Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (1)

5
votes
3answers
2k views

How do I secure my Asterisk server?

Our asterisk server was compromised. some calls were made to Asia countries last weekend. Thought we have improved our network configuration, we still want to determine how the intrusion was done, we ...
-1
votes
3answers
472 views

Entries in `/etc/inittab` below last line - possible hack? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My Linux machine has been hacked lately. There are a few entires in /etc/inittab below the #end of /etc/inittab Something ...
3
votes
5answers
3k views

How to analyse logs after the site was hacked

One of our web-projects was hacked. Malefactor changed some template files in project and 1 core file of the web-framework (it's one of the famous php-frameworks). We found all corrupted files by git ...
0
votes
1answer
590 views

Banner Grabbing DNS? [closed]

How does one banner grab DNS? I'm able to banner grab other services such as HTTP/FTP/SMTP but for DNS it's not immediately obvious. Typically for HTTP I use nc with HEAD / HTTP/1.1 {ENTER}{ENTER}. ...
2
votes
1answer
3k views

Someone try to hack my site, want to understand the log

I have a wordpress site hosted on CentOS 6. After see the following access log, I checked the server, it seems ok. Can anyone explain what does this guy trying to do? Did they get what they want? I ...
-1
votes
1answer
80 views

Is it more secure to spoof addresses using the HOSTS file?

If I have a Windows service with a config file that points to web services it needs to call, is it more secure to put a fake DNS name for the server being connected to, then update the HOSTS file to ...
2
votes
1answer
375 views

Load too high and many files including iptables missing: Is my server under attack?

My server was under heavy load around 400 and above. Here is the link of Server Fault question I was able to see the rm command and xargs running in top output, in which I was the one and only ...
1
vote
2answers
221 views

I got some message about suspended site, which I have to debug, how do I proceed? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY The hosting company supplied an email to its client and the client wanted some help from me. the message states: Any items listed ...
-2
votes
1answer
153 views

My php script hacked again and again? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I did a php script my self for a digital shop store but a hacker is hacking it again and again. He is copying some php and ...
4
votes
1answer
2k views

code injection, some sort of hack?

something seems to have either hacked a webserver, or we have some sort of semi-malicious code running that keeps injecting code into our website. it seems to affect just a couple of coldfusion and ...
0
votes
1answer
89 views

My site was hacked, but just for bots [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Help! My site has been hacked. The pages served to regular users are ok, but the pages served to bots (like google and facebook) ...
-1
votes
3answers
194 views

How can a website recover from code injection especially the domain name?

My website was recently hacked that apparently it came under code injection vulnerability not SQL injection. At least that's what Google is telling me and even gave me a possible iframe codes. That ...
-3
votes
1answer
208 views

Got hacked, cannot understand how [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY In log i found that site was scanned by hacker for few hours but actual hack was few minutes i think. He somehow found out about ...
0
votes
1answer
1k views

Anti-Malware Antivirus for Linux Web Server? [closed]

Does anyone have experience running anti-virus software on a Linux web server, especially CentOS, and what do you recommend? I'm interested in putting it on a web server we have as one more method ...
8
votes
3answers
1k views

Unsecured MySQL 'root'@'localhost' account accessed remotely?

A little background: We've just had our PBX system hacked. The server itself seems secure (no logged unauthorised console access - SSH etc), but somehow the hackers have managed to inject a new admin ...
0
votes
3answers
194 views

Server not responding, after reset, all data rolled few months back

A Debian Server stopped responding earlier today. After hardware reset, the data on server was rolled back several months ago to the state it was in february. How is this possible?Everything, logs, ...
0
votes
1answer
265 views

Website visitors are still being redirected after “fixing” the damage from a conditional redirect website attack

BACKGROUND A website of mine was recently the target of a conditional redirect attack. PHP code was added to my pages to redirect visitors. The .htaccess file was edited to redirect visitors. ...
-2
votes
1answer
911 views

