How to detect backdoors?

14-07-2018, 09:42 PM

kasselschaden Wrote: Basicly,
- Read and understand all code you run on your servers.
- Do NOT put workshop add-ons on a server directly, unpack and check them instead
- Override RunString/RunStringEx/CompileString to prevent running remote HTTP payloads.
- maps may have backdoors
- encrypted and/or obfuscated code is encrypted and/or obfuscated for a reason, a very bad reason.

For leaks, begin with searching for encrypted code patterns, like _G[, http, RunString(Ex), CompileString, \12\34\56 (regex \\\d+)

also a lot of backdoor examples: https://github.com/RyanJGray/Backdoor_Busting_2015

p.s. and if you spotted a backdoor in a leak - please share your findings!

I didnt even know maps had backboors.. wow.