So, I have a web site that has been compromised twice in two weeks. every index.php and .js file gets a script injecting into the source code of the file. The problem is that I have no idea how they're doing it. I've seen this done via sql injection before, but I don't know how they are actually writing to the file. I've dug through the Apache logs but didn't find anything interesting. The site is built using the cakephp framework on a godaddy shared server.

Anybody know what secturity settings or log files to check to see how they are doing this?

migrated from stackoverflow.com Jun 14 '10 at 14:46

This question came from our site for professional and enthusiast programmers.

  • 4
    On shared hosting the problem could also be on a different site of the same server. The whole server could be compromised. – Fabian Jun 14 '10 at 12:26
  • how can a .js file "get" a script. furthurmore, how can whatever the .js file got inject into the source code of what. you need to rewrite the question... – Longpoke Jun 14 '10 at 14:43
  • @longpoke additional code was added to every .js file on the site. – pinniger Jun 14 '10 at 15:05
  • @pinnigger: Then they have access to the filesystem. Perhaps because there is a vulnerability in your php source, or they have compromised your machine and keep getting your new passwords from that. Or perhaps because the GoDaddy server is insecure in which case there's nothing you can do to fix this. IIRC GoDaddy is retarded and lets other people with accounts access your web stuff if it's chmodded with public write access. – Longpoke Jun 14 '10 at 15:31

Based on the injected files, and it being hosted on GoDaddy, I would take a look at Sucuri.net's blog posts about the continuing infection of websites on GoDaddy's shared servers over the past month.

I would start here: http://blog.sucuri.net/tag/godaddy


  • +1 good link. Its well known that GoDaddy has some major problems with security. – Rook Jun 14 '10 at 15:48
  • +1 Looks like OP should leave GoDaddy and never go back... – Longpoke Jun 14 '10 at 15:49

This is not sql injection. This is a worm, and getting this level of access with a worm on a custom site isn't realistic. I know this because I write exploits that worms use to spread, and I'm telling you its defiantly not sql injection under MySQL (MS-SQL is a different story, the attacker has xp_cmdshell()).

Never the less you should scan your site for vulnerabilities using both w3af(free) and Wapiti(free), or Acunetix($), or the best tool NTOSpider($$$).

First of all I would make sure all of your libraries are up to date. Any machines with FTP access must be scanned with an anti-virus. I know GoDaddy only has FTP access, because they obviously don't care about security. There are worms that sniff for FTP logins and then infect the site, these are very successful worm because of idiots like GoDaddy. If you don't want to spring for the cash, running AVG on your local system which is better than nothing.

Usually when you are infected Google will throw a browser warning and they will tell you the name of the worm. If you search for the name often times someone has done analysis and that will tell you how it is spreading.

  • antivirus?? please. – Longpoke Jun 14 '10 at 14:41
  • 1
    @Longpoke yeah if his local machine has a virus that is sniffing for ftp, then yeah he needs an anti-virus. I have personally cleaned up sites that where affected by this. – Rook Jun 14 '10 at 14:42
  • I dont think its sql injection either, my db is clean. anyway, the url the script is requesting a file from is "kollinsoy.skyefenton.com:8080/XML.js" (dont go there). is a sniffer the only way to get ftp password? i've ran McAfee and malwarebytes, but they came up empty. – pinniger Jun 14 '10 at 15:12
  • 1. Any two-bit programmer can write malicious code that wont be detected by antivirus (ESPECIALLY for web languages which av is typically weaker in) 2. How do you know this is a worm... 3. The entrypoint of the attacker very well could have been SQL injection, there is no way for you to know. For instance, the attacker could have used obtained the database and the admin had the same password in the db as the web host, or the sql server could have been on the same host, and he used load_file() (I'm assuming this is MySQL here) to read some configs and win. – Longpoke Jun 14 '10 at 15:22
  • 4. No, Google browser wont magically know you are infected and tell you (only if you're lucky). – Longpoke Jun 14 '10 at 15:24

Change the credentials for your database, and ftp logins and update the security salt etc in your app/config/core.php.

Although as Fabian said, if you are on a shared server you are at the mercy of everyone elses code also. Do as much as you can and let GoDaddy know about it also.

You might also code a helper which specifically look for this code and strips it from your files when they are executed.

  • I don't think this will help. – Rook Jun 14 '10 at 14:40
  • "if you are on a shared server you are at the mercy of everyone elses code also" No, that's not true for any sane shared hoster, you shouldn't be able to access other people's sites on it. If this is the case, OP needs to move to another host. – Longpoke Jun 14 '10 at 15:50
  • Not access them, but if the host goes down due to someones crap code, or gets ddos'd because they are targeting a specific site, is more what I meant. – David Yell Dec 3 '12 at 9:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.