Scanning a site for porn/malware links

Customer Support Customer Only Discussion
1

Recently, the CMSes on a couple of clients sites were hacked and porn links were added to their pages. I’ve cleaned up and updated their CMSes obviously. But to monitor for such things in the future, I’d like to set up some sort of automated scanning script. Anyone know of something like that?

I guess some sort of regex looking for common terms kicked off by a cron job is what I’m looking for. I could probably write something myself but I’m not very good with regex. So, maybe someone knows of a published solution.

Thanks,
Tim

2

Don’t know of anything but it sounds interesting.

Maybe even a mapping of links spider type thing, that would be able to report ‘suspicious’ links?

3

Tim,

You want to parse final output (for SQL injections, etc)? or just page infections (IFRAME/Js infections)?

4

I’d like to scan/parse the final output of the pages as generated by the CMS.

In this particular situation, I’m not sure of the attack vector .. the client’s CMS was out of date with known vulnerabilities, but he also used a very insecure password (easily guessable with even modest knowledge about him).

On a more general basis, I’d like to scan a bunch of my client’s sites on a routine schedule.

5

http://www.blueinfy . com/ tools.html
Look for ScanEx. This came as first search result on google.
Since I’ve not used this tool, do scan it before using.
Best if run on a disposable VM.

6

I scan for porn all the time, so if I see any there I’ll let you know. :wink: