2

More and more, lately - I've seen attackers posting complete HTML pages that seem to have nothing malicious - to php pages that aren't even listening to their POST (sometimes, it's a contact form, which blocks spam, anyway).

So, my question is - is there any other malicious purpose that such things could be crafted for, other than spam?

Whenever this type of attack happens, the attacking IP will post several pages before it stops... so, perhaps it is trying to do some type of buffer overflow?

Here is a pastbin of one of the most recent examples - http://pastebin.com/2b2N2337

It's pretty big - but, i don't see any scripts or anything obviously malicious. Just looks like spam...

Any insight on this matter is greatly appreciated.

Improve this question
4
  • 3
    Are you familiar with "Stored XSS"? Could it be that? We're only guessing unless we see some code.
    – schroeder ♦
    Commented Nov 13, 2014 at 15:17
  • Stored XSS ? I imagine that's just XSS where the XSS gets saved, instead of triggered? I'm no security expert - but I don't think this is XSS, since there aren't any script tags -
    – rm-vanda
    Commented Nov 13, 2014 at 16:20
  • 1
    Stored XSS is particularly useful in forums where visitors end up sending their session key to the attacker who then logs in as them to post spam. Also, Stored XSS can be made to target the admin tools, so that when an admin reviews logs, etc, the admin ends up sending out their session info.
    – schroeder ♦
    Commented Nov 13, 2014 at 16:25
  • Thanks -! I will have to do some reading up on that, this weekend.
    – rm-vanda
    Commented Nov 13, 2014 at 16:31

2 Answers 2

Reset to default
3

From the sample you provided, it looks like forum spam where the poster is trying to advertise. I was unable to spot anything malicious at first glance, although the target sites might host malware.

It IS possible that they might be trying to trigger a DoS scenario by clogging your forms, but there are more efficient ways to do that.

Just looks like simple spam.

Improve this answer
1

This appears to be standard link farming/blackhat SEO, where the spammer is attempting to increase the google page rank of the target domain by significantly increasing the amount of links to the target website. The nofollow link attribute was introduced to combat this type of attack, but it looks like it may not be applicable in this scenario as the attacker appears to control the html.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .