One of our websites got hacked over the weekend. The attack used a .net script to hack to the root directory of the site and allowed the scumbag…errr… hacker to replace the default page.
I downloaded a copy of the files (a.aspx, default.asp) and sent them in on a support ticket, deletd them from the site, changed all passwords and replaced the default file with the one in our archives. I also alerted image shack that an image file hosted by them was being used in the hack, and if appropriate, they should report it to the authorities.
My immediate concern is that the server may still be vulnerable to this kind of hack. Ashwani thanked me for my concern, but I just wanted to be sure that this hack cannot happen again.
Thanks for the concern, but most of the time this is due to site level code insecurity rather than asp.net insecurity, such as allowing a remote include as in this case.
The thing is that the public part of this site only has a few queries, all in classic asp, all of which use regular expressions to validate URL parameters (only integers are allowed). The majority of the site is plain html and other than a couple of mail forms, no public user input is provided. The database was not hacked with any injection scripts.
The admin console does allow site administrators to update content via classic asp, but all pages in that directory use a session variable for authorization. AFAIK, this is fairly robust.
This seems to be a new hack; not sure if you’ll have time or opportunity to look at it, but any information about how I could adjust the code would be great, as the code on this site is the same as many others…
looks like all the pages of yours(even in different usernames) were hacked using the same means…which I am still trying to determine, each within about 10 minutes. Digging out the logs and comparing them as well.