Author Topic: No problem with code but what does it do?  (Read 1658 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34065
  • malware fighter
No problem with code but what does it do?
« on: July 23, 2013, 06:39:40 PM »
Code: [Select]
/^(htxp(s)?:\/\/)?blocletters.com/No problems with js, but why is it on that site. Site suspicious: http://siteinspector.comodo.com/public/reports/15978816
known seo spam site: http://sitecheck.sucuri.net/scanner/?scan=http%3A%2F%2Fblocletters.com
using div id='HideMeBetter'  injection -> http://forum.joomla.org/viewtopic.php?f=432&t=765672

polonus
« Last Edit: July 23, 2013, 06:51:15 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline !Donovan

  • Web Analyst
  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 2219
    • The WAR Against Malware
Re: No problem with code but what does it do?
« Reply #1 on: July 23, 2013, 06:50:00 PM »
Hi Polonus,

That is a regular expression. It returns true if the tested string contains the given url.

Also see: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/RegExp

~!Donovan
Familiarize Yourself! | Educate Yourself! | Beautify Yourself! | Scan Yourself!
"People who say it cannot be done should not interrupt those who are doing it."

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 34065
  • malware fighter
Re: No problem with code but what does it do?
« Reply #2 on: July 23, 2013, 07:01:25 PM »
Hi !Donovan,

Thank you for establishing. The <?php echo $tmpTools-> there  is part of a remote SQL Injection through a Joomla exploit.

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!