+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Under Attack] 10K+ Websites Infected In Ongoing Mass SQL Injection Attack (/showthread.php?tid=2367028)
[Under Attack] 10K+ Websites Infected In Ongoing Mass SQL Injection Attack - Mr.Phoenix - Apr 4, 2012
Security experts of Webroot has confirmed that another mass SQL-Injection attack is currently underway. According to the blog post of Webroot "Hundreds of thousands of legitimate web sites are currently affected in a a mass SQL injection attack that has been ongoing for the past several months. The ongoing mass SQL injection attacks, are directly related to last year’s scareware-serving Lizamoon mass SQL injection attacks.
The cyber criminals behind it, are automatically exploiting the legitimate web sites, and embedding a tiny script on the affected pages, abusing an input validation flaw, or exploiting vulnerable and outdated versions of the web application software running on them."
hjfghj.com/r.php – According to Google, 323,000 sites are affected
fgthyj.com/r.php – According to Google, 390,000 sites are affected
gbfhju.com/r.php – According to Google, 74,200 sites are affected
statsmy.com/ur.php – According to Google, 3,080,000 sites are affected
stmyst.com/ur.php – According to Google, 1,320,000 sites are affected
Earlier in 2011 we have also seen such scenario when 614,000 webpages comromised with mass ASP.NET Infection, also Willysy malware Infects More than 6 Million WebSites, Lilupophilupop Attack took 1 Million+ Web-pages and so on. Even in last month we have seen more than 200,000 websites get compromised with fake anti-virus exploit
Google Dorks:
Code
hjfghj.com/r.php
fgthyj.com/r.php
gbfhju.com/r.php
statsmy.com/ur.php
stmyst.com/ur.phpsource:http://www.voiceofgreyhat.com/2012/04/10k-websites-infected-in-ongoing-mass.html
🎉🎉🎉🎉
* - supracontra - Apr 4, 2012
This happens all the time, seems to affect Windows the majority of the time probably due to the ease of OS level axs through the SQL daemon.
Anyway, old news is old.
* - IDrinkMooMooMilk - Apr 4, 2012
Nice, but this isn't SQL?
This more is just an html code that's being injected in tons of websites?
* - supracontra - Apr 4, 2012
The HTML is inserted via SQLi.
I may look into doing something similar in fact, looks interesting.
* - Mr.Phoenix - Apr 5, 2012
Hmmmm :) well :-) i think this will lead to an big attack :-) :-)