Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (1)

2
votes
5answers
2k views

Finding out who hacked my site [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY All Joomla! sites hosted on a single server of mine were hacked and had the following code injected into the index.php files ...
1
vote
3answers
229 views

What can be causing the following hack?

Server information: Windows XP Service Pack 2 Microsoft-IIS/6.0 Generally speaking the server is out of my countrol (for the time being.) I can request patches that are missing but ...
3
votes
3answers
2k views

Amazon EC2 instance possibly Compromised

I have an EC2 instance that may have been compromised. The instance responds far too slowly as of last week and recently I've checked the httpd access_logs and they are in excess of 11Gigs, despite ...
4
votes
6answers
8k views

How did they hack my Wordpress sites

I have many wordpress sites hosted in a Bluehost shared hosting environment. Recently when I searched one of the sites in Google, it said "The site might be compromised". I got alerts from Google ...
3
votes
4answers
389 views

Web server minimum password security based on 100 attempts per second

This insightful article proposes that passwords don't need to be very secure: http://www.baekdal.com/tips/password-security-usability? There is one specific line in here that I find troubling: ...
-2
votes
3answers
356 views

Server hacked with javascript

eOHello. I just got hacked! The hacker injected code into my website files on my server. Server: Debian Lenny, Apache 2.2, PHP 5.2, MySQL 5 EDIT: Apparently my question wasn't deemed good enhough ...
5
votes
1answer
3k views

How do I decode this WordPress hack? [closed]

I found an offending string in a client's WordPress-powered website, and I just want to know what it does. ...
0
votes
2answers
439 views

How is it possible that multiple computers on a network are being maliciously redirected

Intermittently, and not at the same time, computers connected the network will redirect to Stop-online-piracy.com (may not want to go there). The domain responds with the source: <div ...
2
votes
2answers
1k views

Ubuntu Server hack

I looked at netstat and I noticed that someone besides me is connected to the server by ssh. I looked after this because my user has the only one ssh access. I found this in an ftp user .bash_history ...
2
votes
3answers
614 views

Discover LAN's IP range, netmask & gateway?

If I am plugged into a network with no DHCP and no reachable 'sample' hosts where I can peek in the configs. how do I discover/guess the network IPs range, netmask? Gateway IP address? P.S. Don't ...
0
votes
3answers
355 views

DDoS Network Protection Devices

In our office we're running a Cisco ASA 5510 firewall. Is this device enough if we want to protect against DDoS attacks? What devices (like cisco guard, etc) do you recommend and what's the user ...
2
votes
4answers
3k views

My computer is sending ICMP packets to arbitrary destinations

My computer is sending ICMP packets to arbitrary destinations. I can't understand the reason. Dump of one of the packet is : Internet Control Message Protocol Type: 3 (Destination unreachable) ...
0
votes
2answers
724 views

.htaccess htpassword protect, safe enough?

I'm blocking my site via .htaccess, htpassword. I heard from a friend that it's really a joke and it can be bypassed in a minute. Is that true? What are other methods that I can use to prevent ...
2
votes
3answers
100 views

Migrating server post server hack: what should we be scrubbing the data for before moving it over?

In preparation for migrating servers after an infiltration, we want to scrub our data and make sure it doesn't contain any malicious hacks or security holes. To give you an idea of what I mean, ...
1
vote
3answers
4k views

hosts.deny not blocking ip addresses

I have the following in my /etc/hosts.deny file # # hosts.deny This file describes the names of the hosts which are # *not* allowed to use the local INET services, as decided # by the ...
9
votes
5answers
4k views

Should I report hacking attempts?

I am running a small (Windows-based) server. When I check the logs, I see a steady flow of (unsuccesfull) password-guessing hacking attempts. Should I try to report those attempts to the owners of the ...
0
votes
3answers
1k views

Security: How to check if our server is hacked?

Our server are hosting a website, but we find our database are added some tables, so we suspect if the server was hacked ? How can I confirm this and solve it ?
0
votes
2answers
681 views

Hex \x hacking attempts on web server

I've been seeing a lot of these in my Apache 2 logs recently: Invalid URI in request ...
0
votes
2answers
197 views

Registry remotley hacked, Windows 7, need help tracking the perp

I was writing some .VBS code at the office that would allow certain file extensions to be downloaded without a warning dialog on a Windows7x32 system. The system I was writing this on is in a lab on ...
6
votes
3answers
389 views

Need help recovering a corrupt SQL database

I have a very special case that I have been working on for several days. I have a very large SQL Server 2008 database (about 2 TB) that contains 500 filegroups to support very large partitioned ...
2
votes
1answer
175 views

What are some topics you'd like to see covered in an 'Introduction to Network Security' book? [closed]

I'm trying to put together a list of topics in Network Security and prioritize them accordingly. A little background on the book - we are trying to gear the text towards college students, as an ...
11
votes
7answers
2k views

Hacking prevention, forensics, auditing and counter measures

Recently (but it is also a recurrent question) we saw 3 interesting threads about hacking and security: My server's been hacked EMERGENCY. Finding how a hacked server was hacked File ...
349
votes
13answers
63k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
3
votes
4answers
681 views

Strange stuff in apache log

I'm building some kind of webapp, and currently the whole thing runs on my machine. I was combing down my logs, and found several "strange" log entries that made me a bit paranoid. Here goes: ...
6
votes
2answers
681 views

Finding Webserver Vulnerability

We operate a webserver farm hosting around 300 websites. Yesterday morning a script placed .htaccess files owned by www-data (the apache user) in every directory under the document_root of most (but ...
0
votes
2answers
338 views

How to recover deleted gmail emails? [closed]

Is there a program to recover emails that I deleted in my gmail account? I've already checked the "trash" and they are gone.Please help me.
3
votes
1answer
108 views

iptables: 0.0.38.69 ACCEPT?

