Malicious JavaScript scripts. How to search for malicious code without antiviruses and scanners. The most frequent problems
Malicious code hits the site by negligence or malicious intent. Destinations of malicious code are different, but, in fact, it harms or interferes with the normal operation of the site. To remove malicious code On WordPress you need to first find it.
What is malicious code on WordPress website
By appearanceMost often, malicious code is a set of letters and symbols of the Latin alphabet. In fact, this is an encrypted code that is executed, a particular action. Actions can be the most different, such as your new posts, are immediately published on a third-party resource. In fact, it is theft of your content. Codes and other "tasks", for example, placement of outgoing links on the site pages. The tasks may be the most sophisticated, but one thing is clear that the malicious codes need to be hunted and deleted.
How do malicious codes come to the site
Lazakes to hit the codes to the site, also set.
- Most often, these are topics and plugins downloaded from the "left" resources. Although, such penetration is characteristic of the so-called encrypted links. Explicit code does not fall into the site.
- Penetration of the virus when hacking the site, the most dangerous. As a rule, the site hacking allows you to place not only a "disposable code", but set the code with Malware elements (malware). For example, you find the code, and removes it, and it is restored, after a while. Options, again many.
Immediately notice, the fight against such viruses is difficult, and manual removal requires knowledge. There are three solutions to the problem: first decision - Use Antelorisian plugins, for example, plug-in called Bulletproof Security.
Such a solution gives good results, but takes time, although small. There is a more radical solution, getting rid of malicious codes, including complex viruses, it is to restore the site from pre-made backups of the site.
Since, a good webmaster makes periodically, then roll back to a not infected version will work out without any problems. Third decision For the rich and lazy, just contact the specialized "office" or a specialist of an individual.
How to search for malicious code on WordPress
It is important to understand that malicious code on WordPress can be in any site file, and not necessarily in the working topic. He can be laid with a plugin, with the topic, with the "self-made" code of the brought from the Internet. Try to find malicious code in several ways.
Method 1. Manually. List all the site files and compare them with the files of the unreleased backup. Find someone else's code - delete.
Method 2. With WordPress security plugins. For example, . This plugin has a wonderful function, scanning the site files for someone else's code and plugin perfectly copes with this task.
Method 3. If you have a reasonable support hosting, and it seems to you that on the site "Alien", ask them to scan your site with your antivirus. All infected files will be indicated in their report. Next, open these files in text editor And remove a malicious code.
Method 4. If you can work with SSH access to the site catalog, then forward, there is your kitchen.
Important! No matter how much you searched for malicious code, before searching and submitting code deletion, close access to the site files (turn on the maintenance mode). Remember about the codes that themselves are restored when they are removed.
Search for malicious codes by Eval function
There is such a php eval function. It allows you to execute any code in its row. Moreover, the code can be encoded. It is because of the encoding a malicious code looks like a set of letters and symbols. Two encodings are popular:
- BASE64;
- Rot13.
Accordingly, in these encodings, the Eval function looks like this:
- eval (Base64_Decode (...))
- eVAL (STR_ROT13 (...)) // in internal quotes, long not clear sets of letters and symbols ..
Algorithm for finding a malicious code according to the EVAL function Next (we work from the administrative panel):
- go to the site editor (appearance → editor).
- copy Functions.php file.
- open it in a text editor (for example, NotePad ++) and search for word: eval..
- if found, do not rush to remove anything. It must be understood that this function "asks" to execute. To understand this code needs to be decomposed. For decoding is online tools, called decoders.
Decoders / Coders
Work decoders simply. Copy the code to be decrypted, insert into the decoder field and decoder.
At the time of this writing, I did not find any encrypted code found in WordPress. I found the code from the Joomla site. In principle, there is no difference for understanding the decoding. We watch photos.
As you can see in the photo, the EVAL function after decoding, it brought not a terrible code that threatens the safety of the site, and copyright encrypted link, author template. It can also be deleted, but it will return after updating the template, if you do not use.
At the end, I note not to get a virus to the site:
- Malicious code on WordPress more often comes with themes and plugins. Therefore, do not put templates and plugins from the "left", not proven resources, and if you put, carefully pump them, for the presence of references and executive functions of PHP. After installing plugins and those with "illegal" resources, check the site by antivirus.
- Be sure to do periodic backups and perform others.
Malicious JavaScript.
My opinion, consisting in the fact that from the implemented malicious browser scripts (stored XSS attacks) is easier and efficiently protected by means of browsers, it was stated earlier :. Browser protection against JavaScript-A, consisting of the addition of the filter code to HTML pages, it is necessary to assume, it is reliable, however, the presence of such protection does not cancel the need to use another server filter. With regard to the same XSS attacks on the server, an additional defense line can be organized. It is necessary to remember about the possibility of introducing an attacker to an HTML message sent from the site, not browser, but server scripts (PHP), in which the browser will not be strong.
An attacker script, even a browser, at least a server is a program, it is necessary to think that the program will always have some symbolic differences from "pure" HTML. Let's try to find such differences and use them to build an HTML filter on the server. Below are examples of malicious JavaScript.
XSS:
Some text
Some text
Encrypted XSS:
Some text
Browsers restore text from symbolic primitives not only inside HTML containers (between the opening and closing tag), but also inside the tags themselves (between< и >). URL encoding is allowed in HTTP addresses. The specified complicates the recognition of a malicious code on the server side, since the same symbolic sequence can be represented in different ways.