security - Javascript injected into URL - Stack Overflow

admin管理员组

文章数量:1278793

We have a relatively popular website, and recently we started seeing some strange URL's popping up in our logs. Our pages reference jQuery and we started seeing pieces of those scripts being inserted into URL's. So we have logging entries like this:

    /js/,data:c,plete:function(a,b,c){c=a.responseText,a.isResolved()&&(a.done(function(a){c=a}),i.html(g?d(

The User Agent string of the Request is Java/1.6.0_06, so I think we can safely assume it's a bot that's probably written in Java. Also, I can find back the piece of appended code in the jQuery file.

Now, my question is why would a bot try to insert referenced Javascript into the URL?

We have a relatively popular website, and recently we started seeing some strange URL's popping up in our logs. Our pages reference jQuery and we started seeing pieces of those scripts being inserted into URL's. So we have logging entries like this:

    /js/,data:c,plete:function(a,b,c){c=a.responseText,a.isResolved()&&(a.done(function(a){c=a}),i.html(g?d(

The User Agent string of the Request is Java/1.6.0_06, so I think we can safely assume it's a bot that's probably written in Java. Also, I can find back the piece of appended code in the jQuery file.

Now, my question is why would a bot try to insert referenced Javascript into the URL?

• javascript
• security
• http
• code-injection

Share Improve this question Follow asked Feb 16, 2012 at 14:01 ThomasThomas 8,01344 gold badges4040 silver badges4646 bronze badges 1

• Other good fora for questions like this are security.stackexchange. and sla.ckers – Mike Samuel Commented Feb 16, 2012 at 16:06

Add a ment  | 

2 Answers 2

Sorted by: Reset to default 8

It may not be specifically targeted at your site -- it may be a shotgun attempt to find XSS-able sites so that an attacker later can figure out what's stealable and craft an attack and write a web-page to deploy it against real users.

In that cases, the attacker may use bots to collect HTML from sites, and then pass that HTML to instances of IE running on zombie machines to see what messages get out.

I don't see any active payload here so I assume you've truncated some code here, but it looks like JSCompiled jQuery code that probably uses jQuery's postMessage so it's probably an attempt to XSS your code to exfiltrate user data or credentials, install a JavaScript keylogger, etc.

I would grep through your JavaScript looking for code that does something like

eval(location.substring(...));

or anything that uses a regexp or substring call to grab part of the location and uses eval or new Function to unpack it.

Checking for Cross Site Scripting vulnerabilities, maybe.

If the bot detects a successful injection, it might inject dangerous code (e.g. stealing your users' passwords or redirecting them to malicious sites).

本文标签： securityJavascript injected into URLStack Overflow