Tagged Questions

Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (4)

0
votes
2answers
98 views

Should I be concerned with seeing this in my logs?

The following requests (this is about half of them) in my Nginx access log have all come over the span of a few minutes from an IP that is registered to an ISP in Vietnam (I could provide the IP, but ...
0
votes
1answer
1k views

Hacking attempt detected, Can we block user by PC-Name

Recently we notied that hackers are trying to hack our server, we have IP blocking softwares installed on our server but the thing is that, hacker is using dynamic ip addresses to try again and ...
1
vote
1answer
482 views

client 157.56.229.87 attempt to invoke directory as script: /usr/lib/cgi-bin/

Ok, so i frequently check my logs and see an array of errors logs from people "scoping the joint" but today i noticed a new one: [client 157.56.229.87] attempt to invoke directory as script: ...
0
votes
1answer
122 views

DB Detection: MySQL >=5 (Auto Detected) Method: GET Type: Integer (Auto Detected)

Could someone please tell me which penetration-testing tool leaves behind a page that looks like this? DB Detection: MySQL >=5 (Auto Detected) Method: GET Type: Integer (Auto Detected) ...
1
vote
1answer
222 views

How to lockdown a Ubuntu 12.04 web server [duplicate]

All my servers have just been hacked and now I'm ready to start locking down my web servers. They are currently running Ubuntu 12.04 with nginx 1.27 php5-fpm php 5.4.14 mysql 5.5 postgresql 9.1 ...
0
votes
1answer
97 views

Wordpress blog hacked [duplicate]

My wordpress blog has been hacked. Any page that I got to it shows the page html that hacker put in some where. I am not wordpress expert but it looks like hacker put the code somewhere (in database ...
1
vote
0answers
426 views

Server getting constant DNS TXT queries - What is the hazard potential?

recently I discovered that my server was generating a lot more traffic than normal. Normally I get around 1-10 Mb per day, since the server only works as a host for eMail and static websites. ...
11
votes
4answers
2k views

Can a virtual machine (VM) “hack” another VM running on the same physical machine?

Questions: if a VM is corrupted (hacked), what do I risk on others VMs running on the same physical machine? What kind of security issues is there between VMs running on the same physical host? Is ...
0
votes
1answer
145 views

Many of joomla websites on my server have been hacked; no other kind of website [duplicate]

Today I got that many of Joomla websites on my server are hacked. Some of the hacked joomlas were updated (the last version from 2.5 series) with the last version. In many cases, the main index.php ...
0
votes
1answer
128 views

Tool to automatic suspending the DDOSed website before the whole VPS is being suspended by Data center [duplicate]

I have a non-Xen VPS (don't exactly know what the software is). The past week, we had experienced several DDOS attacks on one (or some) of the hosts and because of using more than usual bandwidth, ...
0
votes
2answers
1k views

Can't delete corrupt files on Linux

So I got hit by a script kitte... Fortunately the box is Ubuntu and was able to replace w/ binaries from a comparable system, however, Some of the files I couldn't delete, and am still stumped on ...
0
votes
1answer
56 views

Database got hacked and now our server is unresponsive. [duplicate]

Just recently we noticed in our website (which was made by a 3rd party before) that the database was compromised. All data was appended by a small html information. What we did is to change all the ...
0
votes
1answer
138 views

Constantly someone is making request for index.xml

My server was recently been compromised due to Joomla and allow_url_fopen = ON I see various php files on my server root having this content in them Restricted accoss <?php error_reporting(0); ...
-2
votes
1answer
51 views

Read a file created by root user on unix system [closed]

I have a file created by root user on unix system and the file is assigned to a particular group.All I want to do is read that file by logging in as user which is not root and not a part that ...
1
vote
0answers
28 views

What is a logical approach to tracking IPv6 connections for abuse? [duplicate]

I have a web server that issues AAAA records and I want to understand how I should monitor that interface for abuse. Specifically, how should I dice up that address to determine hacking or brute ...
-2
votes
1answer
56 views

Local development server risk: inbound connection [closed]

