Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (1)

4
votes
1answer
2k views

code injection, some sort of hack?

something seems to have either hacked a webserver, or we have some sort of semi-malicious code running that keeps injecting code into our website. it seems to affect just a couple of coldfusion and ...
0
votes
1answer
88 views

My site was hacked, but just for bots [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Help! My site has been hacked. The pages served to regular users are ok, but the pages served to bots (like google and facebook) ...
-1
votes
3answers
193 views

How can a website recover from code injection especially the domain name?

My website was recently hacked that apparently it came under code injection vulnerability not SQL injection. At least that's what Google is telling me and even gave me a possible iframe codes. That ...
-3
votes
1answer
207 views

Got hacked, cannot understand how [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY In log i found that site was scanned by hacker for few hours but actual hack was few minutes i think. He somehow found out about ...
0
votes
1answer
1k views

Anti-Malware Antivirus for Linux Web Server? [closed]

Does anyone have experience running anti-virus software on a Linux web server, especially CentOS, and what do you recommend? I'm interested in putting it on a web server we have as one more method ...
8
votes
3answers
1k views

Unsecured MySQL 'root'@'localhost' account accessed remotely?

A little background: We've just had our PBX system hacked. The server itself seems secure (no logged unauthorised console access - SSH etc), but somehow the hackers have managed to inject a new admin ...
0
votes
3answers
194 views

Server not responding, after reset, all data rolled few months back

A Debian Server stopped responding earlier today. After hardware reset, the data on server was rolled back several months ago to the state it was in february. How is this possible?Everything, logs, ...
0
votes
1answer
263 views

Website visitors are still being redirected after “fixing” the damage from a conditional redirect website attack

BACKGROUND A website of mine was recently the target of a conditional redirect attack. PHP code was added to my pages to redirect visitors. The .htaccess file was edited to redirect visitors. ...
-2
votes
1answer
860 views

Has my server been hacked? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I have some problem with my server (running on Centos 5). While checking traffic, I run "$lsof | grep ezbuyinfo" and it show too ...
4
votes
4answers
3k views

Is this server hacked or just login attempts ? See log

Can someone tell what does this mean? I tried a command like lastb to see last user logins and I see some strange logins from China (server is EU, I am in EU). I was wondering if these could be login ...
-1
votes
1answer
431 views

.htaccess attack redirect all the sites in the server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My site is hacked and I've asked yesterday about this issue. I've changed the FTP password, the server password. I also have ...
-1
votes
2answers
235 views

My Wordpress site being hack by modifying the .htaccess [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm going crazy right now and I don't know what to do. I've did a Google search about those hackers where they using .htaccess to ...
1
vote
1answer
567 views

Plesk Qmail Queue Exploding From Possible Webform Attack

The qmail queue on my server (running Plesk on CentOS 5.2) balloons up to 120,000+ messages in the queue overnight. The messages in the queue are obviously spam. I've cleared them out over the last ...
5
votes
3answers
2k views

Could this server log mean my server is being used as a proxy?

I came across the following entry in my access.log: 58.218.199.147 - - [05/Jun/2012:12:56:04 +1000] "GET http://proxyproxys.com/ HTTP/1.1" 200 183 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT ...
-4
votes
1answer
263 views

windows Server is hacked by SOG how any one please help me? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY my server is Win2K8 Web SRV , IIS-7, it is a web hosting server & my sites was hacked by someone it is hacked by SOG say's ...
-3
votes
1answer
142 views

How do I go about getting my system hacked? [closed]

I have a project that will eventually be posted as a public service online. Security is a big concern, and I don't have a lot of experience hardening systems and code for public scrutiny. Is there ...
0
votes
3answers
2k views

apache2 server logs - weird activity?

I was going through apache log, and I thought some of the access logs seemed suspicious... I'm not pro, just do server administration as hobby :) so I wonder if I should take some steps... ...
2
votes
1answer
133 views

Potential Bot-Net organizers probing for new machines?

