Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A friend discovered a bunch of spam files in his web directory on his web host the other day. He has no idea where they came from, and I'm not quite sure either.

What are common security breaches that would allow this sort of thing to happen?

Mostly what I can think of is if someone has figured out the FTP password somehow, or if there is a form where you can upload files and this can be exploited somehow. Anyways, would appreciate some pointers on what to look for and ways to prevent this from happening.

They are using Surftown as a webhost. Think it is a shared webhost, and they seem to be running PHP 5.2 from what I can read. The site is pretty much just DreamWeaver generated HTML though, so there is no CMS like Drupal or WordPress installed. Don't know much more at the moment, but I'm mostly looking for general clues about this sort of security breach.

list of spam files

share|improve this question
is there a form that allows images/files to be uploaded? Also, what Content Management are they using, if any (Wordpress, Drupal, etc) – tombull89 Jan 20 '12 at 12:09
@tombull89 Not that I know of. And there is no CMS. Think they use DreamWeaver with its crazy templating stuff. – Svish Jan 20 '12 at 12:24
Easy. 3 letters. F.T.P. Kill It Dead With Fire. – Tom O'Connor Jan 20 '12 at 12:25

Couple of ways:

  • (s)ftp/shell account compromised.
  • a web form which allows file uploads (and possibly even executing them afterwards...).
  • a vulnerability in CMS such as Drupal or Wordpress.
  • a PHP script which allows to run arbitrary PHP embedded in GET request parameters.
  • a rootkit.
share|improve this answer
How can you run PHP embedded in GET request parameters? Or rather, how do you secure yourself against that? – Svish Jan 20 '12 at 12:50
Lack of GET request parameter input validation can lead to interesting results, anything from SQL injection to PHP code execution. So, validate the input and make sure (for example) a text field meant for e-mail does contain a well-formed e-mail address and nothing else. PEAR has Validate module available: and probably there are numerous other ways to do this. :) – Janne Pikkarainen Jan 20 '12 at 13:02
Yeah, I knew about SQL injection, but not heard of PHP code execution. Unless you use eval or something, but I've never used that before... – Svish Jan 20 '12 at 13:59
I'll add this for completeness - it's possible that the hosting provider has it's permissions incorrectly set, allowing others who use the same shared hosting environment to place files in your data area. – malcolmpdx Jan 20 '12 at 15:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.