6 {{ upvoteCount | shortNum }}
6 {{ upvoteCount | shortNum }}

Is this an XSS attempt on my site?

by markowe
5 replies
My site is running Wordpress 3.0.2 (yeah yeah, gonna upgrade to 3.0.4) and is quite new, and I just got some sort of bot hammering it with these kinds of requests:

Code:
http://mysite.com/in%20b?b.using.call(a,d):f.css(d) } };c.fn.extend({position:function(){if(!this[0])return%20null;var%20a=this[0],b=this.offsetParent(),d=this.offset(),f=/^body|html$/i.test(b[0].nodeName)?{top:0,left:0}:b.offset();d.top-=parseFloat(c.curCSS(a,
and then

Code:
http://mysite.com/+b]):f===v?c.css(e,d):this.css(d,typeof%20f===
and so on. I've got a gazillion websites out there, and I have never actually seen this, but it seems to be an attempt to run some sort of code, though I have no idea how that would work (unless there is a known issue with WP).

Should I be worried? I will block the bot or whatever it is, but I have better things to do than spend all my time in my .htaccess file...
#attempt #site #xss
  • Profile picture of the author anestbaik
    Originally Posted by markowe View Post

    My site is running Wordpress 3.0.2 (yeah yeah, gonna upgrade to 3.0.4) and is quite new, and I just got some sort of bot hammering it with these kinds of requests:

    Code:
    http://mysite.com/in%20b?b.using.call(a,d):f.css(d) } };c.fn.extend({position:function(){if(!this[0])return%20null;var%20a=this[0],b=this.offsetParent(),d=this.offset(),f=/^body|html$/i.test(b[0].nodeName)?{top:0,left:0}:b.offset();d.top-=parseFloat(c.curCSS(a,
    and then

    Code:
    http://mysite.com/+b]):f===v?c.css(e,d):this.css(d,typeof%20f===
    and so on. I've got a gazillion websites out there, and I have never actually seen this, but it seems to be an attempt to run some sort of code, though I have no idea how that would work (unless there is a known issue with WP).

    Should I be worried? I will block the bot or whatever it is, but I have better things to do than spend all my time in my .htaccess file...
    maybe

    i try to google and found about "Picasa album gallery", did you use that plugin?
    because sometimes plugin sent and receive data from outside ..
    Signature
    CLONING ANY SITE to WORDPRESS THEME

    CONVERT JPG / PDF / HTML to WORDPRESS THEME
    {{ DiscussionBoard.errors[3259769].message }}
    • Profile picture of the author joe12joe
      Originally Posted by anestbaik View Post

      maybe

      i try to google and found about "Picasa album gallery", did you use that plugin?
      because sometimes plugin sent and receive data from outside ..
      ya i agree. Its a pluggin. You can easily disable it or delete it complete.
      {{ DiscussionBoard.errors[3264026].message }}
  • Profile picture of the author donnan
    It looks like it's a call to receive data.

    Just block it in your .htaccess that should fix the problem. You know if it's an attack because as soon as you block it you will get another start from a different IP.
    {{ DiscussionBoard.errors[3261193].message }}
  • Profile picture of the author markowe
    Thanks, I am mostly using the standard plugins, but there is one I find a bit suspicious, think I will get rid of that, and also block it in .htaccess. It could be 'phoning home' for some unknown purpose of its own. All my other plugins are standard ones I have used before (AIO SEO etc.)

    Thanks.
    Signature

    Who says you can't earn money as an eBay affiliate any more? My stats say otherwise

    {{ DiscussionBoard.errors[3264060].message }}
    • Profile picture of the author twmaffun
      Ive had the same issue, and it was infact the plugin.
      {{ DiscussionBoard.errors[3267793].message }}

Trending Topics