My local development environment is Windows with xampp/nginx. Yesterday I installed malwarebytes and today when I started my xampp server, I soon find out that there is an inbound connection blocked ...
2
votes
1answer
1k views

remove shared library from sshd [duplicate]

mv /lib64/libkeyutils.so.1.9 /root service sshd restart Stopping sshd: [ OK ] Starting sshd: /usr/sbin/sshd: error while loading shared libraries: ...
-2
votes
1answer
64 views

Would this be considered hacking? [closed]

There is this prominent US based News network which allows people to post comments and vote on the comments. While monitoring the http traffic using fiddler, I felt their ajax post had an obvious ...
-1
votes
1answer
137 views

list of IPs that are source of brute force attacks [closed]

I'm getting a lot of attempts to bruteforce into a database. Possibly other attempts too, but this is what I'm focusing on for now. I've compiled a list of IP addresses that are sources of this ...
4
votes
3answers
119 views

What protocol should be followed if website is actively under attack?

When you have just detected your website is currently under a hack attack that is attempting to penetrate your website, I am not including Denial of service in my question, what do you do? Are there ...
0
votes
1answer
157 views

Server hacked: How do I fix, diagnosis and prevent? [duplicate]

Possible Duplicate: How do I deal with a compromised server? WP Site (up to date with version & plug ins) Cheap budget host Inserted on all of my pages inside the tags are the ...
1
vote
1answer
529 views

Mysql root password change by some one [duplicate]

Possible Duplicate: How do I deal with a compromised server? I'm confused, i have a server that is accessible to the public, but i've been 3 times i was in the locker mysql root password by ...
0
votes
2answers
258 views

Asp.net IIS Hacking early warning system

I am running an asp.net website on IIS 7.5 and windows 2008 R2 server. How do I setup (or what do I need) in order to have an alert if there is a hacking attempt against the website and server,? How ...
1
vote
0answers
41 views

When a possible hacker logs into my server, how can I see what they're doing? [duplicate]

Possible Duplicate: Monitor an incoming SSH session in real time I have a CentOS VPS running lfd, and occasionally I see someone logging into my server from an unexpected location. I'm ...
0
votes
0answers
272 views

"Success resolving X in X after reducing the advertised. Possible hack?

In my sys log I sometimes see this message: success resolving 'ns.macomnet.ru/AAAA' (in 'macomnet.ru'?) after reducing the advertised EDNS UDP packet size to 512 octets I am not using those name ...
-4
votes
1answer
253 views

Hacked websites by inserting code in .js files [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY It seems that someone hacked I bunch of sites I own by inserting code in all the .js files. function g(){var r=new RegExp("(?:; ...
0
votes
1answer
140 views

Is my webserver being abused for banking fraud?

Since a few weeks i'm getting a lot of 403 errors from apache in my log files that seem to be related to a bank frauding scheme. The relevant log entries look like this (The ip 1.2.3.4 is one I made ...
1
vote
4answers
367 views

Apache Website : How to protect against URL testing

I have a website running on Linux with Apache. I can see on the access log file several IP addresses trying to access some common and well known application like PhpMyAdmin, probably to hack the ...
0
votes
0answers
76 views

Mass targeted malware installed - g00glestatic.com [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I run a webserver which over the last few days seems to have become infected with malware that tries to include content from ...
0
votes
1answer
71 views

Script Injection on random pages [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY I am currently running a Windows 2003 server with IIS 6.0. It seems to be that one of the website has been 'hacked'. <script ...
-1
votes
1answer
513 views

Lots of new qmail accounts in Ubuntu 12. Have I been hacked?

I am using Ubuntu 12.04. Recently, lots of new qmail accounts started appearing at the login screen. Excluding my account, 6 new users viz qmaill, qmailr, qmailr, qmails, qmailp and alias are now ...
0
votes
2answers
371 views

Nginx 400 errors due to random encoded string starting with “\x” from random IP addresses

I assume these are some sort of bots, but would like to know what are they trying to do to my server. The logs in questions are below and the IP address has been changed from the original. ...
4
votes
3answers
2k views

How do I secure my Asterisk server?

