1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Someone's blackhat code. For anyone who wants to solve.

Discussion in 'Black Hat SEO' started by meannn, Jul 5, 2011.

  1. meannn

    meannn Supreme Member

    Joined:
    Apr 22, 2009
    Messages:
    1,461
    Likes Received:
    1,896
    Occupation:
    Unemployed Winner
    Location:
    TR
    During a routine surfing, somehow I have redirected to a page. It was looking strange. There was a fake captcha image verification. I got the code and still playing this to solve. This guy is playing a blackhat game. Here is the code:

    Code:
    
        <head>
         <TITLE>Continue</TITLE>
         <link rel="stylesheet" href="style.css.php?u=m5vKx8hpmWiVxnKYypXJlphsmpycbW9qmMmampWUyJtsa57FlmOcZWmUn5LHmMpom51systuaGiZlZRtlsebl5eyypOcYpxrbJeem8rhymxsam-czHCetGuamW1mksSVbGrJkchfbWOYmW-Um5PKZJlxbuHHbZlsapHDZmGXm5hvZJmXxmWbYGacaZnG4cpom3Fsmsxub2WZlZg">
         <style> a {text-decoration: none; color: black; cursor: text;} </style>
         <SCRIPT LANGUAGE="javascript">
        <!--
        var keyStr = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
    
        function encode(input) {
        var output = "";
        var chr1, chr2, chr3;
        var enc1, enc2, enc3, enc4;
        var i = 0;
       do {
          chr1 = input.charCodeAt(i++);chr2 = input.charCodeAt(i++);chr3 = input.charCodeAt(i++);enc1 = chr1 >> 2;enc2 = ((chr1 & 3) << 4) | (chr2 >> 4); enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);enc4 = chr3 & 63;
          if (isNaN(chr2)) {
             enc3 = enc4 = 64;
          } else if (isNaN(chr3)) {
             enc4 = 64;
          }
          output = output + keyStr.charAt(enc1) + keyStr.charAt(enc2) + 
             keyStr.charAt(enc3) + keyStr.charAt(enc4);
       } while (i < input.length);
       
       return output;
       }
        function clickme() 
            {
                var v=document.getElementsByName('token');
    
                for(x=0;x<v.length; x++)  
                {
                 if (v[x].checked) return true;
                 }
                 
                alert ("Please choose one of the options.");
                
                return false;
            }
         -->
         </SCRIPT>
    
          <script language="javascript" src="clickme.js.php?u=m5vKx8hpmWiVxnKYypXJlphsmpycbW9qmMmampWUyJtsa57FlmOcZWmUn5LHmMpom51systuaGiZlZRtlsebl5eyypOcYpxrbJeem8rhymxsam-czHCetGuamW1mksSVbGrJkchfbWOYmW-Um5PKZJlxbuHHbZlsapHDZmGXm5hvZJmXxmWbYGacaZnG4cpom3Fsmsxub2WZlZg"> </script>
    
    
         <script>
           var c='';
        
           if ( window != window.top )
           {
               c=encode(window.top+"|"+1 );  
           }
           else
           {
             c=encode(document.location.href+"|");
           }
         </script>
    
        </HEAD>
        <BODY OnLoad="javascript:clickme2()">
    
    
    
        <script>  
    <!--
       document.write('<iframe src="frame.php?u=m5vKx8hpmWiVxnKYypXJlphsmpycbW9qmMmampWUyJtsa57FlmOcZWmUn5LHmMpom51systuaGiZlZRtlsebl5eyypOcYpxrbJeem8rhymxsam-czHCetGuamW1mksSVbGrJkchfbWOYmW-Um5PKZJlxbuHHbZlsapHDZmGXm5hvZJmXxmWbYGacaZnG4cpom3Fsmsxub2WZlZg*'+c+'" WIDTH=0 height=0 FRAMEBORDER=0 SCROLLING="no"></iframe>');
    
    
       var x,y;
                
