tk2

One of my websites was affected by this. I'm currently doing some work to de-obfuscate the php code.

https://github.com/shiragami/japanese-backdoor/blob/master/o...

Basically what it did: Create a htaccess file to redirect request. Respond differently if client is web-crawlers i.e. seo cloaking. Download a php backdoor. Rewrite sitemap.xml and robots.txt

I'm still not sure what exploit that it uses to gain access.

I accidentally found this circa 2008. I found a xss vulnerability on a local news website, where I could inject js into the webpage URL.

I then posted a poc on my blog. The poc will create a img link to my blog.

To my surprise my blog ranked 2nd for the news name. The only explanation that I can think of was googlebot followed the poc link and thought the news site has a link to my blog. Of course this is only possible if googlebot execute js, which was not a standard for other crawlers at that time.

I believe the blackhat term for this is Google Bowling. Correct me if I'm wrong.