Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
My server's been hacked EMERGENCY

My site has been hacked, but when I am looking at source files in ftp everything looks fine. My website address: can anybody please guide me how can i fix it and avoid it in future.

Thank You.

share|improve this question

marked as duplicate by Chris S Feb 17 '12 at 16:03

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

how do you know that it was hacked? – bastianneu Dec 15 '09 at 12:48
all the contents have been changed – Shishant Dec 15 '09 at 12:49
So, maybe someone just knows your username and password. Maybe a bad Friday out? – Trick Dec 15 '09 at 12:50
no friday out :(( and my password is same as that i got when i registered the hosting account and its not used anywhere else – Shishant Dec 15 '09 at 12:53
Virtual domain, VM or actual host? Operating System (Windows/Linux/Solaris?) Web Server (Apache, IIS... ?) If ALL the files are OK, has your site really been hacked or just the DNS redirected? You have given us almost nothing to work with. – kmarsh Dec 15 '09 at 13:56
up vote 5 down vote accepted

First...wipe the system. Really. You can't trust system binaries anymore. It's like asking your brain to analyze itself. You can't objectively do it. Your system binaries could easily be compromised to hide what is actually going on.

By the time you sort everything out you could easily have rebuilt the thing three times.

Wipe the computer. Restore from backup. (what backup? If you're asking yourself that, you're in deeper should probably rebuild the site from scratch and start making a really good backup...OFFLINE backup...plan).

Did you have all updates installed?

You didn't mention your platform/OS/etc. You also didn't mention what your website was (apache? What SQL version? PHP? virtual server, hosted, self-hosted, dedicated server, what kind of hack, how did you know it was hacked, what was in the logs...)

If you're really into trying to secure it, you should probably look at decent backups, checking every day for security updates, and install chkrootkit and rkhunter (if a Linux like platform) and something with a checksum for the files like tripwire.

You can also run audits on your system using Nessus or other vulnerability scanners.

Check your logfiles and audit log files for unusual activity.

Were you able to log in remotely to it? Strong passwords? SSH? Install denyhosts and configure it for locking out unusual attempts to the system.

Check into what method you could use for detecting that you're getting slammed by particular IP's or port scan attempts and firewall them.

Overall...need more info, and you need to wipe the system and reinstall from backups or scratch and get all updates installed. Monitor for file changes. Monitor your logs. Websites really can be run as just a set up and forget thing, but if you're a sysadmin, it takes actual work to run a website "correctly," and it takes maintenance. Even a simple website can be a PITA to keep running and updated.

You can also subscribe to some security lists specializing in your platform of choice (your web server, OS, if you're running SQL or PHP or a specific BBS platform) so you can comb the mailings for vulnerabilities specific to your platform.

share|improve this answer
I am on a shared host, linux server. I can login in my cpanel, I have backup not recent but its good enough to be restored still any idea what should be done to check how it was hacked – Shishant Dec 15 '09 at 13:24
If it's not a full backup, i.e., of the whole system, you can't trust the system binaries. For example, replace ls with a version that hides the executable named hack*. If you have control of the system you can reinstall. If it's hosted, part of the issue will have to be a coordinated fix with your hosting provider, depending on your terms of service and such. – Bart Silverstrim Dec 15 '09 at 13:33
Checking how it was hacked depends on more variables...logfiles? If they're on the same system as the hacked system they can't even be trusted, as the hacker can easily script something to wipe footprints. If you had out of date PHP or scripts that allowed unsanitized SQL statements, those could do it...only audits would really show that up. You didn't mention if it was a hack into the database, file replacement, OS found doing something it shouldn't be...nature of hack? – Bart Silverstrim Dec 15 '09 at 13:35

Having your website defaced and having your server hacked are a bit different. But you have to understand the attack. For instance if it was just an SQL injection then the only thing really affected by the attack was the database. Restoring the database from a known good backup or manually removing the malicious code that was inserted into the database is normally sufficient. And patching the program that allowed the injection to begin with. This would normally be an out of date version of WordPress or similar database driven framework.

Now if someone managed to brute force a password or log in and manually edit your pages then as Bart indicated you should talk to your provider as they will be in the best position to determine what the risks involved and take appropriate action. But I agree with the system can't be trusted point that Bart makes in general it's a good idea. With shared hosting though that's going to be up to the provider.

share|improve this answer

Don't make your password: a.

share|improve this answer
+1 for funny comment – bastianneu Dec 15 '09 at 12:53
what does that mean? my pass is combination of small and caps with numbers – Shishant Dec 15 '09 at 12:54
Also, please don't tell us anything more about your password. – larsks Dec 15 '09 at 21:43
You're wrong, it was qwerty :)) – kolypto Dec 18 '09 at 2:46

There are a lot of problems with this question that make it difficult to help you. In particular, we don't know exactly what you mean by "all the contents have been changed". Since by your own question we know that the contents on disk appear to be unmodified, this suggests that your website was not actually hacked and that something else is going on.

The first question to ask is, "am I really looking at the website I think I am?" That is, does the URL you are entering in your browser really correspond to the system that hosts your website? If there has recently been a change in DNS this may not be the case.

One way to verify this would be to watch your Apache access log whilst making a request (that is, loading a page). If you see the request in your access log then it is at least not a DNS problem. If you do not see the request, then you need to figure out what system you're actually talking to.

Without more information we can't really help you.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.