473,748 Members | 11,145 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Mail insertion hack on Send Mail form

I'm using CDO to send mail to the site owner from ASP pages with forms.
Recently one of my forms is occasionally sending email with what seems
to be an insertion which is replacing the plain text part of the email
with something else. Looking at the server sent email source, the
hacked emails have the following:

This is a multi-part message in MIME format.
------=_NextPart_000_ 0001_01C60610.9 1D1FFA0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: base64
QmVsb3cgaXMgdGh lIHJlc3VsdCBvZi B5b3VyIHJlcXVlc 3QgZm9yIGluZm8g Zm9ybS4...etc
............... ......S0tLS0tLS 0tLS0tLS0tLS0tL S0tLS0tLS0NCi0t LQ0K
------=_NextPart_000_ 0001_01C60610.9 1D1FFA0
Content-Type: text/html
Content-Transfer-Encoding: 8bit
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
.......the correct html content

On a non-hacked email the content is:

This is a multi-part message in MIME format.
------=_NextPart_000_ 0001_01C5FD9B.4 7C9C190
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Below is the result of your request......
.........the correct plain text content
------=_NextPart_000_ 0001_01C5FD9B.4 7C9C190
Content-Type: text/html
Content-Transfer-Encoding: 7bit
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
.......the correct html content

How can I prevent this happening?
What is the evil hacker attempting to include?
Apart from the submitter's email address and links to a chinese site,
all the rest of the characters in the submission are non-english
(irrelevant no doubt).
I am changing the form to include a server generated value which will
make it harder for this to be done by posting to the page without going
to the form first. I am clipping all form entries to reasonable sizes.
What can I look for in or strip from the form submission to decide to
trash the attempt?
Colin

Dec 23 '05 #1
0 2135

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

2
2428
by: Mark Creelman | last post by:
Hi: I am relatively new to ASP. I prefer Perl, but need to do this form to e-mail sipt for a web page, See Example of script below that works fine. I want to add the feature to this where it will tell customer that they missed a field, "click here" to go back & try again. Does not need to be fancy telling them which field they missed. (Although would be nice) Can even require all fields to be filled out, or do again. Currently it...
16
2379
by: polilop | last post by:
I made a form in which I send the visitor a link to my page but when the visitor gets that link in the mail it dosent send him to the page just says invalid syntax or something like outbound....... I'm not trying to spam this is the code iput into body variable text= "<table width='310' border='0'> "&_ "<tr><td class='all'><p align='center'> Something <br>"&_ "something<br>"&_
3
2196
by: Kassam | last post by:
Hi MVPs out there. I have constructed an order form and the users will enter the informtion. I now need to send the filled out form as an e-mail (body being the HTML with the fille din data) to a predefined e-mail address. I know how to use CDO. I don't want to go to another page to recontruct the HTML as the '.body' Thank you in anticipation. Kassam
6
11184
by: DigitalRick | last post by:
I have been running CDONTS in my ASPpages to send emails to me sent from my guestbook. It had been working fine untill I upgraded to Server 2003 (I am also running Exchange 2003) all locally. I will include the code I originally used. I understand I should switch from CDONTS to CDO mail but after several sttempts I am finding a very hard time getting the new CDO mail to work properly. Any assistance with this would be greatly...
5
2151
by: ElanKathir | last post by:
Hi ! I wrote one code for Send the E-mail, But that code have some problem , So please help me Here i paste my code and Error: Error: Server Error in '/Elan_Sample' Application. --------------------------------------------------------------------------------
4
5878
by: Angelos | last post by:
Hi, Because I am fed up with attacks on my form mail scripts I want to find a way to hack them my self and test it while I am developing it.... Does anyone knows a good resource to learn how to hack my own forms ? or anything relative to security precautions Cheers
3
1478
by: jlaustill | last post by:
Hey yall, I have a problem, I'm a DBA for about 250 databases. I currently have ZERO means of notification on them. I put together an entire plan for using SQL mail, got a pop3 account set up and all that jazz, but when I put the request into my company to get outlook installed on my sql servers they shut me down. The security guys said no email on servers period even if it's outgoing only because someone might hack it. As far as I...
4
3901
by: Jason | last post by:
I'm troubleshooting a program that I didn't build, so forgive me on this one. It's called email.php, and it looks like a program that the original developer must have downloaded from somewhere. The part of the program that sends an email states this: $headers = 'MIME-Version: 1.0' . "\r\n"; $headers .= 'Content-type: text/html; charset=iso-8859-1' . "\r\n"; // Additional headers if (isset($_REQUEST)){ $headers .= 'Bcc: '.$bcc....
3
3297
uranuskid
by: uranuskid | last post by:
Hey folks, I was going to include a contact form on my website. Well, in the first place that seemed an easy thing to do with a form that prompts a PHP file validating the input vaiables and using it's mail () function to send the mail. However, as I got more into that topic I realized that one should be really concerned about the validation part to prevent spam abuse. There are shiploads of 'mail scripts' available with each of them has...
0
8989
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look ! Part I. Meaning of...
0
8828
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
1
9319
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
0
6073
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
4599
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
0
4869
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
3309
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
2
2780
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.
3
2213
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.