Hacker Problem

[Neil]

Hi,

I have a website hosted on MS IIS.

It has a news section fed by a database to allow the owners of the site the
ability to update the news pages themslves.

Last week a message was added by an Iranian hacker (see the end of this
post.)

What I don't understand is how they were able to do this.

The code checks for the existance of a session variable before alowing the
page to be displayed, so how could they create this variable?

Also, (from the log file,) they jumped right into the update page, not the
form where the message is created!

Any opinion would be greafully received, especially if a solution can be
suggested!!

Best reagrds

NEIL

Message:

H4cked By Mafia Hacking Team Black Hat - 16 September 2006 at 14:39

Iranian Hackers Are The Best---Darkl0rD Was Here---**** Pop---Only For
Islam

(e-mail address removed)

 

[Mike Brind]

Hi,

I have a website hosted on MS IIS.

It has a news section fed by a database to allow the owners of the site the
ability to update the news pages themslves.

Last week a message was added by an Iranian hacker (see the end of this
post.)

What I don't understand is how they were able to do this.

The code checks for the existance of a session variable before alowing the
page to be displayed, so how could they create this variable?

Also, (from the log file,) they jumped right into the update page, not the
form where the message is created!

Any opinion would be greafully received, especially if a solution can be
suggested!!

Best reagrds

NEIL

Message:

H4cked By Mafia Hacking Team Black Hat - 16 September 2006 at 14:39

Iranian Hackers Are The Best---Darkl0rD Was Here---**** Pop---Only For
Islam

(e-mail address removed)

He's been busy according to Google. And he seems to like ASP sites
that deliver stories in a file called news_item.asp and use the
querystring NewID. That's probably not all that you have in common.

http://www.hyannispoint.com/webdev/webdev_vulnerabilities.asp

 

[Neil]

He's been busy according to Google. And he seems to like ASP sites
that deliver stories in a file called news_item.asp and use the
querystring NewID. That's probably not all that you have in common.

http://www.hyannispoint.com/webdev/webdev_vulnerabilities.asp

Thanks Mike,

I will need to do some changes to prevent this from happening again.

Regards,

NEIL