Has my server been hacked? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I have some problem with my server (running on Centos 5). While checking traffic, I run "$lsof | grep ezbuyinfo" and it show too ...
6
votes
4answers
3k views

Is this server hacked or just login attempts ? See log

Can someone tell what does this mean? I tried a command like lastb to see last user logins and I see some strange logins from China (server is EU, I am in EU). I was wondering if these could be login ...
-1
votes
1answer
437 views

.htaccess attack redirect all the sites in the server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My site is hacked and I've asked yesterday about this issue. I've changed the FTP password, the server password. I also have ...
-1
votes
2answers
237 views

My Wordpress site being hack by modifying the .htaccess [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm going crazy right now and I don't know what to do. I've did a Google search about those hackers where they using .htaccess to ...
1
vote
1answer
585 views

Plesk Qmail Queue Exploding From Possible Webform Attack

The qmail queue on my server (running Plesk on CentOS 5.2) balloons up to 120,000+ messages in the queue overnight. The messages in the queue are obviously spam. I've cleared them out over the last ...
5
votes
3answers
2k views

Could this server log mean my server is being used as a proxy?

I came across the following entry in my access.log: 58.218.199.147 - - [05/Jun/2012:12:56:04 +1000] "GET http://proxyproxys.com/ HTTP/1.1" 200 183 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT ...
-4
votes
1answer
266 views

windows Server is hacked by SOG how any one please help me? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY my server is Win2K8 Web SRV , IIS-7, it is a web hosting server & my sites was hacked by someone it is hacked by SOG say's ...
-3
votes
1answer
144 views

How do I go about getting my system hacked? [closed]

I have a project that will eventually be posted as a public service online. Security is a big concern, and I don't have a lot of experience hardening systems and code for public scrutiny. Is there ...
0
votes
3answers
2k views

apache2 server logs - weird activity?

I was going through apache log, and I thought some of the access logs seemed suspicious... I'm not pro, just do server administration as hobby :) so I wonder if I should take some steps... ...
2
votes
1answer
133 views

Potential Bot-Net organizers probing for new machines?

I'm getting a number of exploit attempts from different IP's today. GET ...
0
votes
1answer
76 views

Periodic DNS Fault

I have a reseller account. but sometimes, somthings goes wrong on my websites. I think server is hacked or DNS server is hacked. I searched similar content on google, then I found same HTML codes on ...
0
votes
1answer
2k views

Logwatch httpd - hacks and probes

Sometimes in my daily logwatch report, I notice that there is a section under httpd for "attempts to use known hacks..." and another section about how many sites probed the server. I have a few ...
1
vote
2answers
243 views

Is there a way to log who upload or change a spesific file? (centos) [duplicate]

Possible Duplicate: My server’s been hacked EMERGENCY There is a file that keeps infected with this code. I can't figure out why. So I want to log who upload or change the file. Is there a ...
6
votes
1answer
846 views

How does Windows hide internal users?

I just recognized that Windows hides some special users, like for example the NT Authority\SYSTEM user or the users which are added after the installation of SQL Server (ReportServer$SQLEXPRESS, ...
0
votes
1answer
252 views

Apache server under attack

I have a CentOS 5.8 server with Apache 2.2.3 with 20 websites on it. The last weeks the server was several times inaccessible (too many database connections and lots of CPU usage). I had to restart ...
-1
votes
2answers
198 views

How to prevent Brute-Fource server attack on Linux base server?

Lately my server goes down many times and I have to reboot it in order to start up again. I use CentOS for my web server and notice an email send from my server log that Brute-Force Attack detected ...
1
vote
2answers
2k views

Websites get hijacked by parking page

Since a couple of weeks the websites on my hosting get hijacked by a webhosting parking page when requesting them. Sometimes it shows my actual website, but a couple of minutes after requesting it, ...
4
votes
1answer
2k views

Linux Server hacked? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm trying to determine if this linex webserver/openfire server has been compromised by some form of malware or a hacker. Can you ...
1
vote
1answer
224 views

Apache error_log showing which command output

Apache's error_log shows lines like the following: --- snip --- which: no ruby in (/sbin:/usr/sbin:/bin:/usr/bin) which: no locate in (/sbin:/usr/sbin:/bin:/usr/bin) which: no suidperl in ...
3
votes
2answers
598 views

Apache server redirecting requests from Google, compromised?

