API request returns HTML

Resolved Bill Hill
(@bill-hill)

12 years, 1 month ago

I started working with this API about two weeks ago and everything was working just fine.

A couple of days ago, the API suddenly started returning strange stuff: Some weird, short HTML code and (after the closing </html> tag) the actual JSON response.

I tried re-installing it, but that didn’t help. Any idea?

Example: http://lolkitten.org/api/get_recent_posts/?count=1&page=1

Cheers,
Cedric

https://wordpress.org/plugins/json-api/

Viewing 3 replies - 1 through 3 (of 3 total)

Thread Starter Bill Hill
(@bill-hill)

12 years, 1 month ago

Ok, I just found some unwanted code in a couple of php files: eval(decode(...)) (but a huge cryptic string instead of …), which would probably produce some iframe on my page with dishonest intentions.

I hope I could remove all of them.

Moderator Jan Dembowski
(@jdembowski)

Forum Moderator and Brute Squad

12 years, 1 month ago

Ok, I just found some unwanted code in a couple of php files: eval(decode(...))

That’s really not good. Your site is hacked.

I hope I could remove all of them.

It’s doable but it’s a lot of work to delouse your installation. Start with the standard reading material for hacked sites.

http://codex.wordpress.org/FAQ_My_site_was_hacked
http://wordpress.org/support/topic/268083#post-1065779
http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
http://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:
Hardening WordPress
http://sitecheck.sucuri.net/scanner/
http://www.unmaskparasites.com/
http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

Thread Starter Bill Hill
(@bill-hill)

12 years, 1 month ago

Thank you for those resources. I scanned my active theme directory for eval(... expressions and found three more.

Now I installed a security plugin to check everything and to get instantly alerted in the future if something like that should happen again.

Still, I don’t know where it came from… I suspect it might have been a plugin, but I have no idea which one (I’m using 22 right now). Anyway, I’m thinking about a complete re-design, which I could use as a chance to take a completely fresh installation.

Cheers,
Cedric

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘API request returns HTML’ is closed to new replies.

Tags