I'm getting a number of exploit attempts from different IP's today. GET ...
0
votes
1answer
75 views

Periodic DNS Fault

I have a reseller account. but sometimes, somthings goes wrong on my websites. I think server is hacked or DNS server is hacked. I searched similar content on google, then I found same HTML codes on ...
0
votes
1answer
1k views

Logwatch httpd - hacks and probes

Sometimes in my daily logwatch report, I notice that there is a section under httpd for "attempts to use known hacks..." and another section about how many sites probed the server. I have a few ...
1
vote
2answers
230 views

Is there a way to log who upload or change a spesific file? (centos) [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY There is a file that keeps infected with this code. I can't figure out why. So I want to log who upload or change the file. Is there a ...
5
votes
1answer
830 views

How does Windows hide internal users?

I just recognized that Windows hides some special users, like for example the NT Authority\SYSTEM user or the users which are added after the installation of SQL Server (ReportServer$SQLEXPRESS, ...
0
votes
1answer
249 views

Apache server under attack

I have a CentOS 5.8 server with Apache 2.2.3 with 20 websites on it. The last weeks the server was several times inaccessible (too many database connections and lots of CPU usage). I had to restart ...
-1
votes
2answers
191 views

How to prevent Brute-Fource server attack on Linux base server?

Lately my server goes down many times and I have to reboot it in order to start up again. I use CentOS for my web server and notice an email send from my server log that Brute-Force Attack detected ...
1
vote
2answers
2k views

Websites get hijacked by parking page

Since a couple of weeks the websites on my hosting get hijacked by a webhosting parking page when requesting them. Sometimes it shows my actual website, but a couple of minutes after requesting it, ...
3
votes
1answer
2k views

Linux Server hacked? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm trying to determine if this linex webserver/openfire server has been compromised by some form of malware or a hacker. Can you ...
1
vote
1answer
214 views

Apache error_log showing which command output

Apache's error_log shows lines like the following: --- snip --- which: no ruby in (/sbin:/usr/sbin:/bin:/usr/bin) which: no locate in (/sbin:/usr/sbin:/bin:/usr/bin) which: no suidperl in ...
3
votes
2answers
590 views

Apache server redirecting requests from Google, compromised?

I found something very suspicious. When connecting to www.pulseexpress.com following a Google link, the server redirects you to some very dubious site that sends you a .exe file right away: # host ...
1
vote
1answer
304 views

Hacker exploiting Wordpress install

I'm running WordPress on IIS7 on one of my servers. For some reason, a hacker is able to change the read/write permissions on all of the files, and then inject a script tag into the top line of the ...
1
vote
1answer
507 views

Server Hacked + Huge Bandwidth Usage Spike [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I run a couple of sites on Ubuntu via Rackspace Cloud Server. My site typically uses about 3 GB of outbound bandwidth a day. Today, ...
0
votes
4answers
801 views

The more secure iptables script imaginable. Does one exist? [closed]

I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and ...
0
votes
2answers
1k views

Auth log error : Is it a Hack?

I was just going through auth.log file, I found the following error. Can anybody tell is it a hack or just log of Bugzilla which I installed & throughing an error. Mar 12 06:50:10 bigbugz02 ...
1
vote
5answers
727 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
0
votes
1answer
657 views

Hacked server with IPmech installed in /var/tmp/.aw running cronjob every minute, how do I determine how I was hacked

One of my user accounts on an Ubuntu 10.04.3 server was hacked, and I'm not sure how. The password was strong. A cronjob was installed in my user's crontab running and executable in /var/tmp/.aw The ...
1
vote
1answer
885 views

Backdoor and zmeu process on a Linux system [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY First some background info. The server we're talking about is running CentOS 5.6, SSH on port 22 which can be accessed over the ...
0
votes
1answer
1k views

It looks like somebody is using my Mac OS X server to brute force attack another server which is LDAP. What can I do to stop it?

