网站中插入的数据 - 安全问题
我的一个网站存在安全问题，我很不确定如何防止这种情况，因为我从未遇到过类似的问题。我有一个 php 驱动的网页，一夜之间有人设法
<iframe src="http://<webaddress>.com/" width="1" height="1" frameborder="0"></iframe>
将 body 标记后粘贴到 php (!) 文件中。
是什么让这样的事情成为可能？我该如何防止这种情况发生？
感谢您的帮助！
梅尼
I have a security issue on one of my websites and I am quite unsure how to prevent this, as I never had a similar problem. I have a php driven webpage, and over night someone somehow managed to paste
<iframe src="http://<webaddress>.com/" width="1" height="1" frameborder="0"></iframe>
right after the body tag into the php (!) file.
What would make something like that possible? And how do I prevent this?
Thanks for any help!
Maenny
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
很多时候，这是由于您的 FTP 凭据被盗造成的。更改它们，删除恶意代码，并尝试始终通过安全连接连接到您的服务器。这是 joomla、wordpress 和其他流行 CMS 中的常见攻击；通常有许多文件（例如所有的 index.php 文件）受到攻击。
Many times this is the result of your FTP credentials being stolen. Change them, remove the malicious code, and try to always connect to your server over a secure connection. This is a common attack in joomla, wordpress and other popular CMSs; and it's usual to have many files (all your index.php files for example) attacked.
我们已经看到许多插件、扩展等被用作网站的入口点。
黑客不断地试图隐藏他们的“商品”，这样他们就可能不会感染您的所有索引文件，而只是尝试“在雷达下飞行”。
至于删除该行，它可能不会像您在浏览器的“查看源代码”中看到的那样。它将被混淆（编码）。
如果不知道您的网站或在那里运行的内容（即 WordPress、Joomla 等），很难告诉您在哪里查找混淆代码，但是，您可能会查看 header.php 文件或正在生成的任何文件您的身体标签的代码。您可能会在正文标记之后看到脚本标记，并且您可能必须一直滚动到正文标记所在行的末尾才能看到恶意脚本。黑客喜欢添加大量额外的空格来尝试隐藏他们的恶意脚本。
然后您必须查看哪些文件已添加到您的网站。或者，如果您有良好的备份，您可能需要删除站点上的所有文件并从备份中恢复它们。这可能是找到后门的唯一方法。后门是黑客用来上传一些其他受感染文件的文件。它们可以是 PHP 或 Perl。
最后，您必须确定它是如何发生的。您有权访问您的访问日志吗？如果是这样，请扫描它们。查找看起来不正确的字符串。有时，您可能会在日志中搜索字符串“base64_decode”，因为黑客有时喜欢使用该字符串来上传恶意代码。
保持所有软件：WordPress、Joomla、Drupal、Zen Cart、osCommerce 等始终更新。还要保持所有附加组件等的更新。
We've been seeing many plugins, extensions, etc. being used as the point of entry to a website.
Hackers are constantly trying to hide their "wares" so they may not infect all of your index files, just a few to try and "fly under the radar".
As far as removing that line, it's probably not going to look like what you see in the "view source" of your browser. It's going to be obfuscated (coded).
Without knowing your website or what you're running on there, ie., WordPress, Joomla, etc. it's difficult to tell you where to look for the obfuscated code, however, you might look in header.php files or whatever file is generating the code for your body tag. You might see script tags right after the body tag and you may have to scroll all the way to the end of the line with the body tag in order to see the malscript. Hackers like to do add lots of extra spaces to try and hide their malscript.
Then you'll have to see what files have been added to your site. Or, if you have a good backup, you might want to delete all the files on your site and restore them from backup. That might be the only way to find any backdoors. Backdoors are files hackers use to upload some of their other infected files. They can be PHP or Perl.
Last, you'll have to determine how it happened. Do you have access to your access logs? If so, scan them. Look for strings that don't look right. Sometimes you might search the logs for the string, "base64_decode" as hackers like to use that at times to upload their malicious code.
Keep all software: WordPress, Joomla, Drupal, Zen Cart, osCommerce, etc. updated at all times. Also keep any add-ons, etc. updated as well.