TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Customer got hacked via .htaccess

5 点作者 sxsde大约 12 年前

3 条评论

mschuster91大约 12 年前
Just wtf does this code do? Is it supposed to fake page views on that cavadini.savedalyfield.com site in line 40?<p>Lines 4-8 make the whole stuff only match on people redirected to the hacked site by facebook, twitter and searches. 9-32 block out search engines, maybe to prevent stuff like Googlebot detecting the malware. The LNr env variable set on 39 acts as a primitive switch jumptable for the "cases" in 42-161... which redirect the browser using HTTP 302 Temporary Redirect to various subelements on cavadini.savedalyfield.com.
评论 #5369780 未加载
dwj大约 12 年前
I think the customer got hacked some other way, and the hacker just wrote to the .htaccess file AFTER hacking the site. Probably the .htaccess is a quick and easy way of taking over the website.
zorlem大约 12 年前
A customer of mine had practically the same .htaccess file installed through an exploit in a custom PHP software he had written. The difference was with the URL it was pointing to, in my case it was battocletti.theroguedisc.com . The .htaccess was installed on 2012-11-21, but by the time the customer asked for my help cleaning up, the domain was no longer available.