2.9.3 Is there a backdoor Trojan?

[buchun2]

Question

Is there a backdoor Trojan? There is a callback at the end of the run

Environment

• Dalfox Version: 2.9.3
  Releases [v2.9.3]
  read tcp 192.168.128.128:36006->44.228.249.3:80

[*] [duration: 13.682142618s][issues: 5] Finish Scan! [*] 🦊 Start scan [SID:4][4/6][66.67%%] / URL: http://testphp.vulnweb.com/listproducts.php?cat= [E] not running Get "http://testphp.vulnweb.com/listproducts.php?cat=": read tcp 192.168.128.128:36006->44.228.249.3:80: read: connection reset by peer [*] 🦊 Start scan [SID:5][5/6][83.33%%] / URL: http://testphp.vulnweb.com/product.php?pic= [I] Content-Type is text/html; charset=UTF-8 [W] Reflected Payload in HTML: pic="><a href=javas&#99;ript:alert(1)/class=dalfox>click 56 line: syntax to use near '"><a href=javas&#99;ript:alert(1)/class=dalfox>click' at lin [POC][R][GET][inHTML-URL] http://testphp.vulnweb.com/product.php?pic=%22%3E%3Ca+href%3Djavas%26%2399%3Bript%3Aalert%281%29%2Fclass%3Ddalfox%3Eclick [V] Triggered XSS Payload (found DOM Object): pic='"><img/src/onerror=.1|alert`` class=dalfox> 56 line: syntax to use near ''"><img/src/onerror=.1|alert`` class=dalfox>' at line 1 [POC][V][GET][inHTML-URL] http://testphp.vulnweb.com/product.php?pic=%27%22%3E%3Cimg%2Fsrc%2Fonerror%3D.1%7Calert%60%60+class%3Ddalfox%3E [*] -------------------------------------------------------------------------------------------------------------- [*] [duration: 11.775009686s][issues: 2] Finish Scan!

[hahwul]

@buchun2
Hi! Thanks for your question. Are you referring to the connection to 44.228.249.3:80 that you mentioned? From what I can see, that IP seems to correspond to the target you scanned, testphp.vulnweb.com. If I’ve misunderstood the situation, please feel free to let me know!

Just for reference, unless you’ve specified additional options, Dalfox typically doesn’t send requests to any addresses other than the scan target. The only exception would be if you’re using the remote payload option, in which case it would send a request to assets.hahwul.com. Let me know if you’d like me to dig deeper or clarify anything further!