An LDAP server on another is reporting an unusually large number of attempts to read the LDAP directory and attempting a number of users, all of which look like hacking attempts to read user/password ...
2
votes
1answer
1k views

How can I trick SBS 2011 into allowing me to assign a UPN alias so users can logon as user@domain.com

How can I trick SBS 2011 into allowing me to assign a UPN alias so users can logon as user@domain.com See http://support.microsoft.com/kb/243629/en-us But on SBS I only have a 'General', 'Trusts', ...
3
votes
4answers
697 views

best way to find vulnerabilities on a server hosting a large number of sites?

I've inherited a web server that's been compromised. Trying to figure out why apache was hanging and the causes of high server load, I found several copies of perlbot 4.5 in /tmp. I'm now trying to ...
11
votes
1answer
1k views

ubuntu 10.10 sshd contains “YOU WANNA SMOKE A SPLIFF” and pot leaf ascii art. Does this mean I've been hacked?

My sshd binary on an ubuntu 10.10 machine contains the following ascii artwork: ng: %.100sToo many lines in environment file %sUser %.100s not allowed because %s exists YOU WANNA . ...
0
votes
1answer
68 views

Common ways of spam files ending up in a web directory

A friend discovered a bunch of spam files in his web directory on his web host the other day. He has no idea where they came from, and I'm not quite sure either. What are common security breaches ...
-1
votes
1answer
72 views

Old ubuntu password

I know how to set new password of root in ubuntu 10.04 if I don't know root pasword and grub has no password . I want to know that whether I could get the old password which was set before I changed ...
1
vote
1answer
627 views

Malicious script changing .htaccess files on server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY There seems to be a malicious script accessing my server and editing the .htaccess files for all of my hosted sites to redirect ...
0
votes
1answer
399 views

.htaccess file being compromised

I have a website hosted with Dreamhost and the contents of my .htaccess file are being compromised over and over again. someone is putting stuff like this in the front of my code: RewriteCond ...
3
votes
3answers
745 views

Recover data from EC2 instance storage

So last week, an instance on EC2 stopped responding, I still don't know exactly why because I can no longer SSH in, I suspect the /tmp/ directory which was mounted to another drive is no longer ...
0
votes
1answer
790 views

What is “/admin/Y-ivrrecording.php?php=info&ip=uname”?

Help me please, I found an IP address from Korea try to do something with my web server by put this '/admin/Y-ivrrecording.php?php=info&ip=uname' like search a filename from my web server. I ...
1
vote
2answers
316 views

How to prevent bombardment of hack attempts on VPS

Ever since I bought a VPS, I have been receiving emails like those shown below since day one, every single day. I was wondering if is this really normal? Is there anyway I can prevent it, or is ...
0
votes
1answer
386 views

Hidden Spam Meta Descriptions

I have found out that a client's site (WordPress CMS) was somehow infected with spam / hacked and did some serious cleaning, updating and upgrading and cleaning cache. I used various tools and search ...
0
votes
2answers
125 views

Kindly help me on how to handle the hacker

I have a website. Somebody is sending thousands of 404 hits to my site. He uses random IPs. he is keep on sending at least 1000+ hits everyday to various urls which doesn't exists in my site. I have ...
-1
votes
1answer
395 views

How do I figure out how the “Pharma Hack” hackers are gaining access to my site?

One of my sites has been the continuous target of the "Pharma Hack" - but it's using Drupal instead of Wordpress or Joomla. It is version 6, but it's updated to the latest version, and so are all of ...
0
votes
2answers
1k views

VPS under DDoS Attacks [duplicate]

Possible Duplicate: Am I getting DDoSed, and what should I about it? I'm using a 2 VPS Servers. My domains was unvailable for some time. 1 hour, Somtimes 30 Minutes, and pages loading was ...