Questions tagged [hacking]
Hacking is the violation of server or network security via exploitation of weaknesses in that security.
482
questions
0
votes
1
answer
607
views
Server Abuse/Proxy Abuse -- Automated Tunneling (Unique IP's = Hundreds, Thousands of Requests)
I run a simple Proxy/General-Use website me and a few friends use at kerenua.xyz, however, starting 3~ weeks ago, an enormous amount of traffic started flooding in from hundreds of (unique) IP ...
0
votes
2
answers
2k
views
Stopping SSH brute force from China - fail2ban not working
I see things like this in my /var/log/auth.log
sshd[2173]: Unable to negotiate with 218.92.0.205 port 21029: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth]
sshd[1964]: ...
- 113
0
votes
2
answers
3k
views
local mysql was hacked with ransomware hack. How to check if database data was downloaded?
I had a test mysql database running on Vagrant dev box. Turns out the network wasn't that secure.
All of the databases were deleted (and replaced with a DB ransomware note) and in the logs I can see ...
0
votes
1
answer
418
views
Post request with host = "><script>alert('qualys_xss_joomla_2.5.3')</script>
On my web server
Yesterday I have caught a POST request with following text for a host
"><script>alert('qualys_xss_joomla_2.5.3')</script>
in full it was like this
headers
{
...
...
0
votes
1
answer
2k
views
How can a hacker compromising the www-data user account install a rootkit?
Recently a site of mine was hacked. For sure the attacker can execute PHP and start an interactive shell, etc.
I understand a hacker can delete files, or delete DB, the site folder, write in the cron ...
- 159
0
votes
1
answer
1k
views
Understanding nginx log statement [closed]
I need some help in understanding following log statement found in /var/log/nginx/error log file.
2016/07/28 14:06:05 [error] 7255#7255: *712 open() "/usr/share/www/proj/check_proxy" failed (2: No ...
- 127
0
votes
1
answer
266
views
Php script - Have I been hacked [closed]
Here is the PHP script I have found at the root of each of my website folder.
Script name is fcb.php
Content is :
<? $GLOBALS['_1303753477_']=Array(base64_decode('YX' .'JyYXlfZGlmZl91a2V5'),...
0
votes
1
answer
791
views
AWS account hacked! Amazon isn't helping. What can I do?
Recently, someone hacked my AWS account by getting into the email account used for AWS and requesting a password change. Afterwards, they obviously changed the password of the email address. Amazon ...
- 107
0
votes
1
answer
345
views
Diagnosing heavy bandwidth usage
I run a couple of IIS web servers, one on win server 2008 R2, the other on 2003. Both fully patched and up to date, with AV.
Running on a No NAT connection with 8 WAN IP's
The 2003 machine seems to ...
0
votes
1
answer
2k
views
Attacks to my server? [closed]
I've a VPS running a website. I've a logwatch set in the server, and I've received several alerts like:
A total of 2 sites probed the server
31.4.180.163
88.1.154.211
Requests ...
- 103
0
votes
1
answer
4k
views
Do cPHulk Brute Force Protection Settings Effect Hosts? [closed]
Question:
Do my settings (shown below) prevent visitors from getting to any of the public web sites on my server if their ISP's IP Address has been blocked/black-listed through cPHulk Brute Force ...
- 543
0
votes
2
answers
105
views
Looking for a shell command to read non-binary part of most common image types
A website I'm hosting on my dedicated server has been hacked.
Some pictures have been infected with things like <?php eval(base64_decode(....));?>.
I'm looking for a generic shell command which ...
- 1,062
0
votes
1
answer
243
views
DB Detection: MySQL >=5 (Auto Detected) Method: GET Type: Integer (Auto Detected)
Could someone please tell me which penetration-testing tool leaves behind a page that looks like this?
DB Detection: MySQL >=5 (Auto Detected)
Method: GET
Type: Integer (Auto Detected)
...
0
votes
1
answer
73
views
Database got hacked and now our server is unresponsive. [duplicate]
Just recently we noticed in our website (which was made by a 3rd party before) that the database was compromised. All data was appended by a small html information. What we did is to change all the ...
0
votes
1
answer
189
views
Server hacked: How do I fix, diagnosis and prevent? [duplicate]
Possible Duplicate:
How do I deal with a compromised server?
WP Site (up to date with version & plug ins)
Cheap budget host
Inserted on all of my pages inside the tags are the following ...
- 1,585
0
votes
1
answer
161
views
Script Injection on random pages [duplicate]
Possible Duplicate:
My server’s been hacked EMERGENCY
I am currently running a Windows 2003 server with IIS 6.0.