Our asterisk server was compromised. some calls were made to Asia countries last weekend. Thought we have improved our network configuration, we still want to determine how the intrusion was done, we ...
-1
votes
3answers
420 views

Entries in `/etc/inittab` below last line - possible hack? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My Linux machine has been hacked lately. There are a few entires in /etc/inittab below the #end of /etc/inittab Something ...
3
votes
5answers
2k views

How to analyse logs after the site was hacked

One of our web-projects was hacked. Malefactor changed some template files in project and 1 core file of the web-framework (it's one of the famous php-frameworks). We found all corrupted files by git ...
2
votes
1answer
3k views

Someone try to hack my site, want to understand the log

I have a wordpress site hosted on CentOS 6. After see the following access log, I checked the server, it seems ok. Can anyone explain what does this guy trying to do? Did they get what they want? I ...
-1
votes
1answer
79 views

Is it more secure to spoof addresses using the HOSTS file?

If I have a Windows service with a config file that points to web services it needs to call, is it more secure to put a fake DNS name for the server being connected to, then update the HOSTS file to ...
2
votes
1answer
355 views

Load too high and many files including iptables missing: Is my server under attack?

My server was under heavy load around 400 and above. Here is the link of Server Fault question I was able to see the rm command and xargs running in top output, in which I was the one and only ...
1
vote
2answers
189 views

I got some message about suspended site, which I have to debug, how do I proceed? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY The hosting company supplied an email to its client and the client wanted some help from me. the message states: Any items listed ...
-2
votes
1answer
153 views

My php script hacked again and again? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I did a php script my self for a digital shop store but a hacker is hacking it again and again. He is copying some php and ...
4
votes
1answer
2k views

code injection, some sort of hack?

something seems to have either hacked a webserver, or we have some sort of semi-malicious code running that keeps injecting code into our website. it seems to affect just a couple of coldfusion and ...
0
votes
1answer
88 views

My site was hacked, but just for bots [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Help! My site has been hacked. The pages served to regular users are ok, but the pages served to bots (like google and facebook) ...
-1
votes
3answers
189 views

How can a website recover from code injection especially the domain name?

My website was recently hacked that apparently it came under code injection vulnerability not SQL injection. At least that's what Google is telling me and even gave me a possible iframe codes. That ...
-3
votes
1answer
202 views

Got hacked, cannot understand how [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY In log i found that site was scanned by hacker for few hours but actual hack was few minutes i think. He somehow found out about ...
0
votes
1answer
1k views

Anti-Malware Antivirus for Linux Web Server? [closed]

Does anyone have experience running anti-virus software on a Linux web server, especially CentOS, and what do you recommend? I'm interested in putting it on a web server we have as one more method ...
8
votes
3answers
989 views

Unsecured MySQL 'root'@'localhost' account accessed remotely?

A little background: We've just had our PBX system hacked. The server itself seems secure (no logged unauthorised console access - SSH etc), but somehow the hackers have managed to inject a new admin ...
0
votes
3answers
189 views

Server not responding, after reset, all data rolled few months back

A Debian Server stopped responding earlier today. After hardware reset, the data on server was rolled back several months ago to the state it was in february. How is this possible?Everything, logs, ...
0
votes
1answer
263 views

Website visitors are still being redirected after “fixing” the damage from a conditional redirect website attack

BACKGROUND A website of mine was recently the target of a conditional redirect attack. PHP code was added to my pages to redirect visitors. The .htaccess file was edited to redirect visitors. ...
-2
votes
1answer
751 views

Has my server been hacked? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I have some problem with my server (running on Centos 5). While checking traffic, I run "$lsof | grep ezbuyinfo" and it show too ...
3
votes
4answers
2k views

Is this server hacked or just login attempts ? See log

Can someone tell what does this mean? I tried a command like lastb to see last user logins and I see some strange logins from China (server is EU, I am in EU). I was wondering if these could be login ...