当前位置:网站首页>What are the forms of attack and tampering on the home page of the website
What are the forms of attack and tampering on the home page of the website
2022-04-23 12:34:00 【websinesafe】
Let's take a look at several forms of website hacking , In all the work orders I have handled, it is the customer's problem , Basically, if his website is hacked , This is the 4 In the form of . The first page of its website index.php Be tampered with , the second , Added a third party to his website JS Jump code , The third added a home page file ,index.html, The fourth is the third one 301 Retargeting term . In view of these situations . We . Now let's show you . In fact, it was hard to find yesterday , Because we have dealt with the customers who were hacked before , Then I found a hacked original program file from the local computer , This is a diagnostic kit for the customer , Then I have backed up this diagnostic package to the local , Then I'll pack it online now , Then let's take a look and demonstrate this effect .
After uploading, I unzip it . Drag the file out , After dragging it out , Then let's restore this website now , After restoration , Here we need to compare that with the one under the directory install Delete a file inside , Why delete , Because if you don't delete it , Your website can't be rewritten and installed , Because this file is used to check whether your website has been successfully installed , After deletion , Then let's reinstall .
My database is ACSESS, What we said here just now is that we should have , Security awareness can't be set so simple , Because I used to operate locally before , So often admin, So let's make it a little more complicated , You include the cell phone number here , We need to fill in the real , At that time, your website background will find the password , And including these mailboxes , Fill in the real one . Of course, this is not my email , I'm just saying demonstrate , I tell you to fill in your real email here , Then we log in to the background now .
good , After logging into the background , Then we import in a data of this user , After importing in , Then let's take a look at this website , Can you see , My website looks normal , Can't you see any sign of being hacked , Now let's take a look at , If we go to modify the content , See if there's a problem ? For example . I'll go to the website computer here , This is one of our 5.3.6 An old system version of . We are now 7.0 Words , So why is functionality becoming more and more powerful , Is to support visual editing , Look at an old version of the previous , Relatively speaking , One of its modifications is not very convenient , For example, I would like to modify a content of our home page .
For example, I modify a message in this profile , I'll add one here , Then save , After saving , Then let's take a look . It still works here . Now let me set the priority , Because many users , He may be a priority for his website to access files , The latest visit is this index.html, That may be the case . If you open the home page directly, you will jump to other websites , Because the code I modified contains the jump function .
Next, let's take a look at our website , See if it will have a jump . Did you find out? No, he's jumping now , So basically, one of us was hacked and his one . The forms of expression are basically these . The first is through . Tamper with your index file , The second is that it can add a third party js Adjust the code , The third new homepage file , Second point html, The fourth is what I just demonstrated 301 Retargeting term , So it's basically one of our blackened performance forms , Basically, it's just these . If there is a situation that has been tampered with repeatedly and you can't solve it , You can tell the website vulnerability repair company SINE Seek technical support for security .
版权声明
本文为[websinesafe]所创,转载请带上原文链接,感谢
https://yzsam.com/2022/04/202204231225471077.html
边栏推荐
- 航芯技术分享 | ACM32 MCU安全特性概述
- Markdown语法学习
- mysql中 innoDB执行过程分析
- Uni app native app local packaging integrated Aurora push (jg-jpush) detailed tutorial
- BUUCTF WEB [BUUCTF 2018]Online Tool
- Source code analysis of synchronousqueue
- Qt重绘事件与剪切
- Number of nodes of complete binary tree
- php生成json处理中文
- Luogu p5540 [balkanoi2011] timeismoney | minimum product spanning tree problem solution
猜你喜欢
NPDP|产品经理如何做到不会被程序员排斥?
STM32工程移植:不同型号芯片工程之间的移植:ZE到C8
SSL证书退款说明
【每日一题】棋盘问题
Analysis of InnoDB execution process in MySQL
Why is there a wrapper class? By the way, how to convert basic data types, wrapper classes and string classes?
九十八、freemarker框架报错 s.e.ErrorMvcAutoConfiguration$StaticView : Cannot render error page for request
[redis series] redis learning 13. Redis often asks simple interview questions
Idea code quality specification plug-in sonarlint
基于卷积神经网络的遥感影像分类识别系统
随机推荐
Qt进程间通信
S2-062 remote command execution vulnerability recurrence (cve-2021-31805)
航芯技术分享 | ACM32 MCU安全特性概述
QT draw text
【微信小程序】z-index失效
第二十三课 临时对象
Intelligent multi line elastic cloud adds independent IP address. How to realize multi line function?
BUUCTF WEB [BJDCTF2020]ZJCTF,不过如此
大家帮我看一下这是啥情况,MySQL5.5的。谢了
QT draw image
Next. JS static data generation and server-side rendering
软件测试基础DAY2-用例执行
Lesson 23 temporary objects
Buuctf Web [bjdctf2020] zjctf, but so
一个平面设计师的异想世界|ONES 人物
The maximum number of remote desktop servers has been exceeded
对称加密、证书加密
第二十四课 经典问题解析
Labels and paths
Solution of asynchronous clock metastability -- multi bit signal