Persistent XSS

[Scott P]

Does anyone have any experience with Persistent XSS, or more specifically preventing it? More specifically, the part that involves stealing cookies?

[Sombeech]

What kind of trouble are you having with it?

[Scott P]

A website I am an administrator on has been hacked. If you don't mind, maybe you could PM me, if you think you may want to help (though I'll be leaving the weekend soon and may not see it until Monday).

[Sombeech]

I personally won't have much time this weekend either, sorry. Have you identified where it's coming from, maybe corrupted ads or a member who's unknowingly hiding malicious html code in their signature? Is it a forum?

Good luck.

[Scott P]

Have you identified where it's coming from, maybe corrupted ads or a member who's unknowingly hiding malicious html code in their signature? Is it a forum?

One admin is trying to track down where it is coming from. The member who is doing it is definitely doing so intentionally and using it to steal the administrators cookies so he or she can delete content (hundreds of pages and photographs). The site does have the forum, but since phpBB doesn't allow the insertion of the script, it came from someone's added content (of which there are tens of thousand of pages and 34,131 members).

Whoever is doing it has this ip address, 96.5.28.23, in case anyone knows of a way to narrow it down. We believe that it is coming from a school library in Tennessee.

[accadacca]

Sorry to hear that. I've been through it several times on several websites. It's a nightmare. I would have to look at the files to see what's going on. Even then it can be a needle in a haystack. Hopefully the site has good backups.

[Sombeech]

Any luck lately?

[Scott P]

Any luck lately?

I´m in Chile right now, so I´m out of the loop as to what is going on with it.