I host a legacy HTTP website on my own hardware in China. It was attacked due to the Struts file upload flaw last month. But yesterday, Communications Authority in my province alarmed me, there is still a backdoor on my website, and I need to clean it. Here is the information they gave me:
- Backdoor script URL: http://my.website.com/images/xxx.jsp
- My IP address and port: 18.104.22.168:80
- Hacker's IP address and port: 22.214.171.124:2000
After that I confirmed they are correct, there is a backdoor script. However frankly, I am worrying more about them than some random hackers from internet due to there reputation. So I try to learn how they know that. Here is my assumption:
- The hacker's IP already reported, I can find it in this blacklist: https://cleantalk.org/blacklists/126.96.36.199 for example. And they also know this list.
- They filtered all packages to that IP address, and get the backdoor script URL from the HTTP headers in that packages.
My questions are:
- Is my assumption correct?
- If it is a HTTPS website, could they still get the URL?