July 27, 2010
Hacked MediaTemple sites inserting javascript malware
One of my friend’s sites recently had some javascript hacked, which cunningly hid the contents of what it wrote to the screen so that searching through the files with normal means didn’t even show what files were affected.
So here’s a script which shows possibly hacked files. Assuming you have ssh access to your server, save it as check_for_hacked_js.sh and then chmod 755 it. To run it, type:
./check_for_hacked_js.sh
Once it’s done, check the contents of hacked.txt – and you’ll see all files which have possibly been hacked.
#!/bin/bash
# This script scearches through all files on the server for
# a certain string which writes some malware javascript to
# client browsers, and then saves the results in a file
# for inspection.
# Written by Roger Saner on 2010.07.15
grep -ri "document.write(unescape" * > hacked.txt
Roger Saner is a web platform developer (using 