                
                var browserWinWidth = -1, browserWinHeight = -1;
                if( typeof( window.innerWidth ) == 'number' ) {
                //Non-IE
                browserWinWidth = window.innerWidth;
                browserWinHeight = window.innerHeight;
                } else if( document.documentElement && ( document.documentElement.clientWidth || document.documentElement.clientHeight ) ) {
                //IE 6+ in 'standards compliant mode'
                browserWinWidth = document.documentElement.clientWidth;
                browserWinHeight = document.documentElement.clientHeight;
                } else if( document.body && ( document.body.clientWidth || document.body.clientHeight ) ) {
                //IE 4 compatible
                browserWinWidth = document.body.clientWidth;
                browserWinHeight = document.body.clientHeight;
                }
    
    
                x=browserWinWidth;
                y=browserWinHeight;
    
        
                at = 1;
                        
                var image = new Image();
                        
                image.src = "http://feed.peakclick.com/img.php?u="+"m5vKx8hpmWiVxnKYypXJlphsmpycbW9qmMmampWUyJtsa57FlmOcZWmUn5LHmMpom51systuaGiZlZRtlsebl5eyypOcYpxrbJeem8rhymxsam-czHCetGuamW1mksSVbGrJkchfbWOYmW-Um5PKZJlxbuHHbZlsapHDZmGXm5hvZJmXxmWbYGacaZnG4cpom3Fsmsxub2WZlZg" + "*"+ encode( x+"|"+y+"|"+ document.location.href)+"&x="+x;
    
       
    
