Attempted exploit?

F

4

11

I saw that my nopCommerce site had a logged search for:

ADw-script AD4-alert(202) ADw-/script AD4-

I'm a bit curious though what they were trying to accomplish. I searched a bit for it and appearently the ADw-script AD4- encodes in UTF7 to <script>. But why the alert(202)?

Were they just checking for vulnerabilities?

More hacking attemps was logged and I made a new question about them here: Hacking attempt, what were they trying to do and how can I check if they succeeded?

Fusilier answered 1/3, 2011 at 10:46 Comment(0)

P

9

Someone is checking if you have a UTF-7 injection vulnerability to exploit it later. UTF-7 uses only characters that are usually not considered harmful. Do you always use meta charset in your HTML?

Always use meta charset as high as possible in your HTML, like this:

<!doctype html>  
<html lang="en-us">
<head>
  <meta charset="utf-8">
  ...

and you won't have to worry about UTF-7 based XSS attacks.

Perr answered 1/3, 2011 at 10:57 Comment(3)

Actually, I can't find the meta charset tag in my page. I am using the default nopCommerce platform. Is this perhaps a known vulnerability in nopCommerce? – Fusilier 1/3, 2011 at 11:10

If you don't use meta charset then it is an XSS vulnerability for your visitors using Internet Explorer if you ever happen to display any user input. See: Wikipedia, Doctype and UTF-7 XSS Cheat Sheet – Perr 1/3, 2011 at 11:15

It seems like the search didn't catch the first "+" so I was probably safe. I have added the charset tag now. Thanks! :) – Fusilier 1/3, 2011 at 13:2

M

3

Yup , they were just checking if your site is vulnerable for XSS.

Read http://www.cgisecurity.com/xss-faq.html

and Rsnakes XSS cheat-sheet

http://ha.ckers.org/xss.html

for more info

Moralez answered 1/3, 2011 at 10:51 Comment(0)

B

2

Presumably seeing the alert(202) execute would allow the attacker to decide whether it was feasible to inject JS onto your page. In other words, yes, you were probably being probed.

Butte answered 1/3, 2011 at 10:50 Comment(0)

F

0

If you want to be safe from these types of Injections, you must specify a Content-Type.

Try to put the Content-Type in headers instead of meta tags if possible. If you want to do it in php, you can do

<?php
    header('Content-Type: text/html;charset=utf-8');

at the top of your php application. If for some reasons you can't do it, you can put it in your meta tags:

<!DOCTYPE HTML>
<html>
    <head>
        <meta charset="utf-8">
        ....Rest of your page

Fannyfanon answered 11/9, 2014 at 8:38 Comment(0)

Recommended topics

Hot tags