thecoli virus? Keeps asking me if I want to download some sh

SheWantTheD

SheWantTheD

Veteran
Joined
Sep 10, 2015
Messages
38,630
Reputation
1,965
Daps
95,583
On my iPhone only on thecoli I keep getting a pop-up asking "Do you want to download "f.txt.js"?

I'm not getting it on any other sites.

Y'all need to fix y'all shyt! :hhh:
 
Gold

Gold

Veteran
Supporter
Joined
Aug 25, 2015
Messages
43,284
Reputation
19,540
Daps
290,256
Do not run any unauthorized javascript (.js) files!

But currently there is an issue with this site. If you want a high level technical breakdown, certain site cookies (will determine which later) are being passed through the header of the Get from certain browsers.

This is happening because the server is requesting these cookies incorrectly in the Post. This leads to a header being far too large and the Get being denied by the sever.

When this happens, the sever just routes you to pre-created error page and your traffic stops.

If any of you have seen a "Cookie too large/header too large/Cookie not set" error, that is what this.

If you the exact details I can do that when i get home. I often troubleshoot this website when im bored cuz its riddled with small issues :pachaha:
 
SheWantTheD

SheWantTheD

Veteran
Joined
Sep 10, 2015
Messages
38,630
Reputation
1,965
Daps
95,583
Gold said:
Do not run any unauthorized javascript (.js) files!

But currently there is an issue with this site. If you want a high level technical breakdown, certain site cookies (will determine which later) are being passed through the header of the Get from certain browsers.

This is happening because the server is requesting these cookies incorrectly in the Post. This leads to a header being far too large and the Get being denied by the sever.

When this happens, the sever just routes you to pre-created error page and your traffic stops.

If any of you have seen a "Cookie too large/header too large/Cookie not set" error, that is what this.

If you the exact details I can do that when i get home. I often troubleshoot this website when im bored cuz its riddled with small issues :pachaha:
Click to expand...
Naw I'm not getting that error message/pop-up, the error message/pop-up I'm getting is the one I posted in the OP.

"Do you want to download "f.txt.js"?
 
ROFL_GUY

ROFL_GUY

777
Hall of Shame
Joined
May 22, 2012
Messages
41,085
Reputation
-6,030
Daps
45,824
Reppin
RENO, Nevada
image-2123.jpeg
 
Gold

Gold

Veteran
Supporter
Joined
Aug 25, 2015
Messages
43,284
Reputation
19,540
Daps
290,256
BaggerofTea said:
XSS?, But I have never encountered those errors on my personal device.

One if OPs browser is hijacked
Click to expand...

Yeah it could be cross-site script trying to run in thecoli's frame. That actually makes alot of sense since we do sideload outside scripts for our advertisements.

But the script should run within the security confines of its frame and should be compiled by OP's browser's JIT engine. If it asks to download, its not running. Usually means that its a foreign MIME type (which its clearly not), or the creator of the script does not want it to run in the security confines of your browsers frame.... they want it to run as a standalone script on your pc/phone with your admin privileges :ufdup:
 
Gold

Gold

Veteran
Supporter
Joined
Aug 25, 2015
Messages
43,284
Reputation
19,540
Daps
290,256
Okay just got home, loaded up Devtools and went through many different coli pages to see if I ever load a "f.txt.js"
Never did.

Took a Fiddler trace of traffic to see if there ever any request to download/load "f.txt.js". There were none.

Is there a particular page or action that triggers this OP? Maybe I can focus on that page instead.


But this likely means that its cross-scripted from elsewhere. For example, take a look at this.

image.png



Just from loading this very page, we are getting scripting/images from all of these places.
Google, Amazon, twitter, etc.

It is very possible the f.txt.js did not originate from TheColi.com, and is cross-site injected (like @BaggerofTea mentioned).

If it originated from TheColi.com, we would all be able to see it, unless you are doing something special to request from the server that we are not :mjpls:
 
You must log in or register to reply here.
Top