返回列表 发帖

[转载] Microsoft Defaced, again!

Very little time has passed from the last Microsoft defacement (Microsoft Technet), when yesterday Saudi Arabia crackers successfully compromised another Microsoft website: Microsoft.co.uk at the page http://www.microsoft.co.uk/events/ne...x?eventid=8399.

At the time being, the defacement is still up and running even though not every browser will be capable to show it as too many users are trying now to load the hacker's injected CSS (Cascading Style Sheet) located on an external host (h.1asphhost.com) which now has is suffering slow response time.

By analyzing the HTML source code of the defaced page we can see some "extra" HTML code:

"<link xhref=http://h.1asphost.com/remoter/css.css type=text/css rel=stylesheet>".

The technique used by the attacker to deface Microsoft's page is probably based on a kind of SQL flaw (sql injection). In fact, after a short investigation we noticed how the V2 parameter passed to the PreRegister.aspx script, allows to execute both Cross Site Scripting attacks (www.microsoft.co.uk/events/net/P ... entID=p8399&v2="><script>alert(/XSS/)</script>) as well as SQL injection attacks, as you can deduct from the debug error message generated by the application.

Most probably, the attacker exploited the site by means of SQL injection to insert the HTML code "<link xhref=http://h.1asphost.com/remoter/css.css type=text/css rel=stylesheet>" in a field belonging to the table which gets read every time a new page is generated. To discover the name of the table the attacker might have queried the database trying to read the system table "SysObjects" or even the INFORMATION_SCHEMA.TABLES view. We are just speculating here as the DBMS is most probably a MS SQL Server.
借我三千虎骑,复我浩荡中华!饮马恒河畔,剑指天山西;碎叶城揽月,库叶岛赏雪;黑海之滨垂钓,贝加尔湖面张弓;中南半岛访古,东京废墟遥祭华夏列祖。汉旗指处­,望尘逃遁——敢犯中华天威者、虽远必诛

偶没过CST4
天行健,君子以自强不息
地势坤,君子以厚德载物
黑色海岸线欢迎您

QQ群:7212260
致力于探索WEB技术精髓:http://www.bitechcn.com
点这里加我!

TOP

黑客宴会
一个很有个性的人一个可以信赖的人一个能够作朋友的人 

TOP

伊朗黑客入侵了微软的网站?!

英文大测试
哈哈
借我三千虎骑,复我浩荡中华!饮马恒河畔,剑指天山西;碎叶城揽月,库叶岛赏雪;黑海之滨垂钓,贝加尔湖面张弓;中南半岛访古,东京废墟遥祭华夏列祖。汉旗指处­,望尘逃遁——敢犯中华天威者、虽远必诛

TOP

返回列表 回复 发帖