Hi Pondus,
Protection for websites against this can be found by using a token to validate the source of the flooding coming from that origin and not a malicious attacker. Important is the fact to invalidate the valid token once it has been used, how this is done can be read here (also all info credits go there of course): http://stackoverflow.com/questions/3026640/quick-and-easy-flood-protection
See: http://v.virscan.org/PHP/Flooder.Agent.NAA%20virus.html
Also read what Tony Perez has to say here: https://blog.sucuri.net/2011/10/remove-unsused-testing-debug-software-from-your-site.html
The PHP “base64_decode” function is more popular in attacks, because it allows the hacker to encrypt malicious coding statements. The “base64_decode” function decrypts the code upon execution, so it is only seen when the code is opened in a web browser. This PHP function is typically used to include hidden links to malicious websites. Usually, the hacker places the malicious code several lines below the main content, so the webmaster misses the statements. Make sure you scroll all the way to the bottom to find the malicious statements. The following code is a random example of a PHP hack you can find on hacked web pages:
eval(base64_decode($_SERVER57F))%32%5E|.+)
All of the code after the “_SERVER” statement is encrypted code. In this instance, you must delete the entire line of code to remove the hack.
Quote taken from SiteLock Word Press Blog.
polonus
