Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (4)

2
votes
3answers
100 views

Migrating server post server hack: what should we be scrubbing the data for before moving it over?

In preparation for migrating servers after an infiltration, we want to scrub our data and make sure it doesn't contain any malicious hacks or security holes. To give you an idea of what I mean, ...
1
vote
3answers
3k views

hosts.deny not blocking ip addresses

I have the following in my /etc/hosts.deny file # # hosts.deny This file describes the names of the hosts which are # *not* allowed to use the local INET services, as decided # by the ...
9
votes
5answers
4k views

Should I report hacking attempts?

I am running a small (Windows-based) server. When I check the logs, I see a steady flow of (unsuccesfull) password-guessing hacking attempts. Should I try to report those attempts to the owners of the ...
0
votes
3answers
1k views

Security: How to check if our server is hacked?

Our server are hosting a website, but we find our database are added some tables, so we suspect if the server was hacked ? How can I confirm this and solve it ?
0
votes
2answers
644 views

Hex \x hacking attempts on web server

I've been seeing a lot of these in my Apache 2 logs recently: Invalid URI in request ...
0
votes
2answers
193 views

Registry remotley hacked, Windows 7, need help tracking the perp

I was writing some .VBS code at the office that would allow certain file extensions to be downloaded without a warning dialog on a Windows7x32 system. The system I was writing this on is in a lab on ...
6
votes
3answers
381 views

Need help recovering a corrupt SQL database

I have a very special case that I have been working on for several days. I have a very large SQL Server 2008 database (about 2 TB) that contains 500 filegroups to support very large partitioned ...
2
votes
3answers
158 views

What are some topics you'd like to see covered in an 'Introduction to Network Security' book?

I'm trying to put together a list of topics in Network Security and prioritize them accordingly. A little background on the book - we are trying to gear the text towards college students, as an ...
11
votes
7answers
2k views

Hacking prevention, forensics, auditing and counter measures

Recently (but it is also a recurrent question) we saw 3 interesting threads about hacking and security: My server's been hacked EMERGENCY. Finding how a hacked server was hacked File ...
329
votes
13answers
58k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
3
votes
4answers
600 views

Strange stuff in apache log

I'm building some kind of webapp, and currently the whole thing runs on my machine. I was combing down my logs, and found several "strange" log entries that made me a bit paranoid. Here goes: ...
5
votes
2answers
668 views

Finding Webserver Vulnerability

We operate a webserver farm hosting around 300 websites. Yesterday morning a script placed .htaccess files owned by www-data (the apache user) in every directory under the document_root of most (but ...
0
votes
2answers
336 views

How to recover deleted gmail emails? [closed]

Is there a program to recover emails that I deleted in my gmail account? I've already checked the "trash" and they are gone.Please help me.
3
votes
1answer
108 views

iptables: 0.0.38.69 ACCEPT?

Just looking at the firewall rules on a Debian Lenny box with "iptables -L". One entry is scaring me: ACCEPT all -- 0.0.38.69 anywhere ACCEPT all -- anywhere ...
0
votes
1answer
4k views

XerXes for real?? If so.. does anyone know how it works? [closed]

A hacker under the alias Th3j35t3r claims he created an application named XerXes which enables to perform DDoS attacks without using botnets, zombie pc's and with no collateral damage to intermediary ...
17
votes
10answers
1k views

How to Slow Down a Hacker

Some script kiddie in Delhi, India has been trying to hack our site since last night. He wrote a browser script that makes requests of our server in massive nested loops, trying everything under the ...
10
votes
2answers
5k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory ...
0
votes
1answer
420 views

ld library problem

I am getting the below error while checking status of any service or stoping starting any server on my linux server. Its CentOS-5.4 server. sh: /usr/bin/(swapd): /lib/ld-linux.so.1: bad ELF ...
6
votes
6answers
2k views

Attempted hack on VPS, how to protect in future, what were they trying to do? [duplicate]

UPDATE: They're still here. Help me stop or trap them! Hi SF'ers, I've just had someone hack one of my clients sites. They managed to get to change a file so that the checkout page on the site ...
5
votes
3answers
919 views

Weird set of shell commands in root's .bash_history

I have probably just detected that a user on a server of mine has rooted my server, but that's not what I'm asking. Has anyone ever seen command like these: echo _EoT_0.249348813417008_; id; echo ...
3
votes
1answer
2k views

My website is being pestered by “cross_site_scripting.nasl”. What's that about?

My website is throwing up large batches of "Broken link" messages. I assume I'm being probed for a specific vulnerability. I want to know what the perp is looking for, how they hope it will work, ...
1
vote
4answers
518 views

How to exploit data being written to file

I am trying to show that taking data as an input and writing directly to a file without parsing, checking or sanitizing it is a security risk. Can anyone show an example of how this can be exploited. ...
0
votes
1answer
57 views

High processorusage (Plesk)

I have a question concerning the average load displayed in Plesk Controlpanel. This used to be around 0.30 till 0.50 average, but since yesterday it now is around 4.30! Is there a way to see how ...
0
votes
1answer
471 views

AWS sent me abuse report - apparently one of my servers was hacked - whats next?

