1

I administer an E-commerce site, and recently I have been seeing odd URL requests containing jQuery function calls. Here are some examples of the requested URLs that are being logged as 302 permanent redirects.

www.mydomain.com/).on(
www.mydomain.com/).removeClass(
www.mydomain.com/somepath/).on(

Note that we don't explicitly have any of these defined as redirects.

I did some research and found information on something called the Angler Exploit Kit. I can't find anything to indicate there is a problem with our server. The IP addresses these requests originate from are overseas datacenters and server farms.

Could this be related to the Angler Exploit Kit? What do I, as an admin, need to know about Angler, and should I be concerned about these requests?

2 Answers 2

1

To give a broad, general answer, yes, you should be concerned with all requests sent by a user. Be suspicious of all user supplied information and validate everything appropriately.

This looks like a poor attempt at finding an XSS vulnerability. You should be worried if you have input fields that are poorly validated and filtered.

The tool that's being used to generate this traffic itself probably isn't worth worrying about.

0

I Strongly agree with @d1str0, this clearly is a poor attempt for intrusion into your systems. It might be worth to check if all orders are actually paid for etc. Usually script kiddies of this level tend to just order products without paying for them (i have experience with those). But, they usually tend to break "stuff"meaning your website.

My advice; make a quick backup of your code, server and database. And ofcourse watch suspicious orders. Check if orders are actually paid for. I know of an example in wich a hacker got acces to the CMS of a website and made orders and then just set them on "paid", 2 days later he had the goods at his doorstep. Needles to say this is very dumb, but if there is a poor financial administration things like this are easily overlooked.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .