Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (4)

0
votes
0answers
35 views

Auto black list hackers from Apache server that hit website too fast

I notice some hackers jumping from website to website iterating all possible IP addresses and hitting them so fast and hard with their attack URLs to get some flaws. I am more interested in how to ...
2
votes
1answer
101 views

Someone tried to hack my Node.js server, need to understand a GET request in the logs

Alright, so I left my Node.js server alone for a while and came back to find some really interesting stuff in the logs. Apparently some moron from China or Poland tried to hack my server using ...
0
votes
1answer
23 views

IIS 7.5 website application pool with 'full control' permissions hackable?

Although I would never set this permission, I would like to know how a static html website with the permission mentioned in the title could be compromised. In my humble opinion, I would guess that ...
0
votes
1answer
56 views

Taking database from possibly cracked server

I have a server which is behaving erratically. While I investigate if it's been hacked, I'm also thinking about my backup options: As many posts have said the only way to truly know you're clean is ...
0
votes
1answer
68 views

Attacks to my server? [closed]

I've a VPS running a website. I've a logwatch set in the server, and I've received several alerts like: A total of 2 sites probed the server 31.4.180.163 88.1.154.211 Requests ...
2
votes
1answer
60 views

Getting old website after hack (even using wget) - No proxies involved

Our server was hacked and several pages were replaced. We manage to clean up everything. Currently if you access the website from anywhere using any browser the website shows correct and clean. Only ...
2
votes
3answers
134 views

Blocking IP addresses of obvious hack attempts [duplicate]

I have a simple Apache webserver setup and basic IP tables (ufw) for a development server. In my logs I see lines like this: [Fri May 16 10:10:36.258369 2014] [:error] [pid 15926] [client ...
1
vote
0answers
42 views

Why would someone repeatedly enter “-1” into a site search? [closed]

One of the websites I work on has been getting bombarded with site searches of "-1". The IP address appears to be coming from Eastern Europe and my first suspicion is that this is malicious. However ...
1
vote
1answer
381 views

Can I clean these two hacked servers withour reinstalling? [duplicate]

I've got two dedicated servers that some days ago started to send me notifications about unknown cron jobs running. On both servers I've got secondary accounts for my websites and the hacker has ...
1
vote
0answers
39 views

suspicious connection on server

OS: Windows Server 2003 Monitoring tool: CurrPorts When monitoring traffic on the server for traffic going out on port 80, example of results: 5/1/2014 2:36:23 PM Added cscript.exe TCP ...
0
votes
3answers
665 views

Block range of IP Addresses

I am getting bombarded with attempted hacks from China all with similar IPs. How would I block the IP range with something like 116.10.191.* etc. I am running Ubuntu Server 13.10. The current line ...
1
vote
1answer
63 views

Someone tried to access a list of hundreds of standard website urls in a go, is it a cause of concern [duplicate]

I was just checking my website logs today and found that someone accessed my website for a list of hundreds of standard urls that almost every 3rd or 4th website developed on a standard platform ...
0
votes
1answer
36 views

Two different SSID's on the same chanel. Is it safe?

If I have multiple network, that have their SSID's on the same channel, can I go into monitor mode(of the wifi interface) and capture packets of the other SSID?
2
votes
2answers
64 views

EC2 hosting, trying to understand network security model

We are hosting few virtual machines at amazon. Security groups and other configurations are set up to allow access only from desired addresses and to desired parties. The machines do talk with each ...
1
vote
0answers
63 views

How to secure tmp directory from hard link attacks when host doesn't allow partitioning

I'm a new sysadmin in the making, have learned that I need to have /tmp and /home directories on separate partitions in order to prevent possibilities of privilege escalation through hard links based ...
2
votes
0answers
80 views

What kind of hacking attempt is this? [closed]

This past week, my traffic logs are showing many hits (usually with repeated tries) for a url from perhaps 30+ different ip addresses all over the world. This is not a url that should garner more than ...
0
votes
1answer
60 views

Securing the Django web site which is run with Apache mod_wsgi

I have made a website in Django 1.6 with PostgreSQL database which is hosted on Ubuntu 12.04.3 with Apache 2.2.22 and I have recently noticed lots of hacking (probing) attempts from various IPs ...
1
vote
3answers
290 views

Is this a security breach?

