{ "name": "Google-Hack-Honeypot", "author": "Brendan Coles ", "version": "0.3", "description": "Google Hack Honeypot is the reaction to a new type of malicious web traffic: search engine hackers. This plugin identifies the following GHH modules: php-ping, HAXPLORER, phpSysInfo, PHPFM, SquirrelMail, wwwboard passwd.txt", "website": "http://ghh.sourceforge.net/", "matches": [ { "module": "PHP-Ping", "regexp": "(?-mix:The WorldsEnd.NET - Free Ping Script, written in PHP<\\/title><\\/head><body bgcolor=\"#FFFFFF\" text=\"#000000\"><\\/body><p><font size=\"2\">Your IP is: [\\d\\.]*<\\/font><\\/p><form methode=\"post\" action=\"[^\\\"]*\"> Enter IP or Host <input type=\"text\" name=\"host\" value=\"127.0.0.1\"><\\/input> Enter Count <input type=\"text\" name=\"count\" size=\"2\" value=\"4\"><\\/input> <input type=\"submit\" name=\"submit\" value=\"Ping!\"><\\/input><\\/form><br><b><\\/b><\\/body><\\/html>)" }, { "module": "HAXPLORER", "regexp": "(?-mix:<tr><td NOWRAP class=\"top left right\">   <a href=\"1\\.php\\?cmd=dir&dir=\\.\\/\\.\">\\[\\.\\]<\\/a>         <\\/td>\\n<td NOWRAP class=\"top right\"><center>  \\n  <\\/center><\\/td>\\n<td NOWRAP class=\"top right\"> <\\/td>\\n<td NOWRAP class=\"top right\">  \\n<strong>D<\\/strong><strong>R<\\/strong><Strong>X<strong>  <\\/td>\\n<td NOWRAP class=\"top right\" NOWRAP>\\n  Thu 0\\d)" }, { "module": "phpSysInfo", "regexp": "(?-mix:<input type=\"submit\" value=\"Submit\"><\\/form><\\/center><hr>Created by<a href=\"http:\\/\\/phpsysinfo\\.sourceforge\\.net\"> phpSysInfo-2\\.3<\\/a> on Feb 11, 2005 at <br>)" }, { "module": "PHPFM", "text": "<td> index.php</td><td width=60 align='right'>2,81 KB</td><td width=35 align='center'>666</td><td width=110 align='right'>20:36 06-19-2003</td><td width=20> </td><td width=20><a href='?&&path=&filename=index.php&action=edit'><img src='icon/edit.gif' width=20 height=22 alt='Edit file' border=0></a></td><td width=20><a href='?&&path=&filename=index.php&action=rename'><img src='icon/rename.gif' width=20 height=22 alt='Rename file' border=0></a></td><td width=20><a href='?&&path=&filename=index.php&action=download'><img src='icon/download.gif' width=20 height=22 alt='Download file' border=0></a></td><td width=20><a href='?&&path=&filename=index.php&action=delete'><img src='icon/delete.gif' width=20 height=22 alt='Delete file' border=0></a></td></tr><tr><td width=20><img src='icon/text.gif' width=20 height=22 border=0 alt='File'></td><td> readme.txt</td><td width=60 align='right'>2,13 KB</td><td width=35 align='center'>666</td><td width=110 align='right'>22:26 06-19-2003</td><td width=20> </td><td width=20><a href='?&&path=&filename=readme.txt&action=edit'><img src='icon/edit.gif' width=20 height=22 alt='Edit file' border=0></a></td><td width=20><a href='?&&path=&filename=readme.txt&action=rename'><img src='icon/rename.gif' width=20 height=22 alt='Rename file' border=0></a></td><td width=20><a href='?&&path=&filename=readme.txt&action=download'><img src='icon/download.gif' width=20 height=22 alt='Download file' border=0></a></td><td width=20><a href='?&&path=&filename=readme.txt&action=delete'><img src='icon/delete.gif' width=20 height=22 alt='Delete file' border=0></a></td></tr><tr><td colspan=9> </td></tr></table></td></tr></table><br /><br /><table class='bottom' cellpadding=0 cellspacing=0><tr><td align='center'>Powered by <a href='http://phpfm.zalon.dk/' target='_new' class='bottom'>PHPFM</a> 0.2.3</td>" }, { "module": "SquirrelMail", "certainty": 75, "regexp": "(?-mix:<body text=\"#000000\" bgcolor=\"#FFFFFF\" link=\"#0000CC\" vlink=\"#0000CC\" alink=\"#0000CC\" onload=\"squirrelmail_loginpage_onload\\(\\);\">\\n<form action=\"redirect\\.php\" method=\"post\">\\n\\n<table bgcolor=\"#ffffff\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\" width=\"100%\"><tr><td align=\"center\"><center><img src=\"\\.\\.\\/images\\/sm_logo\\.png\" alt=\")" } ] }