What is the difference between Level3 and Level4 trojans in DanderSpritz?
In DanderSpritz, Level represents the connection method. Level3 trojans use a reverse connection: the controller listens on a port while the target host initiates the connection. Level4 trojans use a forward connection: the target host opens a listening port and the controller actively connects to it. This distinction is crucial for selecting the correct listener or connector in [PeddleCheap](/news/nsa-danderspiritz-testing-guide-trojan-generation-and-testing) when generating and using trojans.
Related article:
NSA DanderSpiritz Testing Guide - Trojan Generation and Testing