Timeline for What is this URL Injection piece of code mean?
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Aug 24, 2015 at 14:39 | vote | accept | Sarge | ||
| Aug 24, 2015 at 14:37 | comment | added | Sarge | Its already stopped. There is no sensitive data. This server only allows incoming port 80 traffic and does not allow any kind of outgoing traffic to go out beside allowing to initiate a http request to port 80. Its as strict as you can get. What its missing is the intelligence of a WAF. This is a Wordpress site. | |
| Aug 24, 2015 at 14:37 | comment | added | user45139 | that is good if you shut it down completely, especially if you manage users on your application (private data). If you are too curious, you may read both the source code of that malicious application and the content of your website and run them in a virtual machine for analysis... if you have time @Sarge | |
| Aug 24, 2015 at 14:35 | comment | added | user45139 | I mean instead of trying to analyse the malicious activities (what are the shell commands executed and what they perform), you need rather, in case your web application store private data and so on (users?), to do the necessary to stop that | |
| Aug 24, 2015 at 14:35 | comment | added | Sarge | Thank you for your help. The web app itself was shutdown completely and is in process of migrating to a new box just in case with clean set of data from a original copy. | |
| Aug 24, 2015 at 14:31 | comment | added | user45139 | @Sarge I have been thinking about sniffing the packets to see if you can find the source (IP address) of the machine that attacks by uploading such files and set a firewall to block it? You can give it a try in the case the attacker is rather a kid if you know what I mean. You can also check either manually or programmatically the content of your directories to see how many files are uploaded ... but if you have something sensible on your web application then you need quickly to fix that, may be you can ask that in a separate question, these comments have a limit | |
| Aug 24, 2015 at 14:23 | comment | added | Sarge | Thank you very much. Is there anyway for me to find the content of xsser? Assuming its on the server | |
| Aug 24, 2015 at 14:23 | vote | accept | Sarge | ||
| Aug 24, 2015 at 14:23 | |||||
| Aug 24, 2015 at 14:10 | history | edited | user45139 | CC BY-SA 3.0 |
added 99 characters in body
|
| Aug 24, 2015 at 14:01 | history | answered | user45139 | CC BY-SA 3.0 |