My site was hacked please help

draco2317

I have a website written in php. When I submited a registration forum it redirects to the verify_login.php script. I changed the name of verify_login.php script to login_check.php, then changed the name of the correct processing script to verify_login.php.

I tried again and the forum redirected to the new login_check.php. Then i created a new folder and moved the registration files and scripts to the new folder and tried again, (this was yesterday 9/17/06) I tried a few minutes ago and the script was trying to access the login_check.php file from the new folder, thus not working, yet again. So I tried again to create a new folder and move the files, this time it didnt work.

Again i combed over the script trying to find something that was out of place. Again i found nothing I could see. I checked all the included files and again, nothing i saw was wrong. I looked for files that did not belong, but since i didnt build the script initially, and i have made some updates myself, and hired a few people to update the graphics, i dont know what should and shouldnt be there anymore.

I know that I am being hacked be cause i get ever so often a member sign up with a url saying with anchor text "try this", I have even tried to alter my .htmaccess to ban the ip address, which seems to have slowed it down. I am just lucky its not a brute force attack.

I am by no means an expert. So something simple could be sticking out in front of my face. Im not asking for someone to correct this problem. Just wondering where i can start looking, and maybe some suggestions to prevent this problem from happening in the future.

Please help. I have been working on this problem for over a month with no luck. My site is not growing because i cant get any new members. If you need to look at the script or website please pm me, cause i dont want to post the url here. Thanks in advance.

mjax

This is not hacking (in my definition), but some form of injection. Probably your scripts are vulnerable to HTML/Javascript injection.

If you could show us some code than maybe we can point out some insecure constructions.

draco2317

Well I dont want to post the whole code at once (its too many charactors anyway) so ill start with the beginning and stop at the java script that makes sure all the required fields are filled out. If thats okay ill post more.

<?
include("../header.php");

if (!isset($year))
{
$year="19";
}
if (!isset($website))
{
$website="http://";
}

?>

<script language="JavaScript">
<!--

function formCheck(formobj){
	//1) Enter name of mandatory fields
	var fieldRequired = Array("name" ,"sex","orientation","phone","marital", "email", "day","month","year", "address", "city", "country", "height","weight","measurements", "hair","eyes","travel","photo_type", "experience", "user", "pass", "agree");


//2) Enter field description to appear in the dialog box
var fieldDescription = Array("Name" ,"Sex","Sexual Orientation","Your phone numbers","Marital Status", "E-Mail","Birth day", "Birth month", "Birth year", "Address", "City", "Country","Height", "Weight","Measurements","Hair","Eyes","Travel or not", "Photo type", "Experience",  "Username", "Password","You must agree to our terms and conditions if you want to join.");
//3) Enter dialog message
var alertMsg = "Please complete the following fields:\n";

var l_Msg = alertMsg.length;

for (var i = 0; i < fieldRequired.length; i++){
	var obj = formobj.elements[fieldRequired[i]];
	if (obj){
		switch(obj.type){
		case "select":
			if (obj.selectedIndex == -1 || obj.options[obj.selectedIndex].text == ""){
				alertMsg += " - " + fieldDescription[i] + "\n";
			}
			break;
//		case "select-multiple":
//			if (obj.selectedIndex == -1){
//				alertMsg += " - " + fieldDescription[i] + "\n";
//			}
//			break;
		case "text":
		case "textarea":
			if (obj.value == "" || obj.value == null){
				alertMsg += " - " + fieldDescription[i] + "\n";
			}
			break;
		default:
			if (obj.value == "" || obj.value == null){
				alertMsg += " - " + fieldDescription[i] + "\n";
			}
		}
	}
}

if (alertMsg.length == l_Msg){
	return true;
}else{
	alert(alertMsg);
	return false;
}
}
//-->
</script>
<style type="text/css">
<!--
.style1 {color: #00FFFF}
.style2 {color: #64adde}
-->
</style>

Salkcin

Never ever rely on javascript validation! always do the validation on the serverside!!

mjax

I stopped reading your post at "the java script that makes sure all the required fields are filled out".

A groundrule of every webapplication from the perspective of the PHP page is to never trust any user input. Always check and filter all data coming from the outside. Javascript checks can be easily circumvented.

Check your PHP code to see where the "try this" URL could have slipped in. Refactor that code to include server side checks and filtering.

draco2317

if i am understanding correctly, you are saying I should 86 the javascript and rewrite the validator in php? I have checked the page for the url and im not seeing anything. Im not a pro, instead a novice at best. I am going to go look for a tutorial on how to rewrite the javascript to php, as i have no clue on how to do it. Thanks for the advice.

NogDog

You do not have to get rid of the JavaScript, but you can not depend on it happening. It can be a convenience to legit users who have JavaScript available, in that it will probably provide a faster response if there is an error. But, if the user does not have JavaScript enabled or if a malicious user is bypassing it (or submitting form data via his own form or script), then any data (or lack thereof) could be received by your script.

Therefore you must ultimately verify and sanitize all user inputs in your server-side script, regardless of whether or not you are also checking them on the client side.

draco2317

I understand now. Now if i could just find out why it redirects to the incorrect page, ill be set. I will comb over the script again.

hagen00

also, google type quote_smart into google and hit I'm feeling lucky!