Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (1)

-4
votes
0answers
23 views

RedHat hacked with 2 files in all directories [duplicate]

We have a RedHat server, and today I found out 2 files in all the directories of certain user, which is used in cpanel. One of the files had this "Hacked By SiPengembara Gila~# Sanjungan Jiwa #~". ...
0
votes
0answers
15 views

Blocking creation of PHP files on cPanel/WHM server

I am running WHM 56.0 Build 2 with an updated cPanel installation, and the server hosts 14 Wordpress sites in a Multisite formation. Every site in the multisite is run by a different person; some ...
-4
votes
1answer
46 views

Try to Test Hack Attempt with Telnet [closed]

My server recently was attacked by hackers trying to run code on a web site, and I would like to test what they there trying to do. I'm not sure how to build the telnet command to do this. 2016-06-09 ...
0
votes
1answer
19 views

Danger of setting the environment variable 'PATH' with a '.'? [closed]

I have an upcoming test and looking at past years they always ask a similar question. Basically the security hole that would be created by setting something like: PATH=".:/bin:/usr/bin" I get that ...
0
votes
1answer
111 views

Weak points of ssh tunnel and x11 server, hack investigation

So, today I've been hacked. It's very puzzling to me how it was done, so I'm looking for experienced people to show weak points in design of my systems. I have two servers. One is VPS with ...
0
votes
1answer
30 views

.htaccess file permissions changed

I have a weird problem on some of my servers with Directadmin and Wordpress installed. The file permissions of the .htaccess file are set to 444. When I change them back to 644, edit the file and save ...
0
votes
0answers
29 views

How to respond to password crack on SSH server? [duplicate]

Update: I'd already read How do I deal with a compromised server? but was hoping for advice specific to a password crack (such as using fail2ban), as well as info about whether this could be an OS bug....
0
votes
0answers
20 views

How to determine how a file was created on ubuntu web server?

I recently installed inotify to monitor my server, I was alerted to the following file being created. Which I promptly deleted. But obviously that isn't good. How can I find out how or where the ...
0
votes
0answers
8 views

invalid_userauth_request on server log [duplicate]

Hi I am getting this type of logs on my server frequent for few days: May 3 06:06:00 cloud sshd[***]: Invalid user tomcat from 184.173.54.130 May 3 06:06:00 cloud sshd[***]: input_userauth_request: ...
0
votes
0answers
20 views

Tripwire security

I have installed Tripwire on a temporary server to get a feel for it. Everything seems to be working (e.g. it detects changes and sends an email report). If I understand Tripwire correctly it is ...
2
votes
1answer
47 views

openSUSE installs and VMs constantly being hacked and bricked

Sorry if this is a total newbie question, but I'm doing frontend design work for a radical political organisation and ALL my installations of Linux, be they openSUSE, Ubuntu or Fedora keep getting ...
0
votes
0answers
132 views

whos hacking my FreeSwitch from my own IP?

i have a very odd thing happening in my FreeSWITCH log, it seems that someone is calling me from my own ip address for example [NOTICE] switch_channel.c:1053 New Channel sofia/external/9909@12.34.56....
0
votes
0answers
19 views

Website was hacked but only 1 domain [duplicate]

I recently found out that one of my Domains (which was only a empty Wordpress installation), was hacked. The website didn't show the wordpress installation anymore, instead there was just a website ...
0
votes
0answers
12 views

How did my non-CMS based website get hacked? I have a file called mails.php which contains a preg_replace statement [duplicate]

I have a series of websites in my server, all of which share the same set of PHP files. They're not based in any CMS (no Wordpress, no Joomla, etc.). All of them contain my own "CMS" so to speak. I've ...
-3
votes
1answer
109 views

I think I'm Hacked. MySQL Server Too Many Connections Made my Server CPU load 100% [closed]

I'm having a very urgent problem. Suddenly today My Server can't send email, after i checked out the log turns out there are many errors from MySQL which says too many connections. I checked out my ...
3
votes
3answers
1k views

Continuous POST requests on wordpress login page - hacking attempt?

