Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (1)

-3
votes
0answers
20 views

how to get back my server root access after it hacked [duplicate]

I am very new to server environment. I have dedicated server hosting my application. I have a root access for that IP so I used ftp client to manage files from windows system. Now, someone hacked my ...
0
votes
0answers
27 views

How to respond to password crack on SSH server? [duplicate]

Update: I'd already read How do I deal with a compromised server? but was hoping for advice specific to a password crack (such as using fail2ban), as well as info about whether this could be an OS ...
0
votes
0answers
18 views

How to determine how a file was created on ubuntu web server?

I recently installed inotify to monitor my server, I was alerted to the following file being created. Which I promptly deleted. But obviously that isn't good. How can I find out how or where the ...
0
votes
0answers
8 views

invalid_userauth_request on server log [duplicate]

Hi I am getting this type of logs on my server frequent for few days: May 3 06:06:00 cloud sshd[***]: Invalid user tomcat from 184.173.54.130 May 3 06:06:00 cloud sshd[***]: input_userauth_request: ...
0
votes
1answer
29 views

.htaccess file permissions changed

I have a weird problem on some of my servers with Directadmin and Wordpress installed. The file permissions of the .htaccess file are set to 444. When I change them back to 644, edit the file and save ...
0
votes
0answers
19 views

Tripwire security

I have installed Tripwire on a temporary server to get a feel for it. Everything seems to be working (e.g. it detects changes and sends an email report). If I understand Tripwire correctly it is ...
2
votes
1answer
46 views

openSUSE installs and VMs constantly being hacked and bricked

Sorry if this is a total newbie question, but I'm doing frontend design work for a radical political organisation and ALL my installations of Linux, be they openSUSE, Ubuntu or Fedora keep getting ...
0
votes
0answers
18 views

Website was hacked but only 1 domain [duplicate]

I recently found out that one of my Domains (which was only a empty Wordpress installation), was hacked. The website didn't show the wordpress installation anymore, instead there was just a website ...
0
votes
0answers
12 views

How did my non-CMS based website get hacked? I have a file called mails.php which contains a preg_replace statement [duplicate]

I have a series of websites in my server, all of which share the same set of PHP files. They're not based in any CMS (no Wordpress, no Joomla, etc.). All of them contain my own "CMS" so to speak. I've ...
-3
votes
1answer
95 views

I think I'm Hacked. MySQL Server Too Many Connections Made my Server CPU load 100% [closed]

I'm having a very urgent problem. Suddenly today My Server can't send email, after i checked out the log turns out there are many errors from MySQL which says too many connections. I checked out my ...
0
votes
1answer
67 views

Php script - Have I been hacked [closed]

Here is the PHP script I have found at the root of each of my website folder. Script name is fcb.php Content is : <? $GLOBALS['_1303753477_']=Array(base64_decode('YX' ...
-2
votes
1answer
70 views

Deep packet Inspection Stenography [closed]

I'm trying to develop something that can get around Deep Packet Inspection so that rather than looking like OpenVPN traffic etc, I could put all that into HTTP packets as extra information or some ...
-1
votes
1answer
89 views

AWS account hacked! Amazon isn't helping. What can I do?

Recently, someone hacked my AWS account by getting into the email account used for AWS and requesting a password change. Afterwards, they obviously changed the password of the email address. Amazon ...
0
votes
1answer
67 views

Apache2 access logs suspicious, what kind of attack is this

Essentially I have a webcam set up at home to record movement, and I set up a basic Apache server so that I can externally access said videos stored. The server is running on my laptop and I have ...
0
votes
2answers
41 views

How safe is IPtables whitelisting?