I found something very suspicious. When connecting to www.pulseexpress.com following a Google link, the server redirects you to some very dubious site that sends you a .exe file right away: # host ...
1
vote
1answer
313 views

Hacker exploiting Wordpress install

I'm running WordPress on IIS7 on one of my servers. For some reason, a hacker is able to change the read/write permissions on all of the files, and then inject a script tag into the top line of the ...
1
vote
1answer
540 views

Server Hacked + Huge Bandwidth Usage Spike [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I run a couple of sites on Ubuntu via Rackspace Cloud Server. My site typically uses about 3 GB of outbound bandwidth a day. Today, ...
0
votes
4answers
845 views

The more secure iptables script imaginable. Does one exist? [closed]

I plan on buying a server soon. I'd like the server to be as secure as possible, only having POP3, SMTP, SSH and HTTP open. I know how to write an iptables script to only allow those connections and ...
0
votes
2answers
1k views

Auth log error : Is it a Hack?

I was just going through auth.log file, I found the following error. Can anybody tell is it a hack or just log of Bugzilla which I installed & throughing an error. Mar 12 06:50:10 bigbugz02 ...
1
vote
5answers
756 views

Identifying DOS attack [duplicate]

I'm suspecting that one of my servers is attacked some time ago. My question is how can I identify a DOS or DDOS attack while under attack or after the attack has finished?
0
votes
1answer
691 views

Hacked server with IPmech installed in /var/tmp/.aw running cronjob every minute, how do I determine how I was hacked

One of my user accounts on an Ubuntu 10.04.3 server was hacked, and I'm not sure how. The password was strong. A cronjob was installed in my user's crontab running and executable in /var/tmp/.aw The ...
1
vote
1answer
904 views

Backdoor and zmeu process on a Linux system [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY First some background info. The server we're talking about is running CentOS 5.6, SSH on port 22 which can be accessed over the ...
0
votes
1answer
1k views

It looks like somebody is using my Mac OS X server to brute force attack another server which is LDAP. What can I do to stop it?

An LDAP server on another is reporting an unusually large number of attempts to read the LDAP directory and attempting a number of users, all of which look like hacking attempts to read user/password ...
2
votes
1answer
1k views

How can I trick SBS 2011 into allowing me to assign a UPN alias so users can logon as user@domain.com

How can I trick SBS 2011 into allowing me to assign a UPN alias so users can logon as user@domain.com See http://support.microsoft.com/kb/243629/en-us But on SBS I only have a 'General', 'Trusts', ...
3
votes
4answers
697 views

best way to find vulnerabilities on a server hosting a large number of sites?

I've inherited a web server that's been compromised. Trying to figure out why apache was hanging and the causes of high server load, I found several copies of perlbot 4.5 in /tmp. I'm now trying to ...
12
votes
1answer
2k views

ubuntu 10.10 sshd contains “YOU WANNA SMOKE A SPLIFF” and pot leaf ascii art. Does this mean I've been hacked?

My sshd binary on an ubuntu 10.10 machine contains the following ascii artwork: ng: %.100sToo many lines in environment file %sUser %.100s not allowed because %s exists YOU WANNA . ...
0
votes
1answer
68 views

Common ways of spam files ending up in a web directory

A friend discovered a bunch of spam files in his web directory on his web host the other day. He has no idea where they came from, and I'm not quite sure either. What are common security breaches ...
-1
votes
1answer
72 views

Old ubuntu password

I know how to set new password of root in ubuntu 10.04 if I don't know root pasword and grub has no password . I want to know that whether I could get the old password which was set before I changed ...