Re: XOOPS vs SPAM [Site feedback]

Forum Index

Board index » AROS-Exec forums » Site feedback » XOOPS vs SPAM

Browsing this Thread: 1 Anonymous Users

Bottom

Previous Topic

Next Topic Register To Post

(1) 2 »

azvareth

Re: XOOPS vs SPAM

#16

Home away from home

I did that, I know see that account is removed...

but posts still here?

anyway!

here is how it looked like for me... see it like keeping a memory!

FireFox:
Resized Image

Same side with Chrome and "my" clean tool

Resized Image

I am certain that the "thing" was trying to take over the forum completely... But I am sure you noticed.

Anyway, something weird was going on as

Resized Image

So I blocked that in Firewall (as you said)

the Avast warning popups did dissapear but for some reason I still got pictures not wanted...

Anyway, thanks for deleting that account at least.

Posted on: 2014/2/16 13:00

Kalamatee

Re: XOOPS vs SPAM

#15

Home away from home

Just block the chinanet IP range - 60.166.0.0 to 60.175.255.255

Posted on: 2014/2/16 11:37

azvareth

Re: XOOPS vs SPAM

#14

Home away from home

Is Nicolas (nicomen?) active still ? Is you the admin of this site?

In that case I suggest you seriously take a look at this site if you still have any interrest in it.

Otherwise you might be interrested in share (some?) parts of the admin rights with one of the other that is frequently active here and ofcourse trusted...

[Svenska - Swedish]
@Mendoza: Denna sajt kommer att g? ner om acanadajakker och liknande f?r forts?tta spamma som han g?r...

Du b?r till?ta n?gon annan lite mer r?ttigheter f?r att:
Installera aktiva skydd!
Blocka och eller radera registrerade konton.

Bara min ?sikt...

The other:

Next time one come here, someone (evil) might install something dangerous thru this site!

//signing of until fixed!

Posted on: 2014/2/16 8:47

azvareth

Re: XOOPS vs SPAM

#13

Home away from home

Well I was wrong... I thought so first...

I thought that image.js was "imported" externally but actually it is located here:http://aros-exec.org/class/textsanitizer/image/image.js, acanada* is using functionality inside this framework...

well, I can't be right all the time ;)

Posted on: 2014/2/15 14:09

magorium

Re: XOOPS vs SPAM

#12

Home away from home

standard code, see here.

if you need the image.js (just an example), see here

Quote:

http://sourceforge.net/apps/trac/xoops/browser/XoopsLanguages/danish/core/2.3.2b_utf8/htdocs/class/textsanitizer/image/image.js

oops, where can it be

It's just an image resizer. i thought you hinted at xss in the picture itself.

Posted on: 2014/2/15 12:46

azvareth

Re: XOOPS vs SPAM

#11

Home away from home

this is what the thing does, it is located in an image.js script in my browser cache, but searching inside the Aros-Exec post source, will not show any ref to: image.js, the image.js functions only seems to bee disturbing...


function imageResize (img, maxWidth)

{

    if (img.width > maxWidth && maxWidth > 0) img.width = maxWidth;

}



function CaricaFoto(img)

{

    foto1= new Image();

    img = encodeURI(img);

    foto1.src = (img);

    Controlla(img);

}



function Controlla(img) 

{

    if ( (foto1.width != 0) && (foto1.height != 0) ) {

         viewFoto(img);

    } else {

        funzione = "Controlla('"+img+"')";

        intervallo = setTimeout(funzione, 20);

    }

}



function viewFoto(img) 

{

    largh = foto1.width;

    altez = foto1.height;

    stringa = "width=" + largh + ",height=" + altez;

    finestra = window.open ('','', stringa);

    finestra.document.write ("<html><body leftmargin=0 topmargin=0>");

    finestra.document.write ("<a href='javascript:this.close()'><img border=0 src=");

    finestra.document.write (img);

    finestra.document.write ("></a></body></html>");

    finestra.document.close();

    return false;

}

function imageResize (img, maxWidth)

{

    if (img.width > maxWidth && maxWidth > 0) img.width = maxWidth;

}



function CaricaFoto(img)

{

    foto1= new Image();

    img = encodeURI(img);

    foto1.src = (img);

    Controlla(img);

}



function Controlla(img) 

{

    if ( (foto1.width != 0) && (foto1.height != 0) ) {

         viewFoto(img);

