-
Reporting XSS attacks
Hey all, long time no see. Just stoppin in to ask a quick question.
Recently a friend of mine's website was hit with a successful XSS cookie theft. He did the usual thing those 1337 h4xZ0rZ like to do. (deface the site, change everyone's password etc.) Now, I have a pretty good idea of where he had his cookie catcher (or whatever you want to call it), the cgi script that handles of the incoming +document.cookie information. Problem is he registered with GodDaddy.com but used domainsbyproxy.com as his registrant information. So, My question is; Who should I get in contact with ? Would it be the registrar or the domainsbyproxy guys ? Thanks in advance.
-
Just do a password reset on the hosting server, and with the domain register.
hopefully the email addresse secret question etc has not yet been changed by the attacker.
If they just happened to get lucky with the xss and decided to be a pain that would explain the password's changed.
Hopefully they arn't smart enough to have worked out that they should also change the registrant email addresse etc with the hosting account and domain name account.
Also if your friend wanted to know where the cookie script was located then just get them to check there logs, and they should see a remote website.
Then once he has worked out where the script was held, just make reports to the needed people and have he's website etc closed down.
-
