url hijacking?

Hi eveyone,

recently one of the sites I built using evo had strange url change.
the url for the site changes to this

this affects all my site urls in navigation as if my [(site_url)] is messed up.

testtree.com looks like a respectful software company so I don't get whats happening. if it was porn site or similar I would be sure the site being compromised.

what makes it even more strange is that once I deleted the site cache from the manager the issue disappear. but this is the second time it happened withing a month. again clearing the cache resolved it.
I noticed that the docs cleared in the cache are my contact page (eForm) and some stylesheet.css file I have within modx.

did anyone experienced this before? do you also think the site has been compromised ?

will appreciate any comments.

I would do a global search through the files as well as through the database looking for that URL. The URL itself results in an attempt to fopen() the URL with a permission denied error. It looks as though they had Testree testing their site, although why the testing URL should be in any way associated with your site is a good question.

Is your site in any way associated with roomdividersny?

Scan all your webpages for inserted code that is not yours, for example iFrames.
Greetings Brian.

sorry Susan I wasn't clear enough, roomdividersny is my client. test tree has nothing to do with us.

Check the permissions on your cache directory. Maybe someone has found a way to write to it.

BTW, you're the second person with this problem, though I don't think siteTree was involved with the other case.



------------------------------------------------------------------------------------------
PLEASE, PLEASE specify the version of MODX you are using.
MODX info for everyone: http://bobsguides.com/modx.html

@BonRay, isn't the cache folder must be chmod 777 anyway?

I searched the whole /www/ dir for testtree and couldn't find nothing.


also searched in phpmyadmin without any luck.

since then I stupidly updated the site to the latest evo release, killing my chance of finding last modified files with find -mtime.

I guess I'll have to wait and see if it happens again and then to search for the last modified files to look if I have injected code in there.

for now I just changed all the passwords for ssh plesk and databases.

Hello,
You could try to apply a reverse logic.

Not everyone is skiddies, if someone is mean-spirited, probably will have some form of obfuscated and will not find in any place called "theattacker.com"

Make a web scanner, with DirBuster in mode "pure force",
In the first stage, DirBuster going to try to make a map of your site, analyzing the output of your first page, and in the first results should notice calls to a real directory, from the redering of the page.
If something catches your attention, as a directory that has been recognized,
but no calls are known to these directories in your web page, can be to indicate that you have something hidden in there.

after a while you will notice a series of results with error 500 and directories unknown at this time the "pure force" is doing its normal job, and this does not need you, so what, you can stop the scan.

You can apply this technique to other directories on your website.

a small observation, surely you will know: the majorities of the attacks are hidden in legitimate web, and what has happened, can only be a test of kidnapping, and not draw attention way too, is tested with a legitimate hostname.

Regards. [ed. note: rtoskit last edited this post 14 years, 2 months ago.]