Mobile app version of vmapp.org
Login or Join
LarsenBagley505

: What kind of attack causes a JavaScript 'out of memory' on the attackers device? We experienced a strange attack yesterday. Our error log picked up the same 'out of memory' JavaScript error

@LarsenBagley505

Posted in: #Hacking #Iis7 #Javascript #Security

We experienced a strange attack yesterday.

Our error log picked up the same 'out of memory' JavaScript error from a single IP address every 10 seconds. The requests came from 6 client ports on the same IP. Each client port used once per minute requested the same JavaScript file.

What could the attacker be doing? The JavaScript file he requested had 1:1:37408 appended to it. What is the best way to capture the actual requests he is making?

10.01% popularity Vote Up Vote Down


Login to follow query

More posts by @LarsenBagley505

1 Comments

Sorted by latest first Latest Oldest Best

 

@LarsenBagley505

Depending on what the attacker is doing capturing the requests he is making may or may not give you any useful information. As for what he is trying to do it is unlikely anyone could give you a useful answer there other than the attacker themselves and anyone attempting to do so would only be giving their opinion. In these situations the only thing you can really do is add a temporary IP ban (say 24-72 hours to begin with) to your .htaccess file. Generally when attackers see something like this happen if your site just happens to be a drive-by attempt at something they will move onto another site and try their luck there, if they are focused on your site for some reason then the IP block will keep it safe for however long you set it for and then when you release the IP block just keep a close watch on his IP and see if you see attacks coming from it again.

With our network of applications online we monitor for attacks to identify potential security related bugs in our code to fix but other than that we don't really care what the attacker is doing, what matters is the fact that they are actually attacking. We use an automated script we wrote in house that detects these hacking attempts, first few times the user will be directed to a warning page that what they are doing appears as a security concern to us and that further attacks will result in action being taken, if the attacks continue 24 hour ip block, after the release if it continues 72 hour block, if after the release it continues again 30 day block, only option after that is a permanent block on the IP and in all circumstances of 24 hours or more we report the IP address to a range of blacklists and partner companies as a dangerous IP.

10% popularity Vote Up Vote Down


Back to top | Use Dark Theme