Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (1)

1
vote
4answers
639 views

Random IP's constantly trying to connect to SQL Server

We are building a cloud-based application that relies on a login database as well as many individual client databases. Using rackspace we have setup a server (windows server 2012) with SQL Management ...
0
votes
1answer
1k views

Do cPHulk Brute Force Protection Settings Effect Hosts? [closed]

Question: Do my settings (shown below) prevent visitors from getting to any of the public web sites on my server if their ISP's IP Address has been blocked/black-listed through cPHulk Brute Force ...
28
votes
7answers
5k views

How can I block hacking attempts targeting phpMyAdmin?

My website gets thousands of hits daily from different IPs trying to access: /php-myadmin/ /myadmin/ /mysql/ ...and thousands of other variations. None of these directories exist, I don't even have ...
4
votes
3answers
992 views

VPS exploited for Bitcoin Mining. How to identify the flaw?

An ubuntu VPS I run to host a few basic websites seems to have had apache hacked for bitcoin mining. In my apache error.log I see the following. [Sun Dec 15 06:27:58 2013] [notice] Apache/2.2.22 ...
1
vote
1answer
52 views

“GET /assets/)!==t&&(e.html(e.data( HTTP/1.1” 200 3538 “-” “Java/1.7.0_25”

I'm seeing GET requests like: "GET /assets/)!==t&&(e.html(e.data( HTTP/1.1" 200 3538 "-" "Java/1.7.0_25" in my logs for a box hosting a Rails app. Looks suspiciously like someone probing ...
0
votes
2answers
67 views

login page permission has changed suspiciously [duplicate]

I have developed a website with php and apache server on linux centos I am not professional on security issues and I think some folks try to hack my website first please advice me which security ...
1
vote
3answers
339 views

Check IP who is visiting my site on nginx

I don't really want to know about this since I would like to keep it really private and give my visitor their privacy as much as possible (Not that my blog is popular though). I just installed Ubuntu ...
-1
votes
1answer
336 views

My URL has been identified as a phishing site [duplicate]

Some months before ordered VPS at Ramnode According to tutorial (ZPanelCP on CentOS 6.4) http://www.zvps.co.uk/zpanelcp/centos-6 Installed CentOS and ZPanel) Today received email We are requesting ...
-1
votes
1answer
197 views

Hacked website, code is encrypted in hex, unable to identify [duplicate]

my web site hacked and i am getting code in index page, but i am unable to find that where is the code in my web site... ...
0
votes
1answer
216 views

How to detect malicious script in my CentOS server? [duplicate]

I am warned from my VPS provider that my server sends a lot of SSH SYN Attack to other servers, but I have no idea how to deal with it. Here's the detail my provider sent me: Where can I find the ...
2
votes
1answer
399 views

Prevent user access to console but still allow svn+ssh:// access to SVN repos

I create an user john on my server and I add him into the SVN group so we can share our code and everything looks okay. Now I want to prevent this user from connecting to the console or shell via SSH. ...
0
votes
0answers
124 views

Automatic IPSec IP Blacklist

A new client of ours has a legacy web app on Win Server 2008 R2 and when we started diagnosing the event logs, there were multiple ip's in China trying to hit both their sa sql account and trying to ...
0
votes
2answers
69 views

How can i make my all webistes only accessible by browsers and not auto scripts

I have that my websites have been hacked by some auto running libwww-perl BOT/0.1 (BOT for JCE) and Gecko/20100101 Is there any way that my all websites are only avaiable to genuine browsers and not ...
1
vote
1answer
1k views

What does this Apache access_log entry mean?

68.96.87.214 - - [07/Aug/2013:21:29:25 +0000] "GET /HNAP1/ HTTP/1.1" 403 501 "*************" "Mozilla/4.0 (compatible; Opera/3.0; Windows 4.10) 3.51 [en]" 177.47.105.41 - - [07/Aug/2013:21:57:26 ...
0
votes
1answer
140 views

SSH to track hacker [duplicate]

I'm very new to using SSH and my server has been hacked, someone has gone onto a website of mine and made modifications. I have the time which they did it (29/07/2013 18:14:30), but cannot see how ...
0
votes
2answers
74 views

