mirror of
https://github.com/shmilylty/OneForAll.git
synced 2026-08-26 04:47:48 +08:00
JrD
31 lines
4.3 KiB
JSON
31 lines
4.3 KiB
JSON
{
|
|
"name": "Google-Hack-Honeypot",
|
|
"author": "Brendan Coles <bcoles@gmail.com>",
|
|
"version": "0.3",
|
|
"description": "Google Hack Honeypot is the reaction to a new type of malicious web traffic: search engine hackers. This plugin identifies the following GHH modules: php-ping, HAXPLORER, phpSysInfo, PHPFM, SquirrelMail, wwwboard passwd.txt",
|
|
"website": "http://ghh.sourceforge.net/",
|
|
"matches": [
|
|
{
|
|
"module": "PHP-Ping",
|
|
"regexp": "(?-mix:<title>The WorldsEnd.NET - Free Ping Script, written in PHP<\\/title><\\/head><body bgcolor=\"#FFFFFF\" text=\"#000000\"><\\/body><p><font size=\"2\">Your IP is: [\\d\\.]*<\\/font><\\/p><form methode=\"post\" action=\"[^\\\"]*\"> Enter IP or Host <input type=\"text\" name=\"host\" value=\"127.0.0.1\"><\\/input> Enter Count <input type=\"text\" name=\"count\" size=\"2\" value=\"4\"><\\/input> <input type=\"submit\" name=\"submit\" value=\"Ping!\"><\\/input><\\/form><br><b><\\/b><\\/body><\\/html>)"
|
|
},
|
|
{
|
|
"module": "HAXPLORER",
|
|
"regexp": "(?-mix:<tr><td NOWRAP class=\"top left right\"> <a href=\"1\\.php\\?cmd=dir&dir=\\.\\/\\.\">\\[\\.\\]<\\/a> <\\/td>\\n<td NOWRAP class=\"top right\"><center> \\n <\\/center><\\/td>\\n<td NOWRAP class=\"top right\"> <\\/td>\\n<td NOWRAP class=\"top right\"> \\n<strong>D<\\/strong><strong>R<\\/strong><Strong>X<strong> <\\/td>\\n<td NOWRAP class=\"top right\" NOWRAP>\\n Thu 0\\d)"
|
|
},
|
|
{
|
|
"module": "phpSysInfo",
|
|
"regexp": "(?-mix:<input type=\"submit\" value=\"Submit\"><\\/form><\\/center><hr>Created by<a href=\"http:\\/\\/phpsysinfo\\.sourceforge\\.net\"> phpSysInfo-2\\.3<\\/a> on Feb 11, 2005 at <br>)"
|
|
},
|
|
{
|
|
"module": "PHPFM",
|
|
"text": "<td> index.php</td><td width=60 align='right'>2,81 KB</td><td width=35 align='center'>666</td><td width=110 align='right'>20:36 06-19-2003</td><td width=20> </td><td width=20><a href='?&&path=&filename=index.php&action=edit'><img src='icon/edit.gif' width=20 height=22 alt='Edit file' border=0></a></td><td width=20><a href='?&&path=&filename=index.php&action=rename'><img src='icon/rename.gif' width=20 height=22 alt='Rename file' border=0></a></td><td width=20><a href='?&&path=&filename=index.php&action=download'><img src='icon/download.gif' width=20 height=22 alt='Download file' border=0></a></td><td width=20><a href='?&&path=&filename=index.php&action=delete'><img src='icon/delete.gif' width=20 height=22 alt='Delete file' border=0></a></td></tr><tr><td width=20><img src='icon/text.gif' width=20 height=22 border=0 alt='File'></td><td> readme.txt</td><td width=60 align='right'>2,13 KB</td><td width=35 align='center'>666</td><td width=110 align='right'>22:26 06-19-2003</td><td width=20> </td><td width=20><a href='?&&path=&filename=readme.txt&action=edit'><img src='icon/edit.gif' width=20 height=22 alt='Edit file' border=0></a></td><td width=20><a href='?&&path=&filename=readme.txt&action=rename'><img src='icon/rename.gif' width=20 height=22 alt='Rename file' border=0></a></td><td width=20><a href='?&&path=&filename=readme.txt&action=download'><img src='icon/download.gif' width=20 height=22 alt='Download file' border=0></a></td><td width=20><a href='?&&path=&filename=readme.txt&action=delete'><img src='icon/delete.gif' width=20 height=22 alt='Delete file' border=0></a></td></tr><tr><td colspan=9> </td></tr></table></td></tr></table><br /><br /><table class='bottom' cellpadding=0 cellspacing=0><tr><td align='center'>Powered by <a href='http://phpfm.zalon.dk/' target='_new' class='bottom'>PHPFM</a> 0.2.3</td>"
|
|
},
|
|
{
|
|
"module": "SquirrelMail",
|
|
"certainty": 75,
|
|
"regexp": "(?-mix:<body text=\"#000000\" bgcolor=\"#FFFFFF\" link=\"#0000CC\" vlink=\"#0000CC\" alink=\"#0000CC\" onload=\"squirrelmail_loginpage_onload\\(\\);\">\\n<form action=\"redirect\\.php\" method=\"post\">\\n\\n<table bgcolor=\"#ffffff\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\" width=\"100%\"><tr><td align=\"center\"><center><img src=\"\\.\\.\\/images\\/sm_logo\\.png\" alt=\")"
|
|
}
|
|
]
|
|
}
|