Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (4)

5
votes
2answers
656 views

Finding Webserver Vulnerability

We operate a webserver farm hosting around 300 websites. Yesterday morning a script placed .htaccess files owned by www-data (the apache user) in every directory under the document_root of most (but ...
0
votes
2answers
330 views

How to recover deleted gmail emails? [closed]

Is there a program to recover emails that I deleted in my gmail account? I've already checked the "trash" and they are gone.Please help me.
3
votes
1answer
108 views

iptables: 0.0.38.69 ACCEPT?

Just looking at the firewall rules on a Debian Lenny box with "iptables -L". One entry is scaring me: ACCEPT all -- 0.0.38.69 anywhere ACCEPT all -- anywhere ...
0
votes
1answer
4k views

XerXes for real?? If so.. does anyone know how it works? [closed]

A hacker under the alias Th3j35t3r claims he created an application named XerXes which enables to perform DDoS attacks without using botnets, zombie pc's and with no collateral damage to intermediary ...
16
votes
10answers
1k views

How to Slow Down a Hacker

Some script kiddie in Delhi, India has been trying to hack our site since last night. He wrote a browser script that makes requests of our server in massive nested loops, trying everything under the ...
9
votes
2answers
4k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory ...
0
votes
1answer
386 views

ld library problem

I am getting the below error while checking status of any service or stoping starting any server on my linux server. Its CentOS-5.4 server. sh: /usr/bin/(swapd): /lib/ld-linux.so.1: bad ELF ...
6
votes
6answers
2k views

Attempted hack on VPS, how to protect in future, what were they trying to do? [duplicate]

UPDATE: They're still here. Help me stop or trap them! Hi SF'ers, I've just had someone hack one of my clients sites. They managed to get to change a file so that the checkout page on the site ...
5
votes
3answers
898 views

Weird set of shell commands in root's .bash_history

I have probably just detected that a user on a server of mine has rooted my server, but that's not what I'm asking. Has anyone ever seen command like these: echo _EoT_0.249348813417008_; id; echo ...
3
votes
1answer
2k views

My website is being pestered by “cross_site_scripting.nasl”. What's that about?

My website is throwing up large batches of "Broken link" messages. I assume I'm being probed for a specific vulnerability. I want to know what the perp is looking for, how they hope it will work, ...
1
vote
4answers
457 views

How to exploit data being written to file

I am trying to show that taking data as an input and writing directly to a file without parsing, checking or sanitizing it is a security risk. Can anyone show an example of how this can be exploited. ...
0
votes
1answer
55 views

High processorusage (Plesk)

I have a question concerning the average load displayed in Plesk Controlpanel. This used to be around 0.30 till 0.50 average, but since yesterday it now is around 4.30! Is there a way to see how ...
0
votes
1answer
349 views

AWS sent me abuse report - apparently one of my servers was hacked - whats next?

I got an abuse report from AWS with the following information: * Log Extract: <<< suspicious looking connections on the Undernet IRC Chat Network connecting from a netblock you control ( ...
1
vote
2answers
269 views

Server getting scanned by certain IP addresses

I noticed lines like these in my apache log [Fri Oct 15 21:09:43 2010] [error] [client 216.205.76.228] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): ...
1
vote
2answers
427 views

Group Policy or reg hack to hide startup dialogs in XP

I have a system that I'd like to try and hide some dialogs on at startup. I've gotten rid of login, and welcome screen and all kinds of stuff, but there are still a couple of pesky dialogs I can't ...
0
votes
1answer
653 views

rootkit exploit on centos server

I have recenrly found a file in my folder called wunderbar_emporium its details is here What is that , how it came here and what should i check to make sure what arong has been done to system
1
vote
2answers
1k views

server hacked. need help finding how

one of our CentOS boxes that runs PHP/Apache was recently hacked. Luckily we were going to retire this server soon and have backups etc. However, I need some help in finding how the hackers were able ...
0
votes
2answers
183 views

mysql hacked on php linux

i have a website and mysql entries in tables of the database were deleted or changed values. i found the hacker pretty quickly but he only did minor changes. i have some forms on the site. is it ...
2
votes
5answers
2k views

.htaccess being hacked repeatedly [duplicate]

About 4 or 5 days ago, a client came back to me saying that their site was being redirected to some other suspicious looking website from Google, Yahoo, etc., but it was working fine when the user ...
2
votes
3answers
1k views

Security from C99shell.I

I had found a unauthorized file on my server, After downloading it to my computer, my antivirus recognized it as a virus Backdoor:PHP/C99shell.I Can anybody please guide me how to track the hack and ...
1
vote
3answers
2k views

Reported Attack Page : how to resolve this problem

My site bccfalna.com is working normal before 2 days but now its not open in firefox/chrome and other browser and come below error message Reported Attack Page! This web page at www.bccfalna.com has ...
6
votes
6answers
542 views

Database is hacked over and over again; already cleaned the site for SQL injection

I have a client who's asked me to try and analyze a site for vulnerability. What's happening is, every weekend or so, on field of one record of one table in the database gets changed to the same ...
-1
votes
1answer
217 views

unlock the usb port of Dell Laptop(WindowXP) [closed]

I am using a laptop, Dell630, Window XP. As my company policy, the computer is running a daemon program to lock the USB port. the USB device can only be read, can not be write. So I want to make it ...
0
votes
1answer
70 views

Configure Apache2 to only respond to virtual hosts

Have a server that, while reviewing the logs, appears to get hit many many many times a day via the direct ip address by automated scripts looking for vulnerabilities. Entries like: [Sat Jul 31 ...
3
votes
1answer
2k views

Hacked by Black Jaguar

My Website has been Hacked by Black Jaguar... Help?
12
votes
8answers
1k views

is this a hack attempt?

