Sarah_au Posted February 5, 2009 Share Posted February 5, 2009 Hi there, someone is hacking my site and appending a jquery to all html and php files in the public_html directory. They are also appending to files in any new addon domain directories but not those that were already there when they started so it seems to me as if they don't actually have access to the directory structure or they just can't be bothered. My webhost can't or won't help so is there any way I can find how the hacker is getting in to do the append? I don't even know what the jquery does as it is encrypted. All I know is that when he has done it my firewall stops stuff from my computer trying to access the net. I have seen the words google and ebay but have no idea what is happening. Quote Link to comment Share on other sites More sharing options...
s0c0 Posted February 5, 2009 Share Posted February 5, 2009 They are performing some sort of XSS attach on you most likely. I would first change your FTP password, verify that write and execute permissions on the directory are disabled for the public group (leave them enabled for owner). Next do you have some sort of uploader on your site? If thats how they are posting the files, then disallow any .js file from being uploaded. Also do some searching for free classes that protect your site from XSS attacks and validate all your input through that filter. More details would be nice. Quote Link to comment Share on other sites More sharing options...
Sarah_au Posted February 5, 2009 Author Share Posted February 5, 2009 They are performing some sort of XSS attach on you most likely. I would first change your FTP password, verify that write and execute permissions on the directory are disabled for the public group (leave them enabled for owner). I have no idea what an XSS attack is The directory permission is 755 and has to be for php scripts to work else it throughs out an error 500. Next do you have some sort of uploader on your site? If thats how they are posting the files, then disallow any .js file from being uploaded. Also do some searching for free classes that protect your site from XSS attacks and validate all your input through that filter. More details would be nice. I might have an image uploader somewhere but they are not uploading files as I said in my post they are appending to existing files. I am worried that if I simply block them writing to the files they will delete everything if I can't find out how they are getting in. Quote Link to comment Share on other sites More sharing options...
s0c0 Posted February 5, 2009 Share Posted February 5, 2009 For starters did you change the FTP password? Quote Link to comment Share on other sites More sharing options...
Sarah_au Posted February 6, 2009 Author Share Posted February 6, 2009 For starters did you change the FTP password? If they are not uploading a new file why would changing the ftp password make any difference? Quote Link to comment Share on other sites More sharing options...
premiso Posted February 6, 2009 Share Posted February 6, 2009 On your site, is there anywhere that you write to a file or include a file from GET data? Changing the FTP password is just a security measure. They can modify a file, etc. Let me know on my questions of the writing to a file/include. If that is being done, please post relevant code. Quote Link to comment Share on other sites More sharing options...
gizmola Posted February 6, 2009 Share Posted February 6, 2009 There are a lot of different possibilities here. Usually you need to go into your web logs and look for the attacks. We really don't have enough information or access to your site, so there's no much we can do to help you. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.