Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

i have a website and mysql entries in tables of the database were deleted or changed values.

i found the hacker pretty quickly but he only did minor changes.

i have some forms on the site. is it possible that he used injection?

how to figure out how he did it? what are the first things to test?

share|improve this question

2 Answers 2

Did you keep your system updated to the latest?

Is this a custom programming job? If so you need to find out if it was some kind if injection or bug and fix it.

If it was a case of not keeping up to date with vulnerability fixes and/or updates, you need to wipe and start over with a clean backup and then update it to the latest. You can't trust that it wasn't altered with backdoors. Even rootkit checkers can be fooled or not have checks in place for everything; there will always be the possibility the intruder left behind some "gifts" for you.

After you get it restored, install something like Tripwire that keeps MD5's of your files and that will help with finding alterations to system binaries (of course, don't keep the compare file on the same server). It'll be a pain, but it's the only way to make sure your system binaries aren't compromised in the future.

Summary; your system's been hacked, you can't trust it. Find what caused the intrusion so you can plug the hole, restore from a backup, fix the hole, put measures in place to monitor the system in case of future intrusion.

share|improve this answer
  1. Check MySQL bin log(log_bin in my.cnf, /var/log/mysql/ in ubuntu). Use mysqlbinlog utile.
  2. Check you web-server log. First error log, then access log.
  3. Check ssh log, use command last.
  4. Check rootkit. Use chkrootkit,rkhunter or rkhunter.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.