     -->
    </script>
        
        <FORM NAME="link" ACTION="http://feed.peakclick.com/c.php" METHOD="POST">
    
            <input type="HIDDEN" name="z" value="eNotU8uuokAU_CCTa3cD_VjcxUUEAUUBeW4mdAMqj6uCiBg-fpxkqpJTm6rU4qSqGUEmsZlBwmbneILOBKYZfEH8OQh8MCMAISBAAUChiMy8ZVNusME09CE3GpTFFhSTOoqW1XnkANN4NIX7_T1zUOQCAkigREskERnwEilFiQkWSADlT66UeZnnSl7QDGYgZ6JQ5KIEJSIKlACaqTTDuXCuYd08DvL7xz2X1KnYca9mdXf1IvehrsZVJh9fEt4SX7kld9E2Cz7ht6DVOsEe3qW_0eKexOoy7x63dsBhgMPhTfdseHQ5sKI7KlFY4UNcgM1JBfpIAX_yCyZkqXjB4tzFsuSvYRJM_r03RPCK30ov93K8y2IwxVv0CASgr92WdbefsPbH_VkqrBMxj8fy6A-gj_avRWEmp6Sq1m_jx7fGXlr8nlsa3LexrWU_6rVx42Z3vr_Ys74Yplvi-7A5jvdKTSNnNdXTrdrvpvEs1rElct1xowrW3bYN1e4xGZYU1CdphFryPI_GRldU46BE16G-3dzXqgsivnCddmF-Hks7piwJM57Dg9Dj-Q0suSOex35roEupl0UpGGxAkuVh4S7ScHc1nmctM8kh73hQq2kzlm_Ls67aTt901SUAB-xfhfFL2iipvVdDJxscxTD0Yk8nrXWy1vJ-QKibom_9U-e37jU9oEy_RDjNp97mWd848TW1H713yxRexmqkX5fu0dyikzyN69Q3RPY8QClmxW0tTowsMOif2su6O6tRlDl_XxqqcbtfbQ19b-j9WzYvNtsFZnH_bU1uyCP30sKWLxV5xSF_aV6xhv1zncONvQ2XuwMwEHmbDgS6FqhVlbCgSZXbkzTb6T0EOCXYj8JS1fe7Tt1Y0uZsK6ejD19ZptOnHEnEtJ2Mr_vIuVuyQWqoya3-yCq13BfD0j_I2sJeYy34nrH8BSX56yOUzDOhX1D-7ExBX5DOYJ7RnEu5tG1Zm7bhJFB6463XiItyyeLr98fxj7P032U1CWJPvnGaJLaqbKUMaez-66AE50zCTIK5ABKQeckR5hAwgCH4pDGhUGa5BBVeIME5RmUOUA5ERimVs78vSE4a">
            <input type="HIDDEN" name="u" value="ef86b60c3762fe075d230035de7028c3">
            <input type="HIDDEN" name="cid" value="f783449a00ca98356cbb474d1044d9a5">
            <input type="HIDDEN" name="a" value="1">
            <NOSCRIPT>
            <input type="HIDDEN" name="nscr" value="1">
            </NOSCRIPT>
    <center><h2>The website you are trying to visit does not allow non human visitors<a href="c.php?r=eNotU8uuokAU_CCTa3cD_VjcxUUEAUUBeW4mdAMqj6uCiBg-fpxkqpJTm6rU4qSqGUEmsZlBwmbneILOBKYZfEH8OQh8MCMAISBAAUChiMy8ZVNusME09CE3GpTFFhSTOoqW1XnkANN4NIX7_T1zUOQCAkigREskERnwEilFiQkWSADlT66UeZnnSl7QDGYgZ6JQ5KIEJSIKlACaqTTDuXCuYd08DvL7xz2X1KnYca9mdXf1IvehrsZVJh9fEt4SX7kld9E2Cz7ht6DVOsEe3qW_0eKexOoy7x63dsBhgMPhTfdseHQ5sKI7KlFY4UNcgM1JBfpIAX_yCyZkqXjB4tzFsuSvYRJM_r03RPCK30ov93K8y2IwxVv0CASgr92WdbefsPbH_VkqrBMxj8fy6A-gj_avRWEmp6Sq1m_jx7fGXlr8nlsa3LexrWU_6rVx42Z3vr_Ys74Yplvi-7A5jvdKTSNnNdXTrdrvpvEs1rElct1xowrW3bYN1e4xGZYU1CdphFryPI_GRldU46BE16G-3dzXqgsivnCddmF-Hks7piwJM57Dg9Dj-Q0suSOex35roEupl0UpGGxAkuVh4S7ScHc1nmctM8kh73hQq2kzlm_Ls67aTt901SUAB-xfhfFL2iipvVdDJxscxTD0Yk8nrXWy1vJ-QKibom_9U-e37jU9oEy_RDjNp97mWd848TW1H713yxRexmqkX5fu0dyikzyN69Q3RPY8QClmxW0tTowsMOif2su6O6tRlDl_XxqqcbtfbQ19b-j9WzYvNtsFZnH_bU1uyCP30sKWLxV5xSF_aV6xhv1zncONvQ2XuwMwEHmbDgS6FqhVlbCgSZXbkzTb6T0EOCXYj8JS1fe7Tt1Y0uZsK6ejD19ZptOnHEnEtJ2Mr_vIuVuyQWqoya3-yCq13BfD0j_I2sJeYy34nrH8BSX56yOUzDOhX1D-7ExBX5DOYJ7RnEu5tG1Zm7bhJFB6463XiItyyeLr98fxj7P032U1CWJPvnGaJLaqbKUMaez-66AE50zCTIK5ABKQeckR5hAwgCH4pDGhUGa5BBVeIME5RmUOUA5ERimVs78vSE4a&u=ef86b60c3762fe075d230035de7028c3&cl=1&cid=f783449a00ca98356cbb474d1044d9a5&a=1" onClick="return false;" ONMOUSEOVER="status=('') ; return true">.</a><p>
    <IMG SRC="http://stats.peakclick.com/token/token8.php?u=ZpOal5tql2eWl2qWxWplaZffapdvZMVlZ5pobpdllGGXm5uWm2zJ"><br><br>
    To make sure that you are a human please read the text on the image<br>above and write answer in the field below.</h2>
    
    <input type="text" name="token" value="" size="7" id="token"><br><br>
    
            
            
            <INPUT TYPE="SUBMIT" VALUE="Click Here to Continue to Website" onClickx="return clickme()">
            </center>
            </FORM>
            </BODY></HTML>
    
    
    
    By the way, site is http://64.111.196.121 and here is the url.

    http://64.111.196.121/rej.php?aid=2...+product+key&d=dHlwZS1oYW5kbGUuY29t&rej=1&b=4
     
    Last edited: Jul 5, 2011