Just looking at the firewall rules on a Debian Lenny box with "iptables -L". One entry is scaring me: ACCEPT all -- 0.0.38.69 anywhere ACCEPT all -- anywhere ...
0
votes
1answer
4k views

XerXes for real?? If so.. does anyone know how it works? [closed]

A hacker under the alias Th3j35t3r claims he created an application named XerXes which enables to perform DDoS attacks without using botnets, zombie pc's and with no collateral damage to intermediary ...
17
votes
10answers
1k views

How to Slow Down a Hacker

Some script kiddie in Delhi, India has been trying to hack our site since last night. He wrote a browser script that makes requests of our server in massive nested loops, trying everything under the ...
10
votes
2answers
5k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory ...
0
votes
1answer
442 views

ld library problem

I am getting the below error while checking status of any service or stoping starting any server on my linux server. Its CentOS-5.4 server. sh: /usr/bin/(swapd): /lib/ld-linux.so.1: bad ELF ...
6
votes
6answers
2k views

Attempted hack on VPS, how to protect in future, what were they trying to do? [duplicate]

UPDATE: They're still here. Help me stop or trap them! Hi SF'ers, I've just had someone hack one of my clients sites. They managed to get to change a file so that the checkout page on the site ...
5
votes
3answers
928 views

Weird set of shell commands in root's .bash_history

I have probably just detected that a user on a server of mine has rooted my server, but that's not what I'm asking. Has anyone ever seen command like these: echo _EoT_0.249348813417008_; id; echo ...
3
votes
1answer
3k views

My website is being pestered by “cross_site_scripting.nasl”. What's that about?

My website is throwing up large batches of "Broken link" messages. I assume I'm being probed for a specific vulnerability. I want to know what the perp is looking for, how they hope it will work, ...
1
vote
4answers
588 views

How to exploit data being written to file

I am trying to show that taking data as an input and writing directly to a file without parsing, checking or sanitizing it is a security risk. Can anyone show an example of how this can be exploited. ...
0
votes
1answer
537 views

AWS sent me abuse report - apparently one of my servers was hacked - whats next?

I got an abuse report from AWS with the following information: * Log Extract: <<< suspicious looking connections on the Undernet IRC Chat Network connecting from a netblock you control ( ...
1
vote
2answers
273 views

Server getting scanned by certain IP addresses

I noticed lines like these in my apache log [Fri Oct 15 21:09:43 2010] [error] [client 216.205.76.228] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): ...
1
vote
2answers
441 views

Group Policy or reg hack to hide startup dialogs in XP

I have a system that I'd like to try and hide some dialogs on at startup. I've gotten rid of login, and welcome screen and all kinds of stuff, but there are still a couple of pesky dialogs I can't ...
0
votes
1answer
683 views

rootkit exploit on centos server

I have recenrly found a file in my folder called wunderbar_emporium its details is here What is that , how it came here and what should i check to make sure what arong has been done to system
1
vote
2answers
1k views

server hacked. need help finding how

one of our CentOS boxes that runs PHP/Apache was recently hacked. Luckily we were going to retire this server soon and have backups etc. However, I need some help in finding how the hackers were able ...
0
votes
2answers
189 views

mysql hacked on php linux

i have a website and mysql entries in tables of the database were deleted or changed values. i found the hacker pretty quickly but he only did minor changes. i have some forms on the site. is it ...
2
votes
5answers
2k views

.htaccess being hacked repeatedly [duplicate]

About 4 or 5 days ago, a client came back to me saying that their site was being redirected to some other suspicious looking website from Google, Yahoo, etc., but it was working fine when the user ...
2
votes
3answers
2k views

Security from C99shell.I

I had found a unauthorized file on my server, After downloading it to my computer, my antivirus recognized it as a virus Backdoor:PHP/C99shell.I Can anybody please guide me how to track the hack and ...
1
vote
3answers
2k views

Reported Attack Page : how to resolve this problem

My site bccfalna.com is working normal before 2 days but now its not open in firefox/chrome and other browser and come below error message Reported Attack Page! This web page at www.bccfalna.com has ...
6
votes
6answers
553 views

Database is hacked over and over again; already cleaned the site for SQL injection

I have a client who's asked me to try and analyze a site for vulnerability. What's happening is, every weekend or so, on field of one record of one table in the database gets changed to the same ...
-1
votes
1answer
219 views

unlock the usb port of Dell Laptop(WindowXP) [closed]

I am using a laptop, Dell630, Window XP. As my company policy, the computer is running a daemon program to lock the USB port. the USB device can only be read, can not be write. So I want to make it ...
0
votes
1answer
71 views

Configure Apache2 to only respond to virtual hosts

Have a server that, while reviewing the logs, appears to get hit many many many times a day via the direct ip address by automated scripts looking for vulnerabilities. Entries like: [Sat Jul 31 ...
3
votes
1answer
2k views

Hacked by Black Jaguar

My Website has been Hacked by Black Jaguar... Help?
12
votes
8answers
2k views

is this a hack attempt?

Looking through my 404 logs I noticed the following two URLs, both of which occurred once: /library.php=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ and ...
2
votes
2answers
721 views

How does Blackberry “blackjacking” work from a technical or developers perspective?

Blackjacking is a technique used to connect internally to a corporate network using a typical BES device. It was announced at DefCon a few years back and is hardly new. How does this work, and what ...