5

One of my customers had a problem making a post at his blog, and when I looked into the database I found out that the newsletter table (which sends emails about the blog posts) had a malicious script.

Malicious script

Since I'm just a rookie front-end developer, I have no clue about what would this script do. Could anyone help me with the goal of the attacker?

Also, while looking at the ip of the attacker (which was not obfuscated) I could find that he was using a university to make it. (Not really far from where I am and my customer's location)

enter image description here

I'm using a client validation and also validating the data in my back-end with regex. And this script does not match the parameters, so, I suspect he made a post to the db.

How can I prevent this kind of attack?

And what did the attacker wanted?

EDIT:

As requested, the code:

sample@email.tst
sample@email.tst' and 2*3*8=6*8 and 'sfn7'='sfn7
sample@email.tst" and 2*3*8=6*8 and "sxju"="sxju
sample@email.tst%' and 2*3*8=6*8 and 'l6b4'!='l6b4%
sample@email.tst&n945604=v918673
sample@email.tst'"()&%<acx><script >j9ml(9550)</script>
sample@email.tst_9225

Sorry if this is not the place to make this question, I thought it might not be a StackOverFlow question.

  • 1
    those are just tests to see how your site responded to different inputs – schroeder Jan 11 '18 at 14:11
  • 2
    Yes, somebody tried to perform an SQL injection attack, but in the cases listed the input was correctly handled as data and inserted as is in te database, so those are not the sign of a successful attack (but it doesn’t mean other requests haven’t actually “worked”). However, if that column is supposed to hold e-mail addresses only, your validation clearly failed. Also, in addition to SQL injection, there’s at least one XSS attack attempt, you should check that you correctly encode that data before displaying it. – jcaron Jan 11 '18 at 15:14
  • @jcaron Since I'm new to this, there is any more fields that I should encode as well to prevent those attacks? – Andre Aquiles Jan 11 '18 at 16:02
  • 3
    You can't prevent the attacks, you can only prevent them from succeeding :-) You should: 1. make sure you use parameterised queries, never concatenation of untrusted data. 2. Apply validation rules (server-side) to inputs such as e-mails. 3. Make sure you also apply the correct encoding when displaying data. Text ant HTML are not the same thing. – jcaron Jan 11 '18 at 16:04
1

Interesting stuff. Should be rather flattering to become the target I suppose.

I've never caught anybody like that. Frankly I think the operative line is sample@email.tst'"()&%j9ml(9550) where they are apparently attempting to execute a function named "j9ml". Not exactly sure though. I wouldn't worry about it too much unless you need to maintain an ultra secure blog or there is egg on your face (spam happening or whatever).

I agree with @jcaron that the best defense is parameterizing all queries and stored procedures. Which is to say that you should use the question mark syntax which quotes all user inputs and will prevent this kind of attack.

Important to also acknowledge that it may not be a malicious attack. The kid is probably just playing around. Could conceivably even be an assignment, executing a function on a site is not necessarily malicious or illegal I don't think.

  • 1
    "I once heard that 99% of viruses come from educational institutions.", can you give us the source of this statement please ? – lapinousexy Jan 11 '18 at 20:04
  • Good point @lapinousexy. I have no source. It was over a decade ago. I've edited to remove a bit of opinion. Why do people so often provide an answer in comments? – Jesse Ivy Jan 12 '18 at 0:22
  • 1
    I used the wording "blog" because it is mostly what the website is for, but actually is the website of a City Townhall. That's why it troubles me facing this. I'm thinking that it is also just a kid playing around as well, but thanks for the help! – Andre Aquiles Jan 12 '18 at 17:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.