Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (1)

425
votes
13answers
85k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
50
votes
6answers
4k views

Reinstall after a Root Compromise?

After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just ...
27
votes
10answers
30k views

How do I know if my Linux server has been hacked?

What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
15
votes
1answer
1k views

How to do a post-mortem of a server hack

I have a Windows Server 2003 SP2 machine with IIS6, SQL Server 2005, MySQL 5 and PHP 4.3 installed on it. This is not a production machine, but it is exposed to the world via a domain name. Remote ...
15
votes
3answers
9k views

How can I detect unwanted intrusions on my servers?

How are other admins monitoring their servers to detect any unauthorized access and/or hacking attempts? In a larger organization it's easier to throw people at the problem but in a smaller shop how ...
15
votes
8answers
3k views

What are main steps doing forensic analysis of linux box after it was hacked?

What are main steps doing forensic analysis of linux box after it was hacked? Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other ...
13
votes
9answers
6k views

SSH server zero-day exploit - Suggestions to protect ourselves

According to the Internet Storm Center, there seems to be a SSH zero-day exploit out there. There is some proof of concept code in here and some reference: http://secer.org/hacktools/0day-openssh-...
14
votes
7answers
5k views

Should I bother to block these rather lame attempts at hacking my server?

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like: 66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
11
votes
11answers
1k views

Site hacked, looking for security advice [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Last weekend my company's site was hacked. They did the nicest thing of doing that on a Friday evening so we only noticed the attack ...
5
votes
1answer
4k views

How do I decode this WordPress hack? [closed]

I found an offending string in a client's WordPress-powered website, and I just want to know what it does. @preg_replace("\x40\50\x2e\53\x29\100\x69\145","\x65\166\x61\154\x28\142\x61\163\x65\66\x34\...
5
votes
3answers
3k views

Could this server log mean my server is being used as a proxy?

I came across the following entry in my access.log: 58.218.199.147 - - [05/Jun/2012:12:56:04 +1000] "GET http://proxyproxys.com/ HTTP/1.1" 200 183 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5....
4
votes
4answers
946 views

Strange stuff in apache log

I'm building some kind of webapp, and currently the whole thing runs on my machine. I was combing down my logs, and found several "strange" log entries that made me a bit paranoid. Here goes: ***.***....
7
votes
7answers
1k views

Website hacked again

Final Update: Things have been peaceful for the past few weeks and taught me much more about website security and risks. Here's my version of story - I was using an older version of wordpress and ...
0
votes
2answers
206 views

Did My Server Get Attacked?

I logged into my server today and saw the following unrecognized code at the top of my directory browse window: document.writeln("");var el = document.createElement("iframe");document.body....
12
votes
8answers
3k views

is this a hack attempt?

Looking through my 404 logs I noticed the following two URLs, both of which occurred once: /library.php=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ and ...
15
votes
11answers
1k views

Is there a standard method of proving password security to non-mathematicians?

My client has a server that is being subjected to brute-force login attempts from a botnet. Due to the vagaries of the server and the client's client, we can't easily block the attempts through a ...
12
votes
12answers
2k views

Is it ethical to hack real systems? [closed]

Is it ethical to hack real systems owned by someone else? Not for profit, but to test your security knowledge and learn something new. I talk only about hacks, which does not make any damage to system,...
10
votes
2answers
6k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory (...
6
votes
4answers
1k views

My linux box has been hacked. Some files are undeletable even by root. How can I replace them?

An intruder tried to install a rootkit on my box. I want it back, before reinstallation. How do I replace invalid files installed by the attacker? I cannot chown or rm them. It says "Operation not ...
2
votes
5answers
2k views

.htaccess being hacked repeatedly [duplicate]

About 4 or 5 days ago, a client came back to me saying that their site was being redirected to some other suspicious looking website from Google, Yahoo, etc., but it was working fine when the user ...
2
votes
5answers
2k views

How can I learn Linux from hacking or security point of view [closed]

I was interested in entering the security Field and then I studied various posts about that. Someone told that I had to first know the unix system inside out form security perspective and then I can ...
6
votes
7answers
3k views

How Could My Website Be Hacked

I wonder how this could happen. Someone deleted my index.php files from all my domains and puts his own index.php files with the next message: Hacked by Z4i0n - Fatal Error - 2009 [Fatal Error ...
3
votes
6answers
3k views

I think my server is being hacked. What should I do? [duplicate]

I'm not a server admin and I have very little experience in "debuging" a server. But from looking at my log files, it looks as if I'm being hacked. But I have no clue to what I should do :-/ I was ...
2
votes
1answer
2k views

How can I trick SBS 2011 into allowing me to assign a UPN alias so users can logon as user@domain.com

How can I trick SBS 2011 into allowing me to assign a UPN alias so users can logon as user@domain.com See http://support.microsoft.com/kb/243629/en-us But on SBS I only have a 'General', 'Trusts', ...
1
vote
2answers
1k views

rkhunter reports change in file properties, but I don't see that they've been updated by yum

Maybe I'm being overcautious, but I recently received the following warnings from rkhunter: Warning: The file properties have changed: File: /bin/dmesg Current hash: ...
1
vote
1answer
226 views

Understanding Postfix Mail Log

Recently I checked my mail log and found a lot of messages like this (some cipher text have been truncated): Feb 23 11:57:42 postfix/smtpd[32451]: initializing the server-side TLS engine Feb 23 11:57:...
1
vote
1answer
1k views

I've been hacked, and now I'm a bit confused about some things

I noticed yesterday that my site has been hacked, and I'm really confused about some things at this point. All of the files - as far as I can tell - that were edited or added were done so with a ...
0
votes
1answer
2k views

Do cPHulk Brute Force Protection Settings Effect Hosts? [closed]

Question: Do my settings (shown below) prevent visitors from getting to any of the public web sites on my server if their ISP's IP Address has been blocked/black-listed through cPHulk Brute Force ...
-1
votes
2answers
271 views

My Wordpress site being hack by modifying the .htaccess [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY I'm going crazy right now and I don't know what to do. I've did a Google search about those hackers where they using .htaccess to ...
-1
votes
3answers
570 views

Entries in `/etc/inittab` below last line - possible hack? [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY My Linux machine has been hacked lately. There are a few entires in /etc/inittab below the #end of /etc/inittab Something like: #...