4 ms·

Nice hack in there. But the "bad guys" are already using the .htaccess for a while as well. Posted about it here: http://blog.sucuri.net/2011/05/understanding-

• anthonyb 15y ago
  He's a friend of mine here in Melbourne, and currently working as a pentester for banks and other organisations. Believe me, he knows all of the things that the bad guys get up to.
  • sucuri2 15y ago
    Never said that :) Just wanted to show some of the techniques that the other side are currently using.
    • wireghoul 15y ago
      Hi there, As Antony said, I am a penetration tester, which tends to drive my research. I have seen several malware based attacks via .htaccess when I worked for a shared hosting company many years ago. The append iframe has always been a malware staple. Although I saw more redirects to specialized exploits based on user-agent rewrite rules than the blackhat SEO ones you are showing. SANS ISC has also covered several of these techniques over the years, but I digress. The point of my .htaccess based attacks are remote code execution or information disclosure that are valuable to an attacker during a targeted attack. Malware distribution is a very different beast. However, in both cases Apache hardening will help if not mitigate the attacks as dicussed in the earlier comments.