Backdoors and Trojans

Subverting Client Side Scripting

Client side scripting in the form of Java script or VB script is sometimes
used to perform input validation. This has the feature that the user is
immediately notified when incorrect data is entered, and doesn’t have
to wait for the form to be submitted before receiving feedback.
Input validation done at this level presents serious security flaws, as the
client side source code is available and editable by the end user. By
simply removing the restriction on character sets and input length,
buffer overflow and command execution attacks can then be attempted.
Client side input validation should always be used as an added feature
to server side validation and should not be considered a replacement.
Very poorly written client side scripts sometimes contain usernames
and passwords which can be used to gain access to the system.

Backdoors and Trojans

Trojans and backdoor programs are becoming an increasingly popular
method for gaining unauthorized access to remote systems. Backdoors
offer the attacker an easy way of accessing a remote system, without
having to rely on exploits or other security vulnerabilities.
The simplest backdoors take the form of command shells listening on
unusual ports. A commonly used tool is NetCat, which is available on
both the Windows and Unix platforms. Once NetCat is installed and
listening on port XXXX, the attacker need only telnet to port XXXX and
be presented with a remote command shell.