    } else {

        funzione = "Controlla('"+img+"')";

        intervallo = setTimeout(funzione, 20);

    }

}



function viewFoto(img) 

{

    largh = foto1.width;

    altez = foto1.height;

    stringa = "width=" + largh + ",height=" + altez;

    finestra = window.open ('','', stringa);

    finestra.document.write ("<html><body leftmargin=0 topmargin=0>");

    finestra.document.write ("<a href='javascript:this.close()'><img border=0 src=");

    finestra.document.write (img);

    finestra.document.write ("></a></body></html>");

    finestra.document.close();

    return false;

}

Posted on: 2014/2/15 12:33

magorium

Re: XOOPS vs SPAM

#10

Home away from home

azvareth wrote:
Quote:

Wished trusted users ...

Better would be to not let those wankers join at all in the first place if you would ask me (you already pointed that out, by pointing to same protection/website as i did

)

Quote:

btw... do you know if there is a tool to download and view the script of an image with hidden script?

I have come across something like that (tbh i didn't even know it was possible in the context what it is (mis)used for).

I'm not going to paste links as i do not want to have the little baby crapping her diaper even harder. Just do a proper search and you'll find it.

Quote:

It seems that this thing is calling an gif that seems to contain JS, I dl the image but the thing must somehow have combined scripts with image, otherwhise I can't undestand why the thing does, javascript:external/url/an/image.gif and calling something.

interresting. Did you had a look with an hexeditor ?

Quote:

bother me a bit not to knowing what...

In case you are serious, then please put up the link and i'll have a look (i miss these things as i have blocked everything so my browser won't even touch those sites).

Posted on: 2014/2/15 11:26

azvareth

Re: XOOPS vs SPAM

Home away from home

Nice it worked...

Wished trusted users (MODerators) where able to "customize" the behaviour of Aros-exec either by editing the framework directly or if not that where possible, add scripts to AROS-Exec like this one... a directory on host server that mods could acces and put in userscript into so all visitors get the script needed directly....

btw... do you know if there is a tool to download and view the script of an image with hidden script?

It seems that this thing is calling an gif that seems to contain JS, I dl the image but the thing must somehow have combined scripts with image, otherwhise I can't undestand why the thing does, javascript:external/url/an/image.gif and calling something.

bother me a bit not to knowing what...

Posted on: 2014/2/15 10:49

magorium

Re: XOOPS vs SPAM

Home away from home

Thanks very much azvareth, works like a charm :thumbsup:

ps: if you want greasemonkey scripts in opera then they must have the .user.js extension. .js alone is for opera scripts.

Posted on: 2014/2/15 10:26

azvareth

Re: XOOPS vs SPAM

Home away from home

ok...

thought I should share...

this is for me, still need to block URLS either in host or in avirus...

this is for me to remove and clean his posts, the placeholders of him is still there but empty.

Now it will remove his post content both when logged in or not.

Browser Chrome
addon Tampermonkey
add this


// ==UserScript==

// @name       block acannadajakker content

// @namespace  http://aros-exec.org

// @version    0.2

// @description  fuck the fucker...

// @match      http://aros-exec.org/modules/newbb/* 

// @copyright  No it is not

// ==/UserScript==



var aColl = document.getElementsByTagName('A');





var element = "";

var oDiv = "";

var target = "";

var i = "";

var j = "";



for(i = 0;i < aColl.length-1; i++) {

    element = aColl.item(i);

    if(element.href == "http://aros-exec.org/userinfo.php?uid=3968") {

        oDiv = element.parentNode;

        

        if(oDiv.nodeName == 'DIV') {

            

            if(oDiv.className == 'comUserName') { //We are logged in handle things differently

                target = oDiv.parentNode;

                while(target.className !== 'outer') {

                    target = target.parentNode;

                }

                target = target.getElementsByClassName('comText').item(0); //get that table element with class='outer'

            } else  { //we have no 'comUserName' div

                target = oDiv.nextSibling;  //get the next DIV

                while(target.nodeName == '#text') { //if we got textnodes inbetween skip it

                    target = target.nextSibling;

                } //while target.nodeName = #text

            } //else // we have no 'comUserName' div

            

            if( target.className=='odd' || target.className == 'comText') {

                while (target.firstChild) {

                    target.removeChild(target.firstChild); //clean out acannadajakker's posts

                } //if

            } //while

        }

    } //if

} //for