Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (1)

2
votes
3answers
181 views

mysql server - how can I restore a backup remotely (from the server itself ) without ssh access ? Hack my server

I created an instances on a cloud provider . Generated the .pem key to login through ssh. Installed mysql-server , downloaded the .sql backup on the server. removed the .sql backup from my local ...
1
vote
1answer
60 views

How to find location of wifi packet floods

We've seen ongoing wireless packet floods (beacon, probe requests, and probe response floods) that are reported in the event log of our office firewall appliance. These are being sent continuously and ...
1
vote
1answer
313 views

Blocking HTTP clients which request certain URLs repeatedly

I run a website on Windows Server 2008 R2. Looking through the IIS logs, I have noticed that there are some IP addresses repeatedly requesting certain URLs (such as for example /mysql/phpmyadmin/main....
0
votes
1answer
30 views

.htaccess file permissions changed

I have a weird problem on some of my servers with Directadmin and Wordpress installed. The file permissions of the .htaccess file are set to 444. When I change them back to 644, edit the file and save ...
0
votes
1answer
110 views

Weak points of ssh tunnel and x11 server, hack investigation

So, today I've been hacked. It's very puzzling to me how it was done, so I'm looking for experienced people to show weak points in design of my systems. I have two servers. One is VPS with ...
0
votes
1answer
72 views

Is it possible to mimic the client of a https web service

There is such a windows application that communications with the server through https protocol, it is an auction tool and works only several hours per month. I have