Greenguy's Board - How to decode suspicious script?

Greenguy's Board (http://www.greenguysboard.com/board/index.php)

- General Business Knowledge (http://www.greenguysboard.com/board/forumdisplay.php?f=10)

- - How to decode suspicious script? (http://www.greenguysboard.com/board/showthread.php?t=63914)

HowlingWulf

2012-05-07 10:56 AM

How to decode suspicious script?

I noticed this at a site I trade with, but I can't figure out how to decode it. Should I stop the trade even though I don't know what this does? It seems overly obfuscated to me.

Code:

cd34	2012-05-07 11:24 AM

Code:

The iframe uses an IP address rather than a domain, points to a server at leaseweb, however, the url 404s. The fact that it is an iframe, is hidden, and served with obfuscated code suggests something isn't right. However, you might contact the webmaster and ask what it is for. It is likely his site has been compromised and the code has been added without his knowledge.

(Firefox, View Generated Source from the Web Developers Toolkit)

HowlingWulf

2012-05-07 01:03 PM

Thanks cd!

I searched for Web Developers Toolkit for firefox but only found a reference to a 7 add-on collection.

cd34	2012-05-07 01:17 PM

http://livehttpheaders.mozdev.org/
http://chrispederick.com/work/web-developer/

these are probably the two handiest for tracking down things like this.

All times are GMT -4. The time now is 02:52 AM.