Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (4)

0
votes
2answers
868 views

Can't delete corrupt files on Linux

So I got hit by a script kitte... Fortunately the box is Ubuntu and was able to replace w/ binaries from a comparable system, however, Some of the files I couldn't delete, and am still stumped on ...
0
votes
1answer
49 views

Database got hacked and now our server is unresponsive. [duplicate]

Just recently we noticed in our website (which was made by a 3rd party before) that the database was compromised. All data was appended by a small html information. What we did is to change all the ...
0
votes
1answer
129 views

Constantly someone is making request for index.xml

My server was recently been compromised due to Joomla and allow_url_fopen = ON I see various php files on my server root having this content in them Restricted accoss <?php error_reporting(0); ...
-2
votes
1answer
50 views

Read a file created by root user on unix system [closed]

I have a file created by root user on unix system and the file is assigned to a particular group.All I want to do is read that file by logging in as user which is not root and not a part that ...
1
vote
0answers
26 views

What is a logical approach to tracking IPv6 connections for abuse? [duplicate]

I have a web server that issues AAAA records and I want to understand how I should monitor that interface for abuse. Specifically, how should I dice up that address to determine hacking or brute ...
-2
votes
1answer
55 views

Local development server risk: inbound connection [closed]

My local development environment is Windows with xampp/nginx. Yesterday I installed malwarebytes and today when I started my xampp server, I soon find out that there is an inbound connection blocked ...
2
votes
1answer
888 views

remove shared library from sshd [duplicate]

mv /lib64/libkeyutils.so.1.9 /root service sshd restart Stopping sshd: [ OK ] Starting sshd: /usr/sbin/sshd: error while loading shared libraries: ...
-2
votes
1answer
62 views

Would this be considered hacking? [closed]

There is this prominent US based News network which allows people to post comments and vote on the comments. While monitoring the http traffic using fiddler, I felt their ajax post had an obvious ...
-1
votes
1answer
125 views

list of IPs that are source of brute force attacks [closed]

I'm getting a lot of attempts to bruteforce into a database. Possibly other attempts too, but this is what I'm focusing on for now. I've compiled a list of IP addresses that are sources of this ...
4
votes
3answers
113 views

What protocol should be followed if website is actively under attack?

When you have just detected your website is currently under a hack attack that is attempting to penetrate your website, I am not including Denial of service in my question, what do you do? Are there ...
0
votes
1answer
148 views

Server hacked: How do I fix, diagnosis and prevent? [duplicate]

Possible Duplicate: How do I deal with a compromised server? WP Site (up to date with version & plug ins) Cheap budget host Inserted on all of my pages inside the tags are the ...
1
vote
1answer
319 views

Mysql root password change by some one [duplicate]

Possible Duplicate: How do I deal with a compromised server? I'm confused, i have a server that is accessible to the public, but i've been 3 times i was in the locker mysql root password by ...
0
votes
2answers
238 views

Asp.net IIS Hacking early warning system

I am running an asp.net website on IIS 7.5 and windows 2008 R2 server. How do I setup (or what do I need) in order to have an alert if there is a hacking attempt against the website and server,? How ...
1
vote
0answers
38 views

When a possible hacker logs into my server, how can I see what they're doing? [duplicate]

Possible Duplicate: Monitor an incoming SSH session in real time I have a CentOS VPS running lfd, and occasionally I see someone logging into my server from an unexpected location. I'm ...
0
votes
0answers
153 views

"Success resolving X in X after reducing the advertised. Possible hack?

In my sys log I sometimes see this message: success resolving 'ns.macomnet.ru/AAAA' (in 'macomnet.ru'?) after reducing the advertised EDNS UDP packet size to 512 octets I am not using those name ...
-4
votes
1answer
221 views

Hacked websites by inserting code in .js files [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY It seems that someone hacked I bunch of sites I own by inserting code in all the .js files. function g(){var r=new RegExp("(?:; ...
0
votes
1answer
131 views

Is my webserver being abused for banking fraud?

Since a few weeks i'm getting a lot of 403 errors from apache in my log files that seem to be related to a bank frauding scheme. The relevant log entries look like this (The ip 1.2.3.4 is one I made ...
1
vote
4answers
329 views

Apache Website : How to protect against URL testing

I have a website running on Linux with Apache. I can see on the access log file several IP addresses trying to access some common and well known application like PhpMyAdmin, probably to hack the ...
1
vote
0answers
72 views

Mass targeted malware installed - g00glestatic.com [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I run a webserver which over the last few days seems to have become infected with malware that tries to include content from ...
0
votes
1answer
61 views

Script Injection on random pages [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I am currently running a Windows 2003 server with IIS 6.0. It seems to be that one of the website has been 'hacked'. <script ...
-1
votes
1answer
471 views

Lots of new qmail accounts in Ubuntu 12. Have I been hacked?

I am using Ubuntu 12.04. Recently, lots of new qmail accounts started appearing at the login screen. Excluding my account, 6 new users viz qmaill, qmailr, qmailr, qmails, qmailp and alias are now ...
0
votes
2answers
311 views

Nginx 400 errors due to random encoded string starting with “\x” from random IP addresses

I assume these are some sort of bots, but would like to know what are they trying to do to my server. The logs in questions are below and the IP address has been changed from the original. ...
4
votes
3answers
1k views

How do I secure my Asterisk server?

