Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Someone has hacked my website recently & changed the codes. I have changed the cpanel password & banned some IPS. but still they are posting some content to database using a URL. punadirallu.org/newsitem.php?id=513. actually there is no newsitem with that id. & even if they open that URL, the iP ban script in the header section should block them from opening the page. I don't know how it is happening. Please suggest.

share|improve this question

migrated from stackoverflow.com Aug 12 '09 at 20:30

This question came from our site for professional and enthusiast programmers.

8  
Please give us the source code for your website and root access to your server. –  Bombe Aug 11 '09 at 7:15

6 Answers 6

Once a hacker gets in, they can plant MANY different ways to get into your server.

If this is a web hosting account, completely wipe all files and reinstall your website. If this is a virtual server or physical server, COMPLETELY reinstall the server.

share|improve this answer
if (OS = Windows)
   format C:
else
     fdisk
     mkfs.ext3
share|improve this answer

did you only change the cpanel login? what about logins for ftp and the database?

share|improve this answer
    
+10 if I could give it to you. –  David Rickman Aug 13 '09 at 10:00

You need to find the exploit being used and fix it.

Have you checked your access logs and viewed the HTTP Requests being used to post data to your site?

share|improve this answer

A "meta" solution would be the apache mod_security.

share|improve this answer

You need to back up your own data and wipe and reinstall the server. You can never trust a system once it's been breached; you don't know what trojans or other code paths have been inserted on the server. Sealing the breach won't stop what has already been altered internally!

Hopefully you have backups from before the breach occurred. Otherwise you may have trouble knowing what can be trusted on the system. Worse, your system can be used as a platform from which to launch other attacks or monitor traffic from other systems on the network.

After you reinstall fresh and then do all the updates, you may need to look and see if you can find where the breach occurred (or did you already find it?). Were there unnecessary accounts open? Unnecessary services? Anything in the logs? Are you the only authorized user on the system?

You could also look at a program like Tripwire for monitoring alterations to the filesystem. May help with tracking what is replaced down the road. Also use programs like rkhunter for finding known trojans, scanning periodically and have results emailed to you.

I didn't see if you're running Windows or Linux, but the above tools are for Linux systems. I am not sure what you'd use for Windows...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.