I have recently had random spam links inserted into 3 ASP.NET websites. The links are inserted into the physical file so it is not SQL injection attack.

The websites have very little in common other than they are ASP.NET, 2 of them are MVC and 1 is webforms, 2 are c# and 1 is VB, etc.

The server is Windows 2003 with IIS6 and all security updates have been installed. FTP was turned off overnight and an attack still occurred.

Any ideas on how to start troubleshooting this?

EDIT: Turns out the latest updates have not been installed (last update was June 2010) so I'll need to install all of those first before investigating further.

EDIT 2: Latest updates installed and problem has yet to reoccur. Chalk one up for keeping your server up to date.

  • 1
    are there no transaction logs for the forms? If not, check the IIS logs themselves. If you need help deciphering the logs, look here. Search the file for the link to see where it came from and how it was sent. Commented Dec 14, 2011 at 22:51

2 Answers 2


Log files on the server? Would be a start for seeing what is going on. Check your access controls for the site and server too. But if the server has been compromised these won't be reliable.

  • "Log files on the server", would you be able to recommend anything? Commented Dec 15, 2011 at 5:51

Use some file integrity checker like Tripwire (commercial) or AIDE (free) to see which files were being changed, it could give you some insight into what is happening and you'll also have fast way to spot the changed files.

You should also inspect server logs for suspicious activity, check if your file upload script are implemented correctly (not uploading to predictable URL, correct permissions - uploaded files should not have permission to be executed).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .