Timeline for JS snippets on my live project do not appear in my code residing on my production server
Current License: CC BY-SA 3.0
24 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 21, 2020 at 16:32 | comment | added | Aaron Cicali | This post is pretty old, not sure why it was in the sidebar of SE... but for anyone that stumbles on it - this could simply be a browser extension injecting them. | |
| Feb 12, 2017 at 5:15 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Jan 13, 2017 at 3:53 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Dec 14, 2016 at 3:41 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Nov 14, 2016 at 3:23 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Oct 15, 2016 at 2:53 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Sep 15, 2016 at 2:23 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Aug 15, 2016 at 23:05 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Jul 16, 2016 at 22:31 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Jun 16, 2016 at 22:24 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| May 17, 2016 at 23:06 | comment | added | André Borie |
Can you recursively grep for parts of the malicious JS on your entire Django project directory? The parts that handle HTTP in Django could've been altered to add the malicious code even though it's not present in the template files.
|
|
| May 17, 2016 at 20:35 | history | bumped | CommunityBot | This question has answers that may be good or bad; the system has marked it active so that they can be reviewed. | |
| Feb 20, 2016 at 4:03 | history | tweeted | twitter.com/StackSecurity/status/700893532647727104 | ||
| Feb 17, 2016 at 15:28 | answer | added | pila | timeline score: 1 | |
| Feb 17, 2016 at 6:51 | history | edited | Sarah Micj | CC BY-SA 3.0 |
edited title
|
| Feb 17, 2016 at 6:35 | history | edited | Sarah Micj | CC BY-SA 3.0 |
added 2052 characters in body
|
| Feb 17, 2016 at 6:29 | comment | added | Sarah Micj |
@XiongChiamiov: Okay, this situation is in flux. Right now, the offending JS snippets are gone (tried both curl and Mozilla inspector). I do have JS snippets from Goog Analytics and New Relic, but those I authorized. The snippets related to ads are gone. The only change I made over the day is settomg a basic firewall on my server (I put the iptables config in the question too if you want to read it). I still haven't gotten around to installing SSL. What's going on?
|
|
| Feb 17, 2016 at 2:15 | comment | added | Xiong Chiamiov |
Do you see those snippets when looking at the originally-sent html source? That is, what's sent by the server, before javascript has had a chance to muck with the dom? I think Firefox's view source will show that, but curl certainly will.
|
|
| Feb 16, 2016 at 16:48 | history | edited | Sarah Micj | CC BY-SA 3.0 |
deleted 4 characters in body
|
| Feb 16, 2016 at 16:42 | comment | added | Sarah Micj |
@schroeder: yes, the hosting company never placed ads there. @That1Guy: I never put any script tags, but I see a ton of them in my header file now. A few are legit (new relic, google analytics), but most are some kind of ad-related script tags that I never put. @silverpenguin: Yes, I'm just trying to get as much information right now as possible. It was flagged in my previous ques that my servers might be compromised. So I'm now quite confused about why my files on the production server aren't defaced, but those being served are. Your SSL theory does make sense to me.
|
|
| Feb 16, 2016 at 16:12 | comment | added | That1Guy |
Are there any <script tags at all in your header file?
|
|
| Feb 16, 2016 at 15:40 | comment | added | TheHidden | It depends how the attack, if an attack, is being performed, this could be django I have never used it so cannot be sure. though it is waiting for you to press a key? by the looks of it... if this is an attack then SSL could stop it depending on the type of attack.... though as said previously this could be ads. I would need to see your site. The way SSL would stop an attack like that is by not allowing interception and modification. though its starting to look more and more like ads | |
| Feb 16, 2016 at 15:38 | comment | added | schroeder♦ | And the adverts are not placed there by the hosting company? | |
| Feb 16, 2016 at 14:45 | history | asked | Sarah Micj | CC BY-SA 3.0 |