I got an abuse report from AWS with the following information: * Log Extract: <<< suspicious looking connections on the Undernet IRC Chat Network connecting from a netblock you control ( ...
1
vote
2answers
270 views

Server getting scanned by certain IP addresses

I noticed lines like these in my apache log [Fri Oct 15 21:09:43 2010] [error] [client 216.205.76.228] client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): ...
1
vote
2answers
434 views

Group Policy or reg hack to hide startup dialogs in XP

I have a system that I'd like to try and hide some dialogs on at startup. I've gotten rid of login, and welcome screen and all kinds of stuff, but there are still a couple of pesky dialogs I can't ...
0
votes
1answer
674 views

rootkit exploit on centos server

I have recenrly found a file in my folder called wunderbar_emporium its details is here What is that , how it came here and what should i check to make sure what arong has been done to system
1
vote
2answers
1k views

server hacked. need help finding how

one of our CentOS boxes that runs PHP/Apache was recently hacked. Luckily we were going to retire this server soon and have backups etc. However, I need some help in finding how the hackers were able ...
0
votes
2answers
188 views

mysql hacked on php linux

i have a website and mysql entries in tables of the database were deleted or changed values. i found the hacker pretty quickly but he only did minor changes. i have some forms on the site. is it ...
2
votes
5answers
2k views

.htaccess being hacked repeatedly [duplicate]

About 4 or 5 days ago, a client came back to me saying that their site was being redirected to some other suspicious looking website from Google, Yahoo, etc., but it was working fine when the user ...
2
votes
3answers
1k views

Security from C99shell.I

I had found a unauthorized file on my server, After downloading it to my computer, my antivirus recognized it as a virus Backdoor:PHP/C99shell.I Can anybody please guide me how to track the hack and ...
1
vote
3answers
2k views

Reported Attack Page : how to resolve this problem

My site bccfalna.com is working normal before 2 days but now its not open in firefox/chrome and other browser and come below error message Reported Attack Page! This web page at www.bccfalna.com has ...
6
votes
6answers
549 views

Database is hacked over and over again; already cleaned the site for SQL injection

I have a client who's asked me to try and analyze a site for vulnerability. What's happening is, every weekend or so, on field of one record of one table in the database gets changed to the same ...
-1
votes
1answer
219 views

unlock the usb port of Dell Laptop(WindowXP) [closed]

I am using a laptop, Dell630, Window XP. As my company policy, the computer is running a daemon program to lock the USB port. the USB device can only be read, can not be write. So I want to make it ...
0
votes
1answer
71 views

Configure Apache2 to only respond to virtual hosts

Have a server that, while reviewing the logs, appears to get hit many many many times a day via the direct ip address by automated scripts looking for vulnerabilities. Entries like: [Sat Jul 31 ...
3
votes
1answer
2k views

Hacked by Black Jaguar

My Website has been Hacked by Black Jaguar... Help?
12
votes
8answers
2k views

is this a hack attempt?

Looking through my 404 logs I noticed the following two URLs, both of which occurred once: /library.php=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ and ...
2
votes
2answers
581 views

How does Blackberry “blackjacking” work from a technical or developers perspective?

Blackjacking is a technique used to connect internally to a corporate network using a typical BES device. It was announced at DefCon a few years back and is hardly new. How does this work, and what ...
0
votes
6answers
118 views

Which are services or programs do I need to watch from linux security point of view

I was just watching the log files for my web server and saw a few log entries for SSHD. I can see that someone is continuously trying to connect via ssh with wrong username and password. i just saw ...
1
vote
4answers
196 views

Site hacked - any ideas of what to do, where to look?

A site I host was recently hacked. The index page had the following code added to the bottom (just above the closing body tag): <script language="javascript">document.write('<div ...
1
vote
5answers
22k views

PHP eval(gzinflate(base64_decode(..))) hack - how to prevent it from occurring again?

We recently had a website hacked, where some PHP code was injected into the index.php file that looked something like: eval (gzinflate(base64_decode('s127ezsS/...bA236UA1'))); The code was causing ...
-3
votes
1answer
118 views

host .net 3.5 webservice on dynamic ips / domains [closed]

hey guys i have written a small webservice which allows users of a company (lets call it xyz) to login to xyz's website remotely via my iphone app (without ever going on xyz's official website to ...
0
votes
6answers
2k views

how to check for sniffers in Ubuntu?

Somebody is accusing me that my linux ubuntu machine could be the source for a server attack. Their technique was replacing the original ssh by this patched ssh and, as such eliminated all ...
7
votes
4answers
292 views

Could/Should you be held liable for server vulnerabilities? [closed]

Is there precedent in North America or elsewhere where a server administrator was held accountable for leaving a server vulnerable? For example, if there is a known exploit in IIS - Microsoft issue ...
0
votes
2answers
247 views

security and hacking of mysql-servers

i'm very very new in questions such hacking, security, servers. Where i can read some documentation about security, and hacking of php(mysql) servers. Maybe you will give some links, where can learn ...
0
votes
1answer
203 views

hiden iframe unescape

started helping a company with a web site a few days ago... i notices some strange code in some html and php files on the server: ...
3
votes
2answers
386 views

Owner and permissions on a hacked file versus on a “legal” file

This relates to a hacking incident we had to deal with. The hackers inserted a php file into our system. The directory in question does receive uploads (images) from our cmsadmin. However, all files ...
1
vote
1answer
293 views

Watch files to help alert on being hacked

I want to help guard against getting hacked (again). One thing I want to do is watch the files that have been hacked in the past (twice in fact, always the same files modified) so i can be alerted if ...
4
votes
6answers
598 views

Why is my port 25 so active?

Using netstat -na I notice that I have a lot of connections like tcp 0 0 XXX.XXX.XXX.XXX:25 YYY.YYY.YYY.YYY:13933 ESTABLISHED tcp 0 0 XXX.XXX.XXX.XXX:25 ...
0
votes
1answer
121 views

How can I recognize flooding? [closed]

how can I discover if my server is performing some illegal actions, like flooding?