Web Hosting Talk : Web Hosting Main Forums : Hosting Security and Technology : Cross scripting attack

[Jinii]

On IIS6 many of thesite are under cross scripting attack I tried by remove the the code but it affects again after some time I reset the ftp password and passowrd is a combination of complex alpna numeric character.I have cheked the permission it is ok.

How you guys fight with cross dcripting attack.

[zoticaic]

Raise this with the developers of the code as they wrote thet vulnerability or take down their code (not the code resulting from the XSS but the exploited script) temporarily.

[Jinii]

the code is already reviewed by the web developers they says that the issue is associated at server side.

[Harzem]

Then you have to give us more details about the hack. What do they hack? Which files or databases are affected? How are they affected?

[zoticaic]

I'd not count this totally being server side, as XSS generally occur on front-end applications with an exploitable input.

[Jinii]

Originally Posted by Harzem

Then you have to give us more details about the hack. What do they hack? Which files or databases are affected? How are they affected?

Most of the effected sites are php and asp based in the sites all the pages were injected with a seris of XCC1/XCC2/XCC3..... and injected with P**N url google also claimk that the site as active harmful threats.

[lazat]

Once we had a customer that got hacked the hole time. The hacker hacked the web designers computer and installed a trojan and downloded the ftp programs settings and used that to login to the account.. It took a while before we understanded how the hacker got the password that we changed a lots of times...

[Jinii]

Any suggestion?

[mwatkins]

XSS attacks (and SQL injection) are performed by shoving malicious content into a poorly written application.

You've mentioned changing FTP passwords and such; if attackers are gaining their foothold first via insecure FTP, this is not the same thing as XSS.

Which is it? Is malicious content getting in via your FTP or via the applications? If you can't determine which, you need to hire some help.

[Babushka99]

Reverse proxy in front?