1

I maintain a small site that runs old-fashioned classic ASP pages with an Access backend.

Recently, the site got hacked. The attacker managed to add a large quantity of code to the index.asp page. Mostly it was static content, lots of links to dubious sites, that sort of thing, with a bit of scripting thrown in. I didn't stop to analyse the scripts - I just deleted everything and reposted the page.

There's nothing in that index page which accepts dynamic input: no search boxes, no file uploads, no querystrings. There is elsewhere on the site, which includes some simple forums software, but not on the front page.

Because there's no input on the page that got hacked, I presumed this was a flaw in the host's defences, and alerted them to the fact there might be a problem. After a couple of days, they got back to me claiming they were fully secure and the attacker must have used some form of injection attack to do the damage.

This surprised and alarmed me, because I was not aware that there were techniques to use injection on pages that don't accept any input. But my knowledge of security isn't great, so if there are, I want to know about them.

So, how can an injection attack get on a page that doesn't have a form or a querystring? Or are my hosting company bluffing, and there's a possible flaw in their security?

  • 2
    I would check the patch level of your forum software, and remove it if it isn't being utilized. The attacker could have traversed directories through a vulnerability in the forum software. – Paul Jul 30 '14 at 13:22
4

A vulnerability in active content on your site is not limited to only impacting that portion of your site. If you have a vulnerability that allows execution of arbitrary code, then the code that is injected can do anything that the executing process can do, potentially including file operations on other parts of your site.

This is most probably what happened. The forum software or some other form was injected in a way that allowed a file operation to be preformed on the root folder and that was used to modify the static files on the main page to inject the content payload.

It's a mildly sophisticated attack in that it probably wasn't done exclusively with out of the box tools, but still isn't particularly hard assuming the appropriate vulnerabilities were present.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.