Can you hack it?

PHP
1

Hello,

To test my php script ( add your link ), I put it one a website, and some of you remember that when I began learning php, I was sharing with you here my experience, and some e-friends here tried many times to hack the script, to test it in the goal to make it better.

Anyway, I left the script online to let friends and visitors add their links, BUT, from 2 weeks, I discovered that someone hacked my script, and than Google blocks the access to visit the website, anyway, I moved the website now to another server, but I don’t know how the hacker can do that?? so I’m asking you to try to hack my script, to test it and to let me know if I should do something to protect it better… the link is :

http://www.beginfromhere.com/php/addyourlink/

Don’t worry about google message, I moved today to a new server and asked google to recheck again the website.

thanks in advance for you all.

2

thanks for your help

3

If you want to check the script for XSS vulnerability this is a good place to start: http://ha.ckers.org/xss.html

In addition, do you connect to the FTP over SSH/SSL or do you use a normal connection to port 21? If, you might want to change that as in that case all traffic/information is transferred in clear text, so anyone in between you and the server can listen in and capture the information.

4

hemmm how it’s possible to hack my ftp ?? I old hosting was sharing, so I think sharing is more protect than a dedicated normally, non ??

5

ah wait, I think I can get a sample

6

To me it seems they hacked the FTP server and altered you code. I don’t really see how they could have your script to alter itself. Especially when the script isn’t writable by the web process (which it shouldn’t be).

7

something like the one in this image

8

is it xss ?

9

yes I forget, concerning database, nothing happens… I was really happy to discover that

10

In fact, they added a code to php files, something like a long script that you can’t understand, like a long code includes letters and numbers.

11

How was it hacked exactly? What was the effect of the hack? Did they hack the database, or the filesystem?

12

any system that accepts connections is vulnerable to remote attack.
‘protection’ is good, but it’s never perfect. ever.

13

thanks for the information, but can you explain me more, or give me a link to read more about that ?

A question, a lunix dedicated server with plesk 9, should has a Norton antivirus to protect it ?

14

looking at that code, my first impulse is to say - is an indication to the script to read -XX as &#XX;