Webserver Incident Reporting and Termination(TM) Squad
NOTE: Web servers have logs and in those logs is evidence of attempted hacking. For instance, one may notice an attack that calls such a script from a remote server "r57.php??". Its these kinds of attacks we're looking to investigate. For a concrete example, see these reports.
Please do not submit phish, spam, or malware to WsIRT. Only submit attack signatures from web server logs. As this project hasn't officially been publicly launched, we are still reclassifying the tool and its verbiage.
Paul: This script is used by an attacker, in this case allegedly UNITED ALBANIANS aka ALBOSS PARADISE, to remotely determine
system information of web servers that'll give knowledge as to how they can takeover that system illegally.