From today morning, I am witnessing a series of continuous POST requests hitting on one of blog running on wordpress software on my server. Few things about this pattern: These continuous requests ...
0
votes
1answer
73 views

Php script - Have I been hacked [closed]

Here is the PHP script I have found at the root of each of my website folder. Script name is fcb.php Content is : <? $GLOBALS['_1303753477_']=Array(base64_decode('YX' .'JyYXlfZGlmZl91a2V5'),...
-2
votes
1answer
75 views

Deep packet Inspection Stenography [closed]

I'm trying to develop something that can get around Deep Packet Inspection so that rather than looking like OpenVPN traffic etc, I could put all that into HTTP packets as extra information or some ...
1
vote
2answers
3k views

Can't delete corrupt files on Linux

So I got hit by a script kitte... Fortunately the box is Ubuntu and was able to replace w/ binaries from a comparable system, however, Some of the files I couldn't delete, and am still stumped on ...
-1
votes
1answer
123 views

AWS account hacked! Amazon isn't helping. What can I do?

Recently, someone hacked my AWS account by getting into the email account used for AWS and requesting a password change. Afterwards, they obviously changed the password of the email address. Amazon ...
3
votes
4answers
780 views

Nginx 400 errors due to random encoded string starting with “\x” from random IP addresses

I assume these are some sort of bots, but would like to know what are they trying to do to my server. The logs in questions are below and the IP address has been changed from the original. 12.34.56....
0
votes
1answer
71 views

Apache2 access logs suspicious, what kind of attack is this

Essentially I have a webcam set up at home to record movement, and I set up a basic Apache server so that I can externally access said videos stored. The server is running on my laptop and I have ...
0
votes
2answers
44 views

How safe is IPtables whitelisting?

I am deploying some VPS and of course, security is a big concern. I read that IPtables whitelisting is the best way to safeguard your machine. So I set up the follwing : echo "Flushing rules" ...
0
votes
2answers
113 views

Requests made to a website with a different domain/url in log files, hacking attempt?

in one of my websites I am logging all url requests made to the server. I log that data for stats purpose to improve the website. The logs look like http://example.com/search 2016-01-12 23:03:...
3
votes
4answers
381 views

Rogue processess in linux

I'm running Apache on Linux server. I have noticed the following processes running which I am not expecting to see, and appear rogue. Can anyone please advise me what they mean? Running ps aux | ...
422
votes
13answers
84k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
-5
votes
1answer
106 views

how does one report an RDP attack to Microsoft when it's happening in real time? [closed]

To my surprise, Security Event 10 was for 104.43.193.6 which is apparently a Microsoft ip address: http://ip2location.com/demo/104.43.193.6 =. Microsoft Corporation. Likely AFAIK some has leased 104....
2
votes
1answer
395 views

Possible Cisco Router Hack?

We have a Cisco EPC3928AD EuroDocsis 3.0 2-PORT Voice Gateway from our ISP. The router is connected to a firewall (an Ubuntu-box running iptables and Wireshark). Our LAN (10.0.0.1/24) is beyond the ...
0
votes
0answers
23 views

netstat -r on debian give abnormal output

after looking for stuff with Debian "netstat" and try list stuff with "nestat -r" my main Server out a Long list of unkown Hosts ( mostly hacked IP´s by looking on abuseDB ) here a small example for ...
5
votes
1answer
679 views

Anomalous connection to china from debian server [duplicate]

TL;DR I didn't ask how to take care of my compromised server. I asked how to detect if a file is anomalous/extraneous/non-official. So this is not a duplicate of the question on compromised servers. ...
0
votes
0answers
14 views

Error 522, server not responding [duplicate]

I've an issue with my Google Cloud compute VM. It's running Ubuntu 14.04, Apache2, PHP and Percona MySQL. The server won't respond to TCP connections on port 80. I can connect via SSH, and the server ...
0
votes
1answer
72 views

found movies inside my server [duplicate]

This morning i found movies inside my server (debian VPS, apache,webmin/virtualmin), files are located in /var/log/roundcube/./ and the user/group is www-data I looked in my log (apache,proftp,auth) ...
0
votes
0answers
21 views

Prevent bruteforcelogin attacks from my server [duplicate]

i have received this warning from google that my server has attacked their servers/partners, see the email below Thank you for your follow up! We received an external report for malicious ...
0
votes
0answers
39 views