I am deploying some VPS and of course, security is a big concern. I read that IPtables whitelisting is the best way to safeguard your machine. So I set up the follwing : echo "Flushing rules" ...
0
votes
2answers
99 views

Requests made to a website with a different domain/url in log files, hacking attempt?

in one of my websites I am logging all url requests made to the server. I log that data for stats purpose to improve the website. The logs look like http://example.com/search 2016-01-12 ...
0
votes
0answers
23 views

netstat -r on debian give abnormal output

after looking for stuff with Debian "netstat" and try list stuff with "nestat -r" my main Server out a Long list of unkown Hosts ( mostly hacked IP´s by looking on abuseDB ) here a small example for ...
0
votes
0answers
14 views

Error 522, server not responding [duplicate]

I've an issue with my Google Cloud compute VM. It's running Ubuntu 14.04, Apache2, PHP and Percona MySQL. The server won't respond to TCP connections on port 80. I can connect via SSH, and the server ...
4
votes
1answer
674 views

Anomalous connection to china from debian server [duplicate]

TL;DR I didn't ask how to take care of my compromised server. I asked how to detect if a file is anomalous/extraneous/non-official. So this is not a duplicate of the question on compromised servers. ...
0
votes
1answer
72 views

found movies inside my server [duplicate]

This morning i found movies inside my server (debian VPS, apache,webmin/virtualmin), files are located in /var/log/roundcube/./ and the user/group is www-data I looked in my log (apache,proftp,auth) ...
0
votes
0answers
21 views

Prevent bruteforcelogin attacks from my server [duplicate]

i have received this warning from google that my server has attacked their servers/partners, see the email below Thank you for your follow up! We received an external report for malicious ...
0
votes
0answers
39 views

How to find out if I've been hacked [duplicate]

I am running Apache2 webserver and someone has attempted to hack me. using this script. How can can find if the attack worked and what its done if it has worked. I'm running Kali Linux 2.0. ...
0
votes
0answers
153 views

http cookie contains datr not working (none packets is returned) wireshark

When I filter in wireshark: http.cookie contains datr none packets is returned, the list in null. What's I going wrong?
0
votes
0answers
124 views

whos hacking my FreeSwitch from my own IP?

i have a very odd thing happening in my FreeSWITCH log, it seems that someone is calling me from my own ip address for example [NOTICE] switch_channel.c:1053 New Channel ...
2
votes
1answer
328 views

Possible Cisco Router Hack?

We have a Cisco EPC3928AD EuroDocsis 3.0 2-PORT Voice Gateway from our ISP. The router is connected to a firewall (an Ubuntu-box running iptables and Wireshark). Our LAN (10.0.0.1/24) is beyond the ...
1
vote
2answers
887 views

Server got hacked by some Crypto Lockers [duplicate]

My server (CentOS) recently got hacked by some Crypto Hackers. They encrypted all of my files and asking for ransom to decrypt the files. They kept a message in all folders, which start like this ...
0
votes
0answers
86 views

mod_evasive: Stop attacks against wp-login.php

i would like to stop attacks against some user's WordPress-installations on my server. This is an example of an attack: 91.208.65.12 - - [20/Oct/2015:10:33:08 +0200] "POST /wp-login.php HTTP/1.0" ...
1
vote
1answer
55 views

How to find location of wifi packet floods

We've seen ongoing wireless packet floods (beacon, probe requests, and probe response floods) that are reported in the event log of our office firewall appliance. These are being sent continuously and ...
-1
votes
2answers
129 views

Is this someone trying to hack the server?

I keep seeing the following coming up in my nginx and Apache server log files as a 400: () { :; }; /bin/ping -c 3 x.x.x.x x.x.x.x is different IPs. Does this look like a hacker trying to find a ...
-1
votes
1answer
149 views

Found someone hacking in my LAMP server centos 7 using GET request with WGET

This is a bit confusing and I think I was hit by a shellshock, by the way I'm not a sysadmin and only know a little bit about handling a linux. I'm running a website (LAMP) and hosting it in Digital ...
-1
votes
1answer
393 views

Server 2012 R2 TCP Timestamps

We will be having some penetration testing performed shortly and looking to clean up a few things. One of these is TCP timstamps in Windows. A simiple NMAP scan shows me a guess of the TCP timestamp ...
0
votes
0answers
229 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
0
votes
0answers
8 views

Maldet HIT LIST - what now? [duplicate]

I have gotten the following result after a maldet scan, should I just delete the 3 files, or is there something else I should do? FILE HIT LIST: {HEX}gzbase64.inject.unclassed.15 : ...
-1
votes
1answer
128 views

Exchange Sever Being Hacked

We have a two server Exchange environment and they've been hacked in some way. get-queue displays tens of thousands of emails in the queues. Most of the email was being sent to yahoo.com.tw, ...
0
votes
1answer
109 views

