Hacked website

Hi there. I am a complete newbie to modx. A previous employee left who was administering our website and this has been passed to me.

The output from webalizer shows that a number of links to viagra and other undesirable sites. There are no links to these sites in the home page or other pages as I have searched the database by logging in to it and also searched on the server for any files containing the word viagra. The only files it finds are those in the access logs.

I wonder how I could find any links in the modX framework which are causing this to happen.


Thank you.

These links are usually generated by Javascript that is inserted into your pages. What version of MODx are you using?

I am using 1.0.6

Yes I thought it might be some javascript but have no idea where to find the code that injects this.

Do a search for a phrase via Google for your site and click through from Google results to the site, then see if you see links. There is an old hack that only triggers for people who visit your site via search engine.

Is there any redirection code for off-site links? Sometimes these can be spoofed through simple URL injection to create fake backlinks with an aim to increase the destination site's page rank.

Quote from: smashingred at May 07, 2013, 01:42 PM

Do a search for a phrase via Google for your site and click through from Google results to the site, then see if you see links. There is an old hack that only triggers for people who visit your site via search engine.

Hi Jay,

Thanks. Yes on searching via Google for my site with a phrase there are lots of links.

Do you know how I can find out more details about what this hack is called, how I stop it continuing and what if anything, I can do about the links?

Quote from: absent42 at May 07, 2013, 02:44 PM

Is there any redirection code for off-site links? Sometimes these can be spoofed through simple URL injection to create fake backlinks with an aim to increase the destination site's page rank.

Do you know how these are being spoofed and how to check or stop this?

Quote from: [email protected] at May 08, 2013, 04:23 AM

Do you know how these are being spoofed and how to check or stop this?

Usually the url for a redirect will be something like http://yourdomain.com/redirect.php?url=http://theothersite.com

This generates a page with an offsite redirect, these are then submitted to link sites to be crawled by search engines. This is the way blackhat SEO people create .gov backlinks.

Best way to stop it is not to use a redirect script, or us one that will only accept post requests from within your own domain.

Hi Dan

I feel like I'm getting closer to the answer now thanks to this insight.

When I search in Google then the link appears as
https://www.google.co.uk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&ved=0CDAQFjAA&url=http%3A%2F%2Fwww.lyonsdown.co.uk%2Fbuy-viagra-uk-online.html&ei=JoiKUeXNJoa9PevxgYAF&usg=AFQjCNEcGfADn19KBY5OZabe8oAySFqmHw&bvm=bv.46226182,d.ZWU

How do check in modx if there is a redirect script or limit requests to our domain?



Quote from: absent42 at May 08, 2013, 12:12 PM

Quote from: [email protected] at May 08, 2013, 04:23 AM

Do you know how these are being spoofed and how to check or stop this?

Usually the url for a redirect will be something like http://yourdomain.com/redirect.php?url=http://theothersite.com

This generates a page with an offsite redirect, these are then submitted to link sites to be crawled by search engines. This is the way blackhat SEO people create .gov backlinks.

Best way to stop it is not to use a redirect script, or us one that will only accept post requests from within your own domain.