SpiderLabs Blog

Drupal Compromise Analysis Including Indicators of Compromise

I would like to thank fellow SpiderLabs Researcher Chaim Sanders and Dennis Wilson, Bryant Smith ...

[Honeypot Alert] FHS Null Byte Attack (CVE-2014-6287) Attempts to Install DDoS Malware (Iptablex)

Our web honeypots picked up some exploit attempts for CVE-2014-6287 which is a command execution ...

Announcing ModSecurity v2.9.0 Stable Release

The SpiderLabs Research - ModSecurity Team is proud to announce the stable release of version 2.9.0 ...

GHOST gethostbyname() heap overflow in glibc (CVE-2015-0235)

A heap-based buffer overflow vulnerability in glibc (CVE-2015-0235) was announced this week.

[Honeypot Alert] Wordpress Wp Symposium 14.11 - Unauthenticated Shell Upload Exploit Attempt

Our web honeypots picked up some exploit attempts for the recently released vulnerability in the WP ...

ModSecurity Advanced Topic of the Week: Detecting Malware with Fuzzy Hashing

We witnessed a sophisticated phishing campaign on 16th August 2017, targeting victims by sending ...

Setting HoneyTraps with ModSecurity: Adding Fake Cookies

This blog post continues with the topic of setting "HoneyTraps" within your web applications to ...

Shellshock a Week Later: What We Have Seen

Trustwave, like most other information security firms, has been busy investigating the ShellShock ...

[Honeypot Alert] New Bot Malware (BoSSaBoTv2) Attacking Web Servers Discovered

Our web honeypots picked up some interesting attack traffic. The initial web application attack ...

[Honeypot Alert] Active Probes for WordPress revslider_show_image Plugin Local File Inclusion Flaw

A local file inclusion vulnerability in the WordPress Slider Revolution Plugin has been released:

Blackhat Arsenal 2014: Live ModSecurity Demonstrations

If you are heading out to Blackhat USA 2014 in Las Vegas this week, please stop by the Arsenal ...

[Honeypot Alert] Wordpress XML-RPC Brute Force Scanning

There are news reports of new Wordpress XML-PRC brute force attacks being seen in the wild. The ...

Setting HoneyTraps with ModSecurity: Adding Fake Hidden Form Fields

This blog post continues with the topic of setting "HoneyTraps" within your web applications to ...

ModSecurity Advanced Topic of the Week: JSON Support

Submitted by Felipe Costa and Ryan Barnett (SpiderLabs Research - ModSecurity Team)

Announcing ModSecurity v2.8.0

[Honeypot Alert] JCE Joomla Extension Attacks

Our web honeypots picked up some increased exploit attempts for an old Joomla Content Editor (JCE) ...

ColdFusion Admin Compromise Analysis (CVE-2010-2861)

In a previous blog post, I provided "Method of Entry" analysis for a ColdFusion compromise baed on ...

WordPress XML-RPC PingBack Vulnerability Analysis

There were news stories this week outlining how attackers are abusing the XML-PRC "pingback" ...

ModSecurity Advanced Topic of the Week: Detecting Browser Fingerprint Changes During Sessions

This blog post will discuss a section from Recipe 8-5: Detecting Browser Fingerprint Changes During ...

ModSecurity Advanced Topic of the Week: HMAC Token Protection

This blog post presents a powerful feature of ModSecurity v2.7 that has been highly under-utilized ...

[Honeypot Alert] More PHP-CGI Scanning (apache-magika.c)

In the past 24 hours, one of the WASC Distributed Web Honeypot participant's sensors picked up ...

PHP.Net Site Infected with Malware

Earlier today, users attempting to access the www.php.net site were met with malware warnings from ...

Hiding Webshell Backdoor Code in Image Files

Looks Can Be Deceiving Do any of these pictures look suspicious?

AV Vendors Targeted in Defacement Campaign

Attacked Sites The KDMS hacking team recently defaced several popular websites include Whatsapp.com ...

Setting HoneyTraps with ModSecurity: Adding Fake robots.txt Disallow Entries

The following blog post is taken from Recipe 3-2: Adding Fake robots.txt Disallow Entries in my new ...

[Honeypot Alert] Probes for Apache Struts 2.X OGNL Vulnerability

Today our web honeypot sensors picked up probes for the recent Apache Struts 2.X OGNL vulnerability ...

The Web IS Vulnerable: XSS on the Battlefront (Part 1)