Our asterisk server was compromised. some calls were made to Asia countries last weekend. Thought we have improved our network configuration, we still want to determine how the intrusion was done, we ...
-1
votes
3answers
367 views

Entries in `/etc/inittab` below last line - possible hack? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My Linux machine has been hacked lately. There are a few entires in /etc/inittab below the #end of /etc/inittab Something ...
3
votes
5answers
1k views

How to analyse logs after the site was hacked

One of our web-projects was hacked. Malefactor changed some template files in project and 1 core file of the web-framework (it's one of the famous php-frameworks). We found all corrupted files by git ...
2
votes
1answer
3k views

Someone try to hack my site, want to understand the log

I have a wordpress site hosted on CentOS 6. After see the following access log, I checked the server, it seems ok. Can anyone explain what does this guy trying to do? Did they get what they want? I ...
-1
votes
1answer
78 views

Is it more secure to spoof addresses using the HOSTS file?

If I have a Windows service with a config file that points to web services it needs to call, is it more secure to put a fake DNS name for the server being connected to, then update the HOSTS file to ...
2
votes
1answer
326 views

Load too high and many files including iptables missing: Is my server under attack?

My server was under heavy load around 400 and above. Here is the link of Server Fault question I was able to see the rm command and xargs running in top output, in which I was the one and only ...
1
vote
2answers
176 views

I got some message about suspended site, which I have to debug, how do I proceed? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY The hosting company supplied an email to its client and the client wanted some help from me. the message states: Any items listed ...
-2
votes
1answer
148 views

My php script hacked again and again? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I did a php script my self for a digital shop store but a hacker is hacking it again and again. He is copying some php and ...
4
votes
1answer
2k views

code injection, some sort of hack?

something seems to have either hacked a webserver, or we have some sort of semi-malicious code running that keeps injecting code into our website. it seems to affect just a couple of coldfusion and ...
0
votes
0answers
35 views

rDNS records changed to point to .tk domains. why? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I was having trouble reaching our plesk control panel on our mediatemple dv. In the process of trying to figure out why I saw that ...
0
votes
1answer
86 views

My site was hacked, but just for bots [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Help! My site has been hacked. The pages served to regular users are ok, but the pages served to bots (like google and facebook) ...
-1
votes
3answers
182 views

How can a website recover from code injection especially the domain name?

My website was recently hacked that apparently it came under code injection vulnerability not SQL injection. At least that's what Google is telling me and even gave me a possible iframe codes. That ...
-3
votes
1answer
197 views

Got hacked, cannot understand how [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY In log i found that site was scanned by hacker for few hours but actual hack was few minutes i think. He somehow found out about ...
-1
votes
1answer
1k views

Anti-Malware Antivirus for Linux Web Server? [closed]

Does anyone have experience running anti-virus software on a Linux web server, especially CentOS, and what do you recommend? I'm interested in putting it on a web server we have as one more method ...
8
votes
3answers
842 views

Unsecured MySQL 'root'@'localhost' account accessed remotely?

A little background: We've just had our PBX system hacked. The server itself seems secure (no logged unauthorised console access - SSH etc), but somehow the hackers have managed to inject a new admin ...
0
votes
3answers
185 views

Server not responding, after reset, all data rolled few months back

A Debian Server stopped responding earlier today. After hardware reset, the data on server was rolled back several months ago to the state it was in february. How is this possible?Everything, logs, ...
0
votes
1answer
256 views

Website visitors are still being redirected after “fixing” the damage from a conditional redirect website attack

BACKGROUND A website of mine was recently the target of a conditional redirect attack. PHP code was added to my pages to redirect visitors. The .htaccess file was edited to redirect visitors. ...
-2
votes
1answer
577 views

Has my server been hacked? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I have some problem with my server (running on Centos 5). While checking traffic, I run "$lsof | grep ezbuyinfo" and it show too ...
2
votes
4answers
1k views

Is this server hacked or just login attempts ? See log

Can someone tell what does this mean? I tried a command like lastb to see last user logins and I see some strange logins from China (server is EU, I am in EU). I was wondering if these could be login ...
-1
votes
1answer
414 views

.htaccess attack redirect all the sites in the server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My site is hacked and I've asked yesterday about this issue. I've changed the FTP password, the server password. I also have ...
-1
votes
2answers
221 views

My Wordpress site being hack by modifying the .htaccess [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm going crazy right now and I don't know what to do. I've did a Google search about those hackers where they using .htaccess to ...
1
vote
1answer
410 views

Plesk Qmail Queue Exploding From Possible Webform Attack

The qmail queue on my server (running Plesk on CentOS 5.2) balloons up to 120,000+ messages in the queue overnight. The messages in the queue are obviously spam. I've cleared them out over the last ...
4
votes
3answers
1k views

Could this server log mean my server is being used as a proxy?

I came across the following entry in my access.log: 58.218.199.147 - - [05/Jun/2012:12:56:04 +1000] "GET http://proxyproxys.com/ HTTP/1.1" 200 183 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT ...
-4
votes
1answer
248 views

windows Server is hacked by SOG how any one please help me? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY my server is Win2K8 Web SRV , IIS-7, it is a web hosting server & my sites was hacked by someone it is hacked by SOG say's ...
-3
votes
1answer
138 views

How do I go about getting my system hacked? [closed]

I have a project that will eventually be posted as a public service online. Security is a big concern, and I don't have a lot of experience hardening systems and code for public scrutiny. Is there ...
0
votes
3answers
2k views

apache2 server logs - weird activity?

I was going through apache log, and I thought some of the access logs seemed suspicious... I'm not pro, just do server administration as hobby :) so I wonder if I should take some steps... ...
2
votes
1answer
129 views

Potential Bot-Net organizers probing for new machines?

I'm getting a number of exploit attempts from different IP's today. GET ...
0
votes
1answer
62 views

Periodic DNS Fault

I have a reseller account. but sometimes, somthings goes wrong on my websites. I think server is hacked or DNS server is hacked. I searched similar content on google, then I found same HTML codes on ...