp", "regexp": "(?-mix:(\\r\\n|\\n)\\t(\\r\\n|\\n)\\t(\\r\\n|\\n)\\t(\\r\\n|\\n)\\t<\\/FORM>)" }, { "string": "up.jsp", "url": "up.jsp", "regexp": "(?-mix:(\\r\\n|\\n)(\\r\\n|\\n)(\\r\\n|\\n)(\\r\\n|\\n)<\\/form>)" }, { "string": "cmd_win32.jsp", "url": "cmd_win32.jsp", "regexp": "(?-mix:(\\r\\n|\\n)(\\r\\n|\\n)(\\r\\n|\\n)(\\r\\n|\\n)<\\/FORM>(\\r\\n|\\n)
)"
        },
        {
            "string": "up_win32.jsp",
            "url": "up_win32.jsp",
            "regexp": "(?-mix:(\\r\\n|\\n)(\\r\\n|\\n)(\\r\\n|\\n)(\\r\\n|\\n)<\\/form>(\\r\\n|\\n)<\\/html>)"
        },
        {
            "string": "CmdServlet",
            "url": "CmdServlet",
            "tagpattern": "html,body,hr,p,form,input,input,/form,hr,/pre,/body,/html"
        },
        {
            "string": "ListServlet",
            "url": "ListServlet",
            "regexp": "(?-mix:\\n\\nDirectory Listing<\\/TITLE>\\n<\\/HEAD>\\n<BODY>\\n<FONT Face=\\\"Courier New, Helvetica\\\" Color=\\\"Black\\\">\\n)"
        },
        {
            "string": "UpServlet",
            "url": "UpServlet",
            "tagpattern": "html,body,br,form,input,input,/form,/body,/html"
        },
        {
            "string": "UpServlet",
            "url": "UpServlet",
            "regexp": "(?-mix:<html><body><br><form method=\"POST\" action=\"\" enctype=\"multipart\\/form-data\">UPLOAD <input type=\"file\" name=\"file\" size=\"60\"><input type=\"submit\" value=\"Upload\">)"
        },
        {
            "string": "cfexec.cfm",
            "url": "cfexec.cfm",
            "regexp": "(?-mix:Notes:<br><br>(\\r\\n|\\n)<ul>(\\r\\n|\\n)<li>Prefix DOS commands with)"
        },
        {
            "string": "cmd.cfm",
            "url": "cmd.cfm",
            "regexp": "(?-mix:<table>(\\r\\n|\\n)<form method=\"POST\" action=\"\">(\\r\\n|\\n) <tr>(\\r\\n|\\n)  <td>Command:<\\/td>(\\r\\n|\\n)  <td> < input type=text name=\"cmd\")"
        },
        {
            "string": "perlcmd.cgi",
            "text": "<!-- Simple CGI backdoor by DK (http://michaeldaw.org) -->"
        },
        {
            "string": "perlcmd.cgi",
            "text": "# <!--    http://michaeldaw.org   2006    -->"
        },
        {
            "string": "up.pl",
            "text": "<a href=\"http://www.muquit.com/muquit/\">Muhammad A Muquit"
        },
        {
            "string": "cmd.pl",
            "url": "cmd.pl",
            "tagpattern": "html,body,form,input,input,/form,pre,/pre"
        },
        {
            "string": "cmd.pl",
            "url": "cmd.pl",
            "regexp": "(?-mix:<input type=\"submit\" value=\"Run\">(\\r\\n|\\n)<\\/form>(\\r\\n|\\n)<pre>)"
        },
        {
            "string": "list.pl",
            "url": "list.pl",
            "regexp": "(?-mix:<input type=\"submit\" value=\"List\">(\\r\\n|\\n)<\\/form>(\\r\\n|\\n)Directory)"
        },
        {
            "string": "perlcmd.cgi",
            "url": "perlcmd.cgi",
            "text": "<!-- Simple CGI backdoor by DK (http://michaeldaw.org) -->"
        },
        {
            "string": "perlcmd.cgi",
            "url": "perlcmd.cgi",
            "text": "# <!--    http://michaeldaw.org   2006    -->"
        },
        {
            "string": "up.pl",
            "url": "up.pl",
            "text": "<a href=\"http://www.muquit.com/muquit/\">Muhammad A Muquit"
        },
        {
            "string": "cmd.cgi",
            "url": "cmd.cgi",
            "regexp": "(?-mix:<input type=\"text\" name=\"cmd\">(\\r\\n|\\n)<input type=\"submit\" value=\"Send\">)"
        },
        {
            "string": "cmdexe.cgi",
            "url": "cmdexe.cgi",
            "regexp": "(?-mix:<input type=\"text\" name=\"cmd\">(\\r\\n|\\n)<input type=\"submit\" value=\"Send\">)"
        }
    ]
}