🕵️ BPFDoor

The items that name it 3

• SMTP is the key: BPFDoor and AVERAT hitting the network edge
  writeup2026-10-02

  Attaches raw PF_PACKET/BPF filters to sniff for magic-byte triggers (e.g. 0x6693/0x4274/0x7820, or 14-byte unique payload 2B 76 C0 63 83 E9 5F E1 EE 69 3F 32 CD 94); newer controller tunnels the magic trigger inside HTTPS POST requests to evade DPI; spoofs process names such as /usr/sbin/abrtd, ora_

• 0xor0ne Awesome List
  repo2026-05-12
• [s|l]trace - Linux Malware Analysis
  writeup2024-02-01

  Linux backdoor analyzed in the post; uses BPF socket filters to observe incoming packets, checks for password ('justforfun' or 'socket') in a 'magic packet', and provides reverse shell, bind shell, or sends back a ping response. Discussed with reference to Craig Rowland's (Sandfly Security) presenta