|
b p
|
January 21, 2017 at 12:53 am
Hi,
We got some issue with our system and actually we got hacked. From the server, they sent us the url that is trigerring the issue. Actually they sent us a checkout url with its number. Something like this: http://raceyoo.com/registration-checkout/?uts=1484984284#checkout
We want to know who is the person doing that. Where does this number come from? Is there any relation with registration id? we want to understand this number so in order to see if it is possible to figure out something else about the person hacking us.
Please let us know asap.
tHANKS.
|
|
b p
|
January 22, 2017 at 9:00 pm
Please, let us know asap about this issue.
thanks
|
|
Tony
|
January 23, 2017 at 6:07 am
Hi b p,
Where does this number come from?
The number is added by EE and is used a cache busting method, it has nothing to do with being hacked.
Is there any relation with registration id?
No.
we want to understand this number so in order to see if it is possible to figure out something else about the person hacking us.
I’m not sure how that would relate to the person?
So you’ve been sent a URL to an EE checkout page that a ‘hacker’ claims they are using to hack your site?
|
|
b p
|
January 25, 2017 at 2:49 am
Basically, our server notified us about someone attacking our site through a url which actually looks just the the checkout url.
|
|
Josh
|
January 25, 2017 at 7:21 am
So there’s nothing malicious in the URL, and broken down in parts it’s:
/registration-checkout/ — the page slug of the page that has the
[ESPRESSO_CHECKOUT] shortcode.
?uts=1484984284 — a unix timestamp
#checkout — an anchor link to the division of the page that has the ID
checkout. This basically scrolls the page to the registration form.
|