Looking through my 404 logs I noticed the following two URLs, both of which occurred once: /library.php=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ and ...
2
votes
2answers
467 views

How does Blackberry “blackjacking” work from a technical or developers perspective?

Blackjacking is a technique used to connect internally to a corporate network using a typical BES device. It was announced at DefCon a few years back and is hardly new. How does this work, and what ...
0
votes
6answers
117 views

Which are services or programs do I need to watch from linux security point of view

I was just watching the log files for my web server and saw a few log entries for SSHD. I can see that someone is continuously trying to connect via ssh with wrong username and password. i just saw ...
1
vote
4answers
195 views

Site hacked - any ideas of what to do, where to look?

A site I host was recently hacked. The index page had the following code added to the bottom (just above the closing body tag): <script language="javascript">document.write('<div ...
1
vote
5answers
20k views

PHP eval(gzinflate(base64_decode(..))) hack - how to prevent it from occurring again?

We recently had a website hacked, where some PHP code was injected into the index.php file that looked something like: eval (gzinflate(base64_decode('s127ezsS/...bA236UA1'))); The code was causing ...
-3
votes
1answer
114 views

host .net 3.5 webservice on dynamic ips / domains [closed]

hey guys i have written a small webservice which allows users of a company (lets call it xyz) to login to xyz's website remotely via my iphone app (without ever going on xyz's official website to ...
0
votes
6answers
2k views

how to check for sniffers in Ubuntu?

Somebody is accusing me that my linux ubuntu machine could be the source for a server attack. Their technique was replacing the original ssh by this patched ssh and, as such eliminated all ...
7
votes
4answers
283 views

Could/Should you be held liable for server vulnerabilities? [closed]

Is there precedent in North America or elsewhere where a server administrator was held accountable for leaving a server vulnerable? For example, if there is a known exploit in IIS - Microsoft issue ...
0
votes
2answers
240 views

security and hacking of mysql-servers

i'm very very new in questions such hacking, security, servers. Where i can read some documentation about security, and hacking of php(mysql) servers. Maybe you will give some links, where can learn ...
0
votes
1answer
192 views

hiden iframe unescape

started helping a company with a web site a few days ago... i notices some strange code in some html and php files on the server: ...
3
votes
2answers
378 views

Owner and permissions on a hacked file versus on a “legal” file

This relates to a hacking incident we had to deal with. The hackers inserted a php file into our system. The directory in question does receive uploads (images) from our cmsadmin. However, all files ...
1
vote
1answer
290 views

Watch files to help alert on being hacked

I want to help guard against getting hacked (again). One thing I want to do is watch the files that have been hacked in the past (twice in fact, always the same files modified) so i can be alerted if ...
4
votes
6answers
577 views

Why is my port 25 so active?

Using netstat -na I notice that I have a lot of connections like tcp 0 0 XXX.XXX.XXX.XXX:25 YYY.YYY.YYY.YYY:13933 ESTABLISHED tcp 0 0 XXX.XXX.XXX.XXX:25 ...
0
votes
1answer
119 views

How can I recognize flooding? [closed]

how can I discover if my server is performing some illegal actions, like flooding?
4
votes
4answers
3k views

Site Hacked Using ?cmd=ls

A Joomla site I'm running was hacked the other day. The hacker dropped some files into the tmp directory and was running an HTTP Daemon there somehow (at least that's what my host told me). At any ...
1
vote
3answers
1k views

FTP server under hacking attempts

FileZilla log is showing regular attempts to login with dictionary keywords, and the attacker's IP remains the same for the last 3 days. What can I do about it apart from deny this IP address?
1
vote
3answers
224 views

how to protect our server from hacker

our website server was frequently gotten hacked recently.how can i protect it
1
vote
5answers
3k views

How can I report a hacker to the local authorities?

How can I report a hacker to the local authorities? I'm in the USA and someone from Norway hacked into my site and changed a lot of data on my site and my database. I'd like to report him if for ...
2
votes
5answers
907 views

How can I learn Linux from hacking or security point of view [closed]

I was interested in entering the security Field and then I studied various posts about that. Someone told that I had to first know the unix system inside out form security perspective and then I can ...
6
votes
7answers
497 views

Server was hacked. Now login wont accept 'root' as username comes up invalid

On Fedora, root is coming up invalid. WHat is solution?
1
vote
1answer
1k views

I've been hacked, and now I'm a bit confused about some things

I noticed yesterday that my site has been hacked, and I'm really confused about some things at this point. All of the files - as far as I can tell - that were edited or added were done so with a ...
0
votes
4answers
667 views

Ubuntu Web server compromised; find out what is spawning processes

The Ubuntu Web server that I just inherited has been compromised. I'm a Windows admin and not all too familiar with Linux. How would I go about finding out what keeps spawning perl processes? I ...
2
votes
4answers
822 views

Server FTP attack from multiple IP addresses spanning 5 countries - how can this be?

I recently had an FTP attack where 3 files were copied into public HTML directory of my domain. (It looks like the FTP password was compromised, but I'm still investigating this.) The strange thing is ...
3
votes
4answers
387 views

Has my site been attacked?

This is about an online store based on Drupal 5. All of a sudden it didn't work anymore. Upon accessing the site, this error came up: Parse error: syntax error, unexpected '<' in ...
0
votes
3answers
2k views

Packet sniffing a webserver

I have a homework in which I should explain how I would break into a server, retrieve a file and cover my tracks. My main question: is it possible to packet sniff a remote web server? Other ...