PHP based defacing tool usage continue to rise

[Mark Ryan del Moral Talabis <talabis () gmail com>]

We have been recieving multiple occurences of remote code injection
attempts for the past few weeks. The code injected is the previously
identified "Defacing Tool 2.0 by r3v3ng4ns" which was reported in SANS
in the previous week. Honeynet data indicates that the occurences has
continued unabated since the mid part of December.

Full write-up and code:
http://www.philippinehoneynet.org/dataarchive.php?date=2006-01-20

Ryan Talabis
Philippine Honeynet Project

-------------------------------------------------------------------------
This List Sponsored by: Watchfire

Watchfire's AppScan is the industry's first and leading web application
security testing suite, and the only solution to provide comprehensive
remediation tasks at every level of the application. See for yourself.
Download AppScan 6.0 today.

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
--------------------------------------------------------------------------