How to find out if I've been hacked [duplicate]

I am running Apache2 webserver and someone has attempted to hack me. using this script. How can can find if the attack worked and what its done if it has worked. I'm running Kali Linux 2.0. ...
0
votes
0answers
168 views

http cookie contains datr not working (none packets is returned) wireshark

When I filter in wireshark: http.cookie contains datr none packets is returned, the list in null. What's I going wrong?
1
vote
2answers
896 views

Server got hacked by some Crypto Lockers [duplicate]

My server (CentOS) recently got hacked by some Crypto Hackers. They encrypted all of my files and asking for ransom to decrypt the files. They kept a message in all folders, which start like this ...
0
votes
0answers
92 views

mod_evasive: Stop attacks against wp-login.php

i would like to stop attacks against some user's WordPress-installations on my server. This is an example of an attack: 91.208.65.12 - - [20/Oct/2015:10:33:08 +0200] "POST /wp-login.php HTTP/1.0" ...
2
votes
1answer
2k views

Someone tried to hack my Node.js server, need to understand a GET request in the logs

Alright, so I left my Node.js server alone for a while and came back to find some really interesting stuff in the logs. Apparently some moron from China or Poland tried to hack my server using ...
-1
votes
1answer
157 views

Found someone hacking in my LAMP server centos 7 using GET request with WGET

This is a bit confusing and I think I was hit by a shellshock, by the way I'm not a sysadmin and only know a little bit about handling a linux. I'm running a website (LAMP) and hosting it in Digital ...
1
vote
1answer
60 views

How to find location of wifi packet floods

We've seen ongoing wireless packet floods (beacon, probe requests, and probe response floods) that are reported in the event log of our office firewall appliance. These are being sent continuously and ...
-1
votes
2answers
131 views

Is this someone trying to hack the server?

I keep seeing the following coming up in my nginx and Apache server log files as a 400: () { :; }; /bin/ping -c 3 x.x.x.x x.x.x.x is different IPs. Does this look like a hacker trying to find a ...
2
votes
3answers
132 views

Block people searching for server admin pages

Occasionally I flip through our (apache) access log and I often come across people trying to fish for admin pages. For example, they are trying to access pages like: /wp-login.php /administrator/...
-1
votes
1answer
488 views

Server 2012 R2 TCP Timestamps

We will be having some penetration testing performed shortly and looking to clean up a few things. One of these is TCP timstamps in Windows. A simiple NMAP scan shows me a guess of the TCP timestamp ...
0
votes
0answers
259 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
0
votes
0answers
8 views

Maldet HIT LIST - what now? [duplicate]

I have gotten the following result after a maldet scan, should I just delete the 3 files, or is there something else I should do? FILE HIT LIST: {HEX}gzbase64.inject.unclassed.15 : /usr/local/src/...
4
votes
6answers
9k views

How did they hack my Wordpress sites

I have many wordpress sites hosted in a Bluehost shared hosting environment. Recently when I searched one of the sites in Google, it said "The site might be compromised". I got alerts from Google ...
-1
votes
1answer
134 views

Exchange Sever Being Hacked

We have a two server Exchange environment and they've been hacked in some way. get-queue displays tens of thousands of emails in the queues. Most of the email was being sent to yahoo.com.tw, yaahoo....
1
vote
4answers
1k views

Random IP's constantly trying to connect to SQL Server

We are building a cloud-based application that relies on a login database as well as many individual client databases. Using rackspace we have setup a server (windows server 2012) with SQL Management ...
12
votes
2answers
2k views

ubuntu 10.10 sshd contains “YOU WANNA SMOKE A SPLIFF” and pot leaf ascii art. Does this mean I've been hacked?

My sshd binary on an ubuntu 10.10 machine contains the following ascii artwork: ng: %.100sToo many lines in environment file %sUser %.100s not allowed because %s exists YOU WANNA . ...
-1
votes
2answers
97 views

how to prevent non-admin user to gain admin access using overflow [closed]

There are all sort of coding best practices to prevent stack overflow attack but that is not what this question is about. What I want to know is how to prevent a legit non-admin user running a piece ...