I have a server running Ubuntu 10.04LTS (I know it is too old), which over the last couple of weeks has on occasion been unresponsive to network traffic, and needed a hard reset first thing in the ...
0
votes
0answers
18 views

My server was used in a regBot attack [duplicate]

I have a Ubuntu 12.04 x64 web server that I only use to host downloads from my website. My website is on another server. I am the only person with access to the server. Today it was blocked by ...
1
vote
4answers
179 views

Random IP's constantly trying to connect to SQL Server

We are building a cloud-based application that relies on a login database as well as many individual client databases. Using rackspace we have setup a server (windows server 2012) with SQL Management ...
0
votes
1answer
359 views

Do cPHulk Brute Force Protection Settings Effect Hosts?

Question: Do my settings (shown below) prevent visitors from getting to any of the public web sites on my server if their ISP's IP Address has been blocked/black-listed through cPHulk Brute Force ...
25
votes
7answers
4k views

How can I block hacking attempts targeting phpMyAdmin?

My website gets thousands of hits daily from different IPs trying to access: /php-myadmin/ /myadmin/ /mysql/ ...and thousands of other variations. None of these directories exist, I don't even have ...
4
votes
3answers
729 views

VPS exploited for Bitcoin Mining. How to identify the flaw?

An ubuntu VPS I run to host a few basic websites seems to have had apache hacked for bitcoin mining. In my apache error.log I see the following. [Sun Dec 15 06:27:58 2013] [notice] Apache/2.2.22 ...
1
vote
1answer
48 views

“GET /assets/)!==t&&(e.html(e.data( HTTP/1.1” 200 3538 “-” “Java/1.7.0_25”

I'm seeing GET requests like: "GET /assets/)!==t&&(e.html(e.data( HTTP/1.1" 200 3538 "-" "Java/1.7.0_25" in my logs for a box hosting a Rails app. Looks suspiciously like someone probing ...
0
votes
2answers
63 views

login page permission has changed suspiciously [duplicate]

I have developed a website with php and apache server on linux centos I am not professional on security issues and I think some folks try to hack my website first please advice me which security ...
1
vote
3answers
143 views

Check IP who is visiting my site on nginx

I don't really want to know about this since I would like to keep it really private and give my visitor their privacy as much as possible (Not that my blog is popular though). I just installed Ubuntu ...
0
votes
0answers
159 views

LogonUI.exe process run again and again - is someone trying to hack us?

One of our win server 2008 virtual machines is constantly at 30% cpu. Looking at the task manager I notice that LogonUI.exe appears again and again, each time with a different process id (PID). It ...
1
vote
0answers
17 views

Fedora Core 9 Being Hacked? [duplicate]

I think I have a system compromise, with sudden perl process starting at the background with the same user as apache (daemon). I found today ZMUIE, which was script to do some sort of bruteforce ...
-1
votes
1answer
143 views

My URL has been identified as a phishing site [duplicate]

Some months before ordered VPS at Ramnode According to tutorial (ZPanelCP on CentOS 6.4) http://www.zvps.co.uk/zpanelcp/centos-6 Installed CentOS and ZPanel) Today received email We are requesting ...
-1
votes
1answer
127 views

Hacked website, code is encrypted in hex, unable to identify [duplicate]

my web site hacked and i am getting code in index page, but i am unable to find that where is the code in my web site... ...
0
votes
1answer
93 views

How to detect malicious script in my CentOS server? [duplicate]

I am warned from my VPS provider that my server sends a lot of SSH SYN Attack to other servers, but I have no idea how to deal with it. Here's the detail my provider sent me: Where can I find the ...
1
vote
1answer
127 views

Prevent user access to console but still allow svn+ssh:// access to SVN repos

I create an user john on my server and I add him into the SVN group so we can share our code and everything looks okay. Now I want to prevent this user from connecting to the console or shell via SSH. ...
0
votes
0answers
68 views

Automatic IPSec IP Blacklist

A new client of ours has a legacy web app on Win Server 2008 R2 and when we started diagnosing the event logs, there were multiple ip's in China trying to hit both their sa sql account and trying to ...
0
votes
2answers
67 views

How can i make my all webistes only accessible by browsers and not auto scripts

I have that my websites have been hacked by some auto running libwww-perl BOT/0.1 (BOT for JCE) and Gecko/20100101 Is there any way that my all websites are only avaiable to genuine browsers and not ...
1
vote
1answer
1k views

What does this Apache access_log entry mean?

