Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm quite sure my server's been hacked. I'm seeing these entries in my access log as the last two before a series of 500 error messages, It's related to the DB but I haven't found out the exact error yet. I'm still trying to figure out what it means - can anyone help me out:

208.90.56.152 - - [16/Jun/2011:16:18:04 +0000] "GET / HTTP/1.1" 200 3011 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0.1) Gecko/20100101 Firefox/4.0.1"

69.162.74.102 - - [16/Jun/2011:16:25:00 +0000] "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" 400 315 "-" "-"

Update

OK - on further investigation - for some reason the mysql service was shut down. I restarted it, and everything LOOKS normal. No data's missing, but I'm really not feeling well over the spook of those weird entries - how can I check if someone's been inside my system?

In my MYSQl log I see these lines - how does that realte to what has happened?

Version: '5.0.77'  socket: '/var/lib/mysql/mysql.sock'  port: 3306  Source distribution
110616 17:34:20 [Note] /usr/libexec/mysqld: Normal shutdown

110616 17:34:20  InnoDB: Starting shutdown...
110616 17:34:21  InnoDB: Shutdown completed; log sequence number 0 2054508
110616 17:34:21 [Note] /usr/libexec/mysqld: Shutdown complete

110616 17:34:21  mysqld ended
share|improve this question
    
possible duplicate of My server's been hacked EMERGENCY –  John Gardeniers Jun 17 '11 at 0:00
2  
Not a duplicate - the other link was about an actual DOS attack. –  Cyclops Jun 17 '11 at 0:30
add comment

5 Answers

up vote 8 down vote accepted

The DFind scan is just that, a scan, and doesn't indicate a breach; you'll see it all the time if you're watching. See here.

That's a graceful MySQL shutdown, which may warrant further investigation, but isn't terribly suspicious on its own.

share|improve this answer
3  
More info at seeing w00tw00t in the logs. –  Cyclops Jun 16 '11 at 22:43
    
thank you for your answer. Do you have any advice on debugging the reason for the mysql shutdown - now I'm a bit worried about why the mysql service just shut down. –  Jakob Jun 16 '11 at 22:49
1  
To support M. Madden: I've been seeing this and others like it in my server logs for years, and they are not indicative of server compromises. They are the results of idle or malicious people nosing around looking for vulnerabilities. Per RFC 2616 § 14.23, your HTTP server should be treating these requests as erroneous, since they are HTTP 1.1 requests without a Host: header. By the logs posted, it appears that it is (status code 400). –  JdeBP Jun 16 '11 at 23:17
add comment

Those two entries in the access log are nothing to worry about.

The first one is perfectly fine (someone at 208.90.56.152 asked for your website root and got it), and the second one looks like someone at 69.162.74.102 tried to access a file called w00tw00t.at.ISC.SANS.DFind:) on your site... and of course didn't find it.

People (or bots) may ask the weirdest things to your web server; this doesn't matter, what matters is that they don't find them :-)

share|improve this answer
    
so it's just a coincidence that my mysql service went down not long after that request? –  Jakob Jun 16 '11 at 22:29
2  
I think so. If you look at the time more carefully, you'll also see that MySQL actually went down more than one hour later. –  Massimo Jun 16 '11 at 22:31
    
Thank you for your response (I can't vote up because I don't have enough cred :) –  Jakob Jun 16 '11 at 22:49
add comment

A record of "GET /w00tw00t.at.ISC.SANS.DFind:) HTTP/1.1" in your Raw Access logs indicates that someone is running vulnerability scanner which has this fingerprint.

By itself, this entry does not mean that you have been hacked. It only means that someone has been trying to hack your site. The entry should always have caused a "400" error on your site, indicating that the attempt was unsuccessful.

This entry should send you a message. Keep your code clean! Most web sites are attacked in one way or another almost every day. Your best defense is to learn what you can do to keep your files, directories, and scripts safe from hackers. Be sure you have your file and directory permissions set properly. Even more imortantly, only use safe scripts that have a good reputation for security on the Internet, and be sure that you always check the parent sites for your scripts at least once a month for updates and bug fixes.

Read more: Dealing with HTTP w00tw00t attacks, Blocking w00tw00t scans.

share|improve this answer
add comment

As others have mentioned, it's just a scanner. Across a few dozen webservers, I've seen about 15 variations of w00t; probably a few hundred thousands hits over the past year. If it bugs you, just add an Apache directive to deny connections to any client with a w00t UserAgent string. I track this stuff, so I let it hit.

share|improve this answer
add comment

In case you have phpmyadmin on your host, remove setup.php file from scripts dir.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.