Mobile app version of vmapp.org
Login or Join
Goswami781

: Repeated calls with random Javascript append to the URL I keep getting calls to my server where there is random Javascript appended on the end of lots of the calls, e.g.: /UI/Includes/JavaScript/).length)&&e.error(

@Goswami781

Posted in: #Hacking #Javascript

I keep getting calls to my server where there is random Javascript appended on the end of lots of the calls, e.g.:

/UI/Includes/JavaScript/).length)&&e.error(
/UI/Includes/JavaScript/,C,!1),a.addEventListener(
/UI/Includes/JavaScript/),l=b.createDocumentFragment(),m=b.documentElement,n=m.firstChild,o=b.createElement(
/UI/Includes/JavaScript/&&a.getAttributeNode(
/UI/Includes/JavaScript/&&a.firstChild.getAttribute(
/UI/Includes/JavaScript/).replace(bd,
/UI/Includes/JavaScript/)),a.getElementsByTagName(


The user agent is always this:

Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.1;+SV1;+.NET+CLR+2.0.50727)

I have jQuery, Modernizr and other JS and originally thought that some browser was messing up it's JS calls, however this particular IP address hasn't requested any images so I'm wondering if it is some kind of attack.

Is this a common occurence?

10.01% popularity Vote Up Vote Down


Login to follow query

More posts by @Goswami781

1 Comments

Sorted by latest first Latest Oldest Best

 

@Angela700

This is almost certainly a robot.

It is a common trick for robots to use simple heuristics to look for URLs within JavaScript strings. It's fairly simple for absolute URLs, but for relative URLs it can be hit and miss, in this case clearly more of a miss.

The fact that the robot is not crawling with a user agent that identifies him may mean that it has some less than honest intentions. If you can block the IP address, I would do so if for no other reason than the misleading user-agent, it is bad etiquette for robots to have user-agents that provide no contact info.

In cases where you see this pattern and the user agent provided contact info, I would contact the operator(s). If it is a legit crawl, they will accommodate you.

I do not believe this is an attack, though. Most likely this is a text scraper (therefor no images). Possibly scraping content to populate link farms.

10% popularity Vote Up Vote Down


Back to top | Use Dark Theme