68.96.87.214 - - [07/Aug/2013:21:29:25 +0000] "GET /HNAP1/ HTTP/1.1" 403 501 "*************" "Mozilla/4.0 (compatible; Opera/3.0; Windows 4.10) 3.51 [en]" 177.47.105.41 - - [07/Aug/2013:21:57:26 ...
0
votes
1answer
100 views

SSH to track hacker [duplicate]

I'm very new to using SSH and my server has been hacked, someone has gone onto a website of mine and made modifications. I have the time which they did it (29/07/2013 18:14:30), but cannot see how ...
0
votes
2answers
52 views

Looking for a shell command to read non-binary part of most common image types

A website I'm hosting on my dedicated server has been hacked. Some pictures have been infected with things like <?php eval(base64_decode(....));?>. I'm looking for a generic shell command which ...
0
votes
1answer
331 views

How to detect my server is used as a port scanner? [duplicate]

My Web Server is running Ubuntu 12.04.2 LTS with all security updates installed. It is used as a Web Proxy server that handles incoming requests on HTTP/80 HTTPS/443 but also retrieves web content ...
1
vote
2answers
43 views

Remote code integrity checking prior to execution

I'm contemplating putting a site online that could be an attractive target for hackers or employees of the host, who could alter the site's code to their benefit. Not wishing to self-host, I was ...
0
votes
2answers
89 views

Should I be concerned with seeing this in my logs?

The following requests (this is about half of them) in my Nginx access log have all come over the span of a few minutes from an IP that is registered to an ISP in Vietnam (I could provide the IP, but ...
0
votes
1answer
760 views

Hacking attempt detected, Can we block user by PC-Name

Recently we notied that hackers are trying to hack our server, we have IP blocking softwares installed on our server but the thing is that, hacker is using dynamic ip addresses to try again and ...
1
vote
1answer
152 views

client 157.56.229.87 attempt to invoke directory as script: /usr/lib/cgi-bin/

Ok, so i frequently check my logs and see an array of errors logs from people "scoping the joint" but today i noticed a new one: [client 157.56.229.87] attempt to invoke directory as script: ...
0
votes
1answer
100 views

DB Detection: MySQL >=5 (Auto Detected) Method: GET Type: Integer (Auto Detected)

Could someone please tell me which penetration-testing tool leaves behind a page that looks like this? DB Detection: MySQL >=5 (Auto Detected) Method: GET Type: Integer (Auto Detected) ...
0
votes
1answer
176 views

How to lockdown a Ubuntu 12.04 web server [duplicate]

All my servers have just been hacked and now I'm ready to start locking down my web servers. They are currently running Ubuntu 12.04 with nginx 1.27 php5-fpm php 5.4.14 mysql 5.5 postgresql 9.1 ...
0
votes
1answer
88 views

Wordpress blog hacked [duplicate]

My wordpress blog has been hacked. Any page that I got to it shows the page html that hacker put in some where. I am not wordpress expert but it looks like hacker put the code somewhere (in database ...
1
vote
0answers
394 views

Server getting constant DNS TXT queries - What is the hazard potential?

recently I discovered that my server was generating a lot more traffic than normal. Normally I get around 1-10 Mb per day, since the server only works as a host for eMail and static websites. ...
9
votes
4answers
1k views

Can a virtual machine (VM) “hack” another VM running on the same physical machine?

Questions: if a VM is corrupted (hacked), what do I risk on others VMs running on the same physical machine? What kind of security issues is there between VMs running on the same physical host? Is ...
0
votes
1answer
130 views

Many of joomla websites on my server have been hacked; no other kind of website [duplicate]

Today I got that many of Joomla websites on my server are hacked. Some of the hacked joomlas were updated (the last version from 2.5 series) with the last version. In many cases, the main index.php ...
0
votes
1answer
116 views

Tool to automatic suspending the DDOSed website before the whole VPS is being suspended by Data center [duplicate]

I have a non-Xen VPS (don't exactly know what the software is). The past week, we had experienced several DDOS attacks on one (or some) of the hosts and because of using more than usual bandwidth, ...
0
votes
2answers
853 views

Can't delete corrupt files on Linux

So I got hit by a script kitte... Fortunately the box is Ubuntu and was able to replace w/ binaries from a comparable system, however, Some of the files I couldn't delete, and am still stumped on ...