Question

We have a relatively popular website, and recently we started seeing some strange URL’s popping up in our logs. Our pages reference jQuery and we started seeing pieces of those scripts being inserted into URL’s. So we have logging entries like this:

    /js/,data:c,complete:function(a,b,c){c=a.responseText,a.isResolved()&&(a.done(function(a){c=a}),i.html(g?d(

The User Agent string of the Request is Java/1.6.0_06, so I think we can safely assume it’s a bot that’s probably written in Java. Also, I can find back the piece of appended code in the jQuery file.

Now, my question is why would a bot try to insert referenced Javascript into the URL?

Answer 1

It may not be specifically targeted at your site — it may be a shotgun attempt to find XSS-able sites so that an attacker later can figure out what’s stealable and craft an attack and write a web-page to deploy it against real users.

In that cases, the attacker may use bots to collect HTML from sites, and then pass that HTML to instances of IE running on zombie machines to see what messages get out.

I don’t see any active payload here so I assume you’ve truncated some code here, but it looks like JSCompiled jQuery code that probably uses jQuery’s postMessage so it’s probably an attempt to XSS your code to exfiltrate user data or credentials, install a JavaScript keylogger, etc.

I would grep through your JavaScript looking for code that does something like

eval(location.substring(...));

or anything that uses a regexp or substring call to grab part of the location and uses eval or new Function to unpack it.