It seems to be that one of the website has been 'hacked'.
<script src=http://&...
- 3
0
votes
3
answers
234
views
Server not responding, after reset, all data rolled few months back
A Debian Server stopped responding earlier today. After hardware reset, the data on server was rolled back several months ago to the state it was in february. How is this possible?Everything, logs, ...
- 143
0
votes
1
answer
384
views
Apache server under attack
I have a CentOS 5.8 server with Apache 2.2.3 with 20 websites on it. The last weeks the server was several times inaccessible (too many database connections and lots of CPU usage). I had to restart ...
user1343955
0
votes
1
answer
461
views
.htaccess file being compromised
I have a website hosted with Dreamhost and the contents of my .htaccess file are being compromised over and over again. someone is putting stuff like this in the front of my code:
RewriteCond %{...
- 175
0
votes
1
answer
1k
views
Please help me decode this Wordpress hack? [closed]
Annotated code is here: http://pastebay.com/145971
Looks like a very similar situation to this post
I'm no good with python so I thought I might ask for help here. The hack seems to include an ...
- 131
0
votes
2
answers
475
views
How is it possible that multiple computers on a network are being maliciously redirected
Intermittently, and not at the same time, computers connected the network will redirect to Stop-online-piracy.com (may not want to go there). The domain responds with the source:
<div id="Message"&...
- 111
0
votes
3
answers
435
views
DDoS Network Protection Devices
In our office we're running a Cisco ASA 5510 firewall. Is this device enough if we want to protect against DDoS attacks?
What devices (like cisco guard, etc) do you recommend and what's the user ...
- 1,351
0
votes
2
answers
1k
views
Hex \x hacking attempts on web server
I've been seeing a lot of these in my Apache 2 logs recently:
Invalid URI in request \xff\x97\x9f\xfe;J\xe8K$J\x1b\xef\xebr?6\xac\x1aG,\xc6\x81\x0eW{G\xf0\xdf\x82\x9a\xfb\xd0\t\v\xf1\xdf\xbc"\xec|\...
- 140
0
votes
2
answers
262
views
mysql hacked on php linux
i have a website and mysql entries in tables of the database
were deleted or changed values.
i found the hacker pretty quickly but he only did minor changes.
i have some forms on the site. is it ...
user55316
0
votes
4
answers
976
views
Ubuntu Web server compromised; find out what is spawning processes
The Ubuntu Web server that I just inherited has been compromised. I'm a Windows admin and not all too familiar with Linux.
How would I go about finding out what keeps spawning perl processes? I ...
user46497
0
votes
1
answer
85
views
Ever encountered this "http://mattker.hu/images/image.php" in scripts in your site? [duplicate]
My site was hacked.
Most html and javascript files in my site were modified to included the link in the question title.
What strategies should I employ to reduce the likelihood of my site being hacked ...
- 103
0
votes
2
answers
2k
views
How can one perform TCP hijacking?
I am developing with an ASP.NET application that uses Windows Authentication. I have setup the web.config file to deny all unauthenticated users, and only allow users from a certain role.
Using ...
- 163
0
votes
1
answer
1k
views
What are all these requests?
I was checking my server's web server log where I'm installing a wordpress website, and found all these requests, the site is new!
Should I be worried? Is my site hacked or something? I don't ...
0
votes
1
answer
779
views
Hacked file regenerates whenever it is deleted - ubuntu/apache2 [duplicate]
Have just had a hacked website flagged by Sucuri
There were a number of backdoor PHP files flagged, which I HAVE been able to delete
However, the index.php file has a spam link injected in to the ...
- 109
0
votes
2
answers
713
views
Block all outgoing ssh traffic
My EC2 instance reported got suspicious activity and I got this email:
has been implicated in activity which resembles scanning remote hosts
on the internet for security vulnerabilities. Activity of ...
0
votes
1
answer
330
views
Google redirect failing on symfony website
I am helping a friend with her website mainteinance and there is some strange behaviour that I do not fully understand.
When you search for her site on google.com, and click on her main website, the ...
- 101
0
votes
1
answer
288
views
How and where do you report "bad" servers?
I recently setup an nginx that was open to the world in order to serve an API to global users.
It's getting a lot of "prodding" (ie: weakness testing/hacking attempts) from an IP address ...
- 113
0
votes
1
answer
749
views
How's hacker used cgi script on Apache2 server to hack and delete database
Today one of my server has been hacked and hacker deleted my app database. And to restore back they are asking to pay money in BTC.
Well, I started investigating to Apache2 logs and found many ...
