Groups > comp.lang.javascript > #20393

Re: How to detect that or determine if your server side script or javascript has been hacked?

Newsgroups	comp.lang.javascript
Date	2013-06-22 07:26 -0700
References	<e5abd2fe-dd94-4d84-8bad-277d87c242a9@googlegroups.com> <XnsA1E79A10E952eejj99@194.109.133.133> <fa737844-ec4d-4581-9c32-82e366b4eb96@googlegroups.com> <XnsA1E75F9003A4eejj99@194.109.133.133>
Message-ID	<39936294-c6ab-4553-b58d-e4401393f89b@googlegroups.com> (permalink)
Subject	Re: How to detect that or determine if your server side script or javascript has been hacked?
From	justaguy <lichunshen84@gmail.com>

Show all headers | View raw

On Saturday, June 22, 2013 3:23:38 AM UTC-4, Evertjan. wrote:
> justaguy wrote on 22 jun 2013 in comp.lang.javascript:
> 
> 
> 
> > You're a good guy and has been very helpful... let's forget about the
> 
> > two scenario speculation for a sec.  In the last few months some of my
> 
> > HTML FORM element returns double value... for instance, <form>
> 
> > <input type="text" id="quantity" name="quantity" size="3">
> 
> > </form>
> 
> 
> 
> Why include all this nonpertinent html-code: id="quantity" & size="3"?
> 
Because I need javascripting for some of these elements and using ID is easier to reference an element.

> > 
> 
> > And say, the user enter 1 for the input box.  But when the form is
> 
> > submitted, the value of FORM.quantity is strangely "1,1" instead of
> 
> > "1". I can't fathom that I change the value of this FORM element upon
> 
> > submission. So, how come?  It has happened several times.
> 
> 
> 
> I doubt if you are telling me the whole story, because:
> 
> 
> 
> 1 if that is what it is, it has nothing to do with Javascript, so is off 
> 
> topic here.
> 
> 
> 
> 2 perhaps the error is in the detection code, which you do not show. I 
> 
> would prefere serverside value detection here.
> 
> 
> 
> 3 if your OS-settings are U.S., "1,1" perhaps, depending on the detection 
> 
> code, is a collection of 2 values, and does not mean 1 1/10.
"a collection of 2 values", correct.
 
> 
> 
> 4 if additional code were introduced by a hacker, you should be able to 
> 
> detect that by debugging.
I did by dumping all the submitted-FORM elements and respective values.

So, it looks possible that I may accidentally create duplicate IDs and Names for a FORM then the problematic double value for a FORM element?  I'm creating a debugging function to test this.

<FORM id="myformID" onSubmit="debugg();">
...
<span id="deb"></span>
</FORM>

function debugg() {
		var elements = document.getElementById("myformID").elements;
		 for (i=0; i<elements.length; i++) {
			document.getElementById('deb').innerHTML = document.getElementById('deb').innerHTML + ' + elements[i] + ' + ':' + '+ elements[i].value + ';
		}
	
		return false;
	}

I thought upon FORM submission it would execute the debugg function and stop, not proceed of actual submission because of return false statement.  But no, it submits the FORM.  What am I missing?

Thanks.

 

> 
> 
> Try to show your error here, using serverside javascript to stay on topic:
> 
> 
> 
> ============ test.asp ==========
> 
> 
> 
> <%@ language="javascript" %>
> 
> <!DOCTYPE html>
> 
> Response: <% Response.write(Request.querystring); %>
> 
> <form>
> 
> <input name="quantity" >
> 
> </form>
> 
> 
> 
> =========== tested =============
> 
> 
> 
> 
> 
> -- 
> 
> Evertjan.
> 
> The Netherlands.
> 
> (Please change the x'es to dots in my emailaddress)

Thread

csiph-web