Weak points of ssh tunnel and x11 server, hack investigation

So, today I've been hacked. It's very puzzling to me how it was done, so I'm looking for experienced people to show weak points in design of my systems. I have two servers. One is VPS with ...
-1
votes
2answers
96 views

how to prevent non-admin user to gain admin access using overflow [closed]

There are all sort of coding best practices to prevent stack overflow attack but that is not what this question is about. What I want to know is how to prevent a legit non-admin user running a piece ...
3
votes
2answers
906 views

Stop China from connecting to my Google Compute Engine server

My company has a Google Compute Engine server hosted in North America. We get so many Chinese IP addresses sending requests to port 11 that it is costing us money for the ingress. Our firewall blocks ...
0
votes
1answer
292 views

Mysql crashed showing following errors. Is this a hack?

2015-05-17 14:50:38 1896 [Warning] Host name 'hn.kd.ny.adsl' could not be resolved: No such host is known. 2015-05-18 00:11:23 1896 [Warning] IP address '222.186.21.38' could not be resolved: The ...
-3
votes
1answer
130 views

How could this hack have been possible unless the host itself was compromised? [closed]

UPDATE II: I honestly fail to see how my question is inappropriate for this site, and no one seems to want to give me a reasonable response for that, but whatevs, I solved it. Thanks to the actual ...
-1
votes
1answer
113 views

Is it a ok wordpress file or is hack, look at this code [duplicate]

I was facing a hack My website is not hosted on a server but shared hosting, If server is hacked I cannot do anything. My Question is not about how to safeguard the server, but is the below code is ...
1
vote
1answer
89 views

Weird server behavior, fear security breach but nothing on logs

These days my hosting (a2hosting) had an issue with the node hosting my VPS and during this period my users noticed a weird behavior other than the several restarts that happened while there were ...
2
votes
2answers
98 views

What are some of the hacks that DNSsec is intended to prevent

I know that the overall purpose of DNSsec is to prevent spoofing your DNS record. But what are some of the actual processes/routines that are used that DNSsec actively prevents?
-1
votes
1answer
104 views

Understanding Postfix Mail Log (Part II)

There are several logs like below in my Postfix mail log: Mar 9 06:01:10 postfix/smtpd[23043]: initializing the server-side TLS engine Mar 9 06:01:10 postfix/smtpd[23043]: connect from ...
1
vote
0answers
24 views

Website ftp details hacked by Alsancak Tim [duplicate]

My web files are hacked by Alsancak Tim. some ine is hacked ftp username and password. then going to delete all files and updated his own file. Now i am looking my website, it display a new ...
2
votes
3answers
131 views

Block people searching for server admin pages

Occasionally I flip through our (apache) access log and I often come across people trying to fish for admin pages. For example, they are trying to access pages like: /wp-login.php ...
1
vote
1answer
218 views

Understanding Postfix Mail Log

Recently I checked my mail log and found a lot of messages like this (some cipher text have been truncated): Feb 23 11:57:42 postfix/smtpd[32451]: initializing the server-side TLS engine Feb 23 ...
-5
votes
1answer
101 views

how does one report an RDP attack to Microsoft when it's happening in real time? [closed]

To my surprise, Security Event 10 was for 104.43.193.6 which is apparently a Microsoft ip address: http://ip2location.com/demo/104.43.193.6 =. Microsoft Corporation. Likely AFAIK some has leased ...
-3
votes
1answer
202 views

Decode array of encoded objects [duplicate]

I need some help from you.. my VPS was hacked.. I was trying to decode the files I found.. here the content of one php file, it's an array of encoded objects. Can you help me? ...
1
vote
2answers
2k views

hacking to my apache using cgi script

I newbie to web programming, so I setup an apache2 sever for my practice. It seems that someone succeeded to hack my apache server. I have notice in my access.log the following line: 81.169.174.52 - ...
3
votes
3answers
1k views

Continuous POST requests on wordpress login page - hacking attempt?

From today morning, I am witnessing a series of continuous POST requests hitting on one of blog running on wordpress software on my server. Few things about this pattern: These continuous requests ...