- 103
0
votes
1
answer
86
views
Why do I keep getting fake sign ups on my website?
I have a website and it is starting to get more users. To use the services offered by the site, a person has to sign up. The sign-up requires an email, password, and a five-number string for recapcha. ...
- 113
0
votes
1
answer
1k
views
How do I see the traffic of target device in WiFi Pineapple Portal?
I'm using Windows 10 PC connect via Ethernet cable.
I also connect my WiFi pine apple nano into my PC, and configure :
Ethernet sharing to share internet connection through : PineApple
PineApple, ...
- 191
0
votes
1
answer
1k
views
Someone is sending email from my address. How can I prevent this from happening
I received a bunch of Mail delivery failed: returning message to sender messages and found out that someone is sending this email to random addresses:
Today we are reaching out to people, brothers ...
- 189
0
votes
2
answers
567
views
Many HTTP CONNECT request for not owned domains
I had a cloud server with two ip, and each ip is configured respectively with apache and wildfly server. In each of them there are some domain/vhost setup in production.
Checking the apache access ...
- 1
0
votes
1
answer
392
views
Vulnerability risk in modern vlans
I'm looking at using VLAN to separate some traffic without buying a bunch of switches for two or three devices. The plan is to use untagged ports for dedicated lans with an external router connecting ...
0
votes
1
answer
340
views
Danger of setting the environment variable 'PATH' with a '.'? [closed]
I have an upcoming test and looking at past years they always ask a similar question. Basically the security hole that would be created by setting something like:
PATH=".:/bin:/usr/bin"
I get that ...
0
votes
1
answer
85
views
found movies inside my server [duplicate]
This morning i found movies inside my server (debian VPS, apache,webmin/virtualmin), files are located in /var/log/roundcube/./ and the user/group is www-data
I looked in my log (apache,proftp,auth) ...
- 101
0
votes
2
answers
423
views
Server compromised, how deep is the intrusion when PHP files are changed in folder without write permissions [duplicate]
I know there have been a lot of similar questions, but none of them covered this specific question:
I found on almost all PHP files on a clients server script injections, it was actually the script ...
- 105
0
votes
1
answer
100
views
Taking database from possibly cracked server
I have a server which is behaving erratically. While I investigate if it's been hacked, I'm also thinking about my backup options:
As many posts have said the only way to truly know you're clean is ...
- 169
0
votes
1
answer
80
views
Two different SSID's on the same chanel. Is it safe?
If I have multiple network, that have their SSID's on the same channel, can I go into monitor mode(of the wifi interface) and capture packets of the other SSID?
0
votes
1
answer
258
views
Tool to automatic suspending the DDOSed website before the whole VPS is being suspended by Data center [duplicate]
I have a non-Xen VPS (don't exactly know what the software is).
The past week, we had experienced several DDOS attacks on one (or some) of the hosts and because of using more than usual bandwidth, ...
- 619
0
votes
2
answers
918
views
Asp.net IIS Hacking early warning system
I am running an asp.net website on IIS 7.5 and windows 2008 R2 server.
How do I setup (or what do I need) in order to have an alert if there is a hacking attempt against the website and server,?
How ...
- 275
0
votes
1
answer
356
views
Website visitors are still being redirected after "fixing" the damage from a conditional redirect website attack
BACKGROUND
A website of mine was recently the target of a conditional redirect attack.
PHP code was added to my pages to redirect visitors.
The .htaccess file was edited to redirect visitors.
I'...
0
votes
3
answers
2k
views
apache2 server logs - weird activity?
I was going through apache log, and I thought some of the access logs seemed suspicious... I'm not pro, just do server administration as hobby :) so I wonder if I should take some steps...
86.138.17....
user113400
0
votes
3
answers
3k
views
Auth log error : Is it a Hack?
I was just going through auth.log file, I found the following error. Can anybody tell is it a hack or just log of Bugzilla which I installed & throughing an error.
Mar 12 06:50:10 bigbugz02 su[...
- 1,142
0
votes
1
answer
1k
views
It looks like somebody is using my Mac OS X server to brute force attack another server which is LDAP. What can I do to stop it?
An LDAP server on another is reporting an unusually large number of attempts to read the LDAP directory and attempting a number of users, all of which look like hacking attempts to read user/password ...
- 1
0
votes
1
answer
817
views
What is "/admin/Y-ivrrecording.php?php=info&ip=uname"?
Help me please, I found an IP address from Korea try to do something with my web server by put this '/admin/Y-ivrrecording.php?php=info&ip=uname' like search a filename from my web server. I don'...
- 11