The tag has no wiki summary.

learn more… | top users | synonyms

-1
votes
1answer
37 views

Helpful linux command for do some forensic on compromised linux web server [duplicate]

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious ...
0
votes
1answer
370 views

FTK Image to VMDK

It seems that most of the posts I can find show me how to take a VMDK and convert it to an FTK Image for processing. I'd like to go the other way, and get a bootable VMWare image. I've found the ...
0
votes
1answer
74 views

Suspicious Process*User:www-data EXE:/usr/sbin/php5-fpm

I have csf installed on Debian server which uses nginx+php5-fpm and see a lot of these lfd[23293]: Suspicious Process PID:16998 PPID:16122 User:www-data Uptime:824 secs EXE:/usr/sbin/php5-fpm ...
7
votes
1answer
156 views

Administrator view ALL mapped drives

In my understanding of security, an administrator should be able to view all connections to and from a computer - just as they can view all processes/owner, network connections/owning process. ...
7
votes
1answer
1k views

Forensic Analysis of the OOM-Killer

Ubuntu's Out-Of-Memory Killer wreaked havoc on my server, quietly assassinating my applications, sendmail, apache and others. I've managed to learn what the OOM Killer is, and about its "badness" ...
1
vote
2answers
398 views

Malware : Identifying & Cleaning Malware on a LAMP site

EDIT : Further information / investigation information contained in the comments to this post Apologies for the vague title - had trouble summarising this one. I have recently discovered that one of ...
0
votes
2answers
322 views

GREP REGEX Date for EnCase

I'm looking for a GREP REGEX for EnCase 03/03/02 @ 10:00:00 The point is looking for files that were created on that date.
3
votes
3answers
2k views

Foremost custom file type not accepted by -t argument

I'm trying to recover a deleted file on an ext3 file system using the foremost utility. The file I want to recover is a hpp C++ source code file. However, foremost does not automatically support the ...
2
votes
1answer
88 views

Forensics on Virtual Private servers [closed]

So these days with talks about having hacked machines being used for malware spreading and botnet C&C, the one issue that is not clear to me is what do the law enforcement agencies do once they ...
0
votes
2answers
118 views

Network shares that a Computer has connected to

I know that Windows 7 (Registry) stores the shares that a machine has connected to. Can anybody tell me what the registry location is ? According to : Forensic Focus, it should be under ...
47
votes
2answers
3k views

Mysterious visitor to hidden PHP page

On my website, I have a "hidden" page that displays a list of the most recent visitors. There exist no links at all to this single PHP page, and, theoretically, only I know of its existence. I check ...
0
votes
3answers
3k views

How to calculate the starting address of a partition from MBR

Given a MBR and the structure of MBR/partition table, how can you calculate the size and starting address of each partition? For clarification let's say I was given this- Answer: There are ...
4
votes
2answers
2k views

How to determine which file/inode occupies a given sector

I received messages in /var/log/kern.log that indicate drive failure. The messages occured while copying my $HOME between drives (ext4 -> ext3): [ 5733.186033] sd 4:0:0:0: [sdb] Unhandled sense code ...
2
votes
1answer
601 views

Find the source of malware?

I have a server that was running an older version of lighttpd (1.4.19 on a freebsd 6.2-RELEASE (yea, old) machine) and google alerted me that it had found malware embedded on one of my server's pages. ...
0
votes
2answers
303 views

Strange Items in Hosts File and Netstat

I ran a netstat -a on a computer and there were a number of strange items: Proto Local Address Foreign Address State TCP netgym:epmap virusin:0 LISTENING ...
6
votes
3answers
2k views

Find IP address of a device?

Open question: How to find the IP address of a device? As I understand, there are no guaranteed methods that work always, but there's a hundred approaches that work in specific situations, and I'd ...
1
vote
8answers
187 views

Learn as much as possible about the setup behind a website

Let's say I'm in the process of planning the setup of a website. I study similar sites that offer similar services or might receive similar traffic model. Is there a way to determine a bit the kind ...
10
votes
3answers
956 views

Website defaced, what can I do?

My company's website has been defaced, provided I have the apache raw access log, is there anything I could do to analyze when and what went wrong? I mean what to look out for among all those ...
2
votes
3answers
432 views

How to find out if my server is compromised?

I have a linux VPS and I received a complaint that my server was scanning on port 22 some other network. How do I find out if it was compromised or not?
1
vote
4answers
758 views

Linux backdoors I should be wary of

I'm new to the server management realm and I'm sure my server is very insecure. I've gone through the WHM CPanel security check but I'm sure to the real gurus, that check is stupid and nowhere near ...