I am working on a Wordpress website that has been hacked. Let's say that it's
http://thewebsite.example. There is no malware that infects people that open this website, but there is a URL
http://thewebsite.example/xyz/ and over there is some other website, that looks like some internet book store. When I click something it redirects me to some foreign website, let's say
http://thewebsite.example website directory there is no
xyz/ subdirectory. I was grepping the whole directory using parts of code or text from what is displayed under
http://thewebsite.example/xyz/ but found nothing. I have no idea where is the infection.
I tried to locate the redirect by checking .htaccess - it's not there. By doing
grep -r "header('Location" ./ but there is no redirect done in PHP files. I tried looking for base64 encoded PHP files or some JS infections, but found nothing suspicious.
So I wanted to check how the redirect is being done, is it 301, 302. But doing wget shows no redirection. The content of the URL is being loaded from server of
http://thewebsite.example. The same with cURL - doing
curl -I http://thewebsite.example/xyz/redirecting-url/ shows me:
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Date: Fri, 08 Mar 2019 08:30:33 GMT
No redirection, just 200 OK. So the redirection must be encoded in PHP or JS files, right? Could it be set in cookie? How can I check, for example using browser "web developer options" what is causing the redirection? It would help me to locate the infection.