Looking for a shell command to read non-binary part of most common image types

A website I'm hosting on my dedicated server has been hacked. Some pictures have been infected with things like <?php eval(base64_decode(....));?>. I'm looking for a generic shell command which ...
0
votes
1answer
997 views

How to detect my server is used as a port scanner? [duplicate]

My Web Server is running Ubuntu 12.04.2 LTS with all security updates installed. It is used as a Web Proxy server that handles incoming requests on HTTP/80 HTTPS/443 but also retrieves web content ...
1
vote
2answers
87 views

Remote code integrity checking prior to execution

I'm contemplating putting a site online that could be an attractive target for hackers or employees of the host, who could alter the site's code to their benefit. Not wishing to self-host, I was ...
0
votes
2answers
112 views

Should I be concerned with seeing this in my logs?

The following requests (this is about half of them) in my Nginx access log have all come over the span of a few minutes from an IP that is registered to an ISP in Vietnam (I could provide the IP, but ...
0
votes
1answer
1k views

Hacking attempt detected, Can we block user by PC-Name

Recently we notied that hackers are trying to hack our server, we have IP blocking softwares installed on our server but the thing is that, hacker is using dynamic ip addresses to try again and ...
1
vote
1answer
768 views

client 157.56.229.87 attempt to invoke directory as script: /usr/lib/cgi-bin/

Ok, so i frequently check my logs and see an array of errors logs from people "scoping the joint" but today i noticed a new one: [client 157.56.229.87] attempt to invoke directory as script: ...
0
votes
1answer
152 views

DB Detection: MySQL >=5 (Auto Detected) Method: GET Type: Integer (Auto Detected)

Could someone please tell me which penetration-testing tool leaves behind a page that looks like this? DB Detection: MySQL >=5 (Auto Detected) Method: GET Type: Integer (Auto Detected) ...
1
vote
1answer
261 views

How to lockdown a Ubuntu 12.04 web server [duplicate]

All my servers have just been hacked and now I'm ready to start locking down my web servers. They are currently running Ubuntu 12.04 with nginx 1.27 php5-fpm php 5.4.14 mysql 5.5 postgresql 9.1 ...
0
votes
1answer
100 views

Wordpress blog hacked [duplicate]

My wordpress blog has been hacked. Any page that I got to it shows the page html that hacker put in some where. I am not wordpress expert but it looks like hacker put the code somewhere (in database ...
1
vote
0answers
467 views

Server getting constant DNS TXT queries - What is the hazard potential?

recently I discovered that my server was generating a lot more traffic than normal. Normally I get around 1-10 Mb per day, since the server only works as a host for eMail and static websites. ...
11
votes
4answers
2k views

Can a virtual machine (VM) “hack” another VM running on the same physical machine?

Questions: if a VM is corrupted (hacked), what do I risk on others VMs running on the same physical machine? What kind of security issues is there between VMs running on the same physical host? Is ...
0
votes
1answer
164 views

Many of joomla websites on my server have been hacked; no other kind of website [duplicate]

Today I got that many of Joomla websites on my server are hacked. Some of the hacked joomlas were updated (the last version from 2.5 series) with the last version. In many cases, the main index.php ...
0
votes
1answer
150 views

Tool to automatic suspending the DDOSed website before the whole VPS is being suspended by Data center [duplicate]

I have a non-Xen VPS (don't exactly know what the software is). The past week, we had experienced several DDOS attacks on one (or some) of the hosts and because of using more than usual bandwidth, ...
0
votes
2answers
2k views

Can't delete corrupt files on Linux

So I got hit by a script kitte... Fortunately the box is Ubuntu and was able to replace w/ binaries from a comparable system, however, Some of the files I couldn't delete, and am still stumped on ...
0
votes
1answer
59 views

Database got hacked and now our server is unresponsive. [duplicate]

Just recently we noticed in our website (which was made by a 3rd party before) that the database was compromised. All data was appended by a small html information. What we did is to change all the ...
0
votes
1answer
151 views

Constantly someone is making request for index.xml

My server was recently been compromised due to Joomla and allow_url_fopen = ON I see various php files on my server root having this content in them Restricted accoss <?php error_reporting(0); ...
-2
votes
1answer
52 views

Read a file created by root user on unix system [closed]

I have a file created by root user on unix system and the file is assigned to a particular group.All I want to do is read that file by logging in as user which is not root and not a part that ...
1
vote
0answers
29 views

What is a logical approach to tracking IPv6 connections for abuse? [duplicate]

I have a web server that issues AAAA records and I want to understand how I should monitor that interface for abuse. Specifically, how should I dice up that address to determine hacking or brute ...
-2
votes
1answer
58 views

Local development server risk: inbound connection [closed]

My local development environment is Windows with xampp/nginx. Yesterday I installed malwarebytes and today when I started my xampp server, I soon find out that there is an inbound connection blocked ...
2
votes
3answers
159 views

mysql server - how can I restore a backup remotely (from the server itself ) without ssh access ? Hack my server

I created an instances on a cloud provider . Generated the .pem key to login through ssh. Installed mysql-server , downloaded the .sql backup on the server. removed the .sql backup from my local ...
2
votes
1answer
1k views

remove shared library from sshd [duplicate]

mv /lib64/libkeyutils.so.1.9 /root service sshd restart Stopping sshd: [ OK ] Starting sshd: /usr/sbin/sshd: error while loading shared libraries: ...
-2
votes
1answer
66 views

Would this be considered hacking? [closed]

There is this prominent US based News network which allows people to post comments and vote on the comments. While monitoring the http traffic using fiddler, I felt their ajax post had an obvious ...
-1
votes
1answer
146 views

list of IPs that are source of brute force attacks [closed]

I'm getting a lot of attempts to bruteforce into a database. Possibly other attempts too, but this is what I'm focusing on for now. I've compiled a list of IP addresses that are sources of this ...
4
votes
3answers
121 views

What protocol should be followed if website is actively under attack?

When you have just detected your website is currently under a hack attack that is attempting to penetrate your website, I am not including Denial of service in my question, what do you do? Are there ...
0
votes
1answer
161 views

Server hacked: How do I fix, diagnosis and prevent? [duplicate]

Possible Duplicate: How do I deal with a compromised server? WP Site (up to date with version & plug ins) Cheap budget host Inserted on all of my pages inside the tags are the ...
1
vote
1answer
703 views

Mysql root password change by some one [duplicate]

Possible Duplicate: How do I deal with a compromised server? I'm confused, i have a server that is accessible to the public, but i've been 3 times i was in the locker mysql root password by ...
0
votes
2answers
303 views

Asp.net IIS Hacking early warning system

I am running an asp.net website on IIS 7.5 and windows 2008 R2 server. How do I setup (or what do I need) in order to have an alert if there is a hacking attempt against the website and server,? How ...
-4
votes
1answer
291 views

Hacked websites by inserting code in .js files [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY It seems that someone hacked I bunch of sites I own by inserting code in all the .js files. function g(){var r=new RegExp("(?:; ...
0
votes
1answer
152 views

Is my webserver being abused for banking fraud?

Since a few weeks i'm getting a lot of 403 errors from apache in my log files that seem to be related to a bank frauding scheme. The relevant log entries look like this (The ip 1.2.3.4 is one I made ...
1
vote
4answers
417 views

Apache Website : How to protect against URL testing

I have a website running on Linux with Apache. I can see on the access log file several IP addresses trying to access some common and well known application like PhpMyAdmin, probably to hack the ...
0
votes
0answers
77 views

Mass targeted malware installed - g00glestatic.com [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I run a webserver which over the last few days seems to have become infected with malware that tries to include content from ...
0
votes
1answer
79 views

Script Injection on random pages [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I am currently running a Windows 2003 server with IIS 6.0. It seems to be that one of the website has been 'hacked'. <script ...
-1
votes
1answer
543 views

Lots of new qmail accounts in Ubuntu 12. Have I been hacked?

I am using Ubuntu 12.04. Recently, lots of new qmail accounts started appearing at the login screen. Excluding my account, 6 new users viz qmaill, qmailr, qmailr, qmails, qmailp and alias are now ...
2
votes
2answers
485 views

Nginx 400 errors due to random encoded string starting with “\x” from random IP addresses

I assume these are some sort of bots, but would like to know what are they trying to do to my server. The logs in questions are below and the IP address has been changed from the original. ...
5
votes
3answers
1k views

How do I secure my Asterisk server?

Our asterisk server was compromised. some calls were made to Asia countries last weekend. Thought we have improved our network configuration, we still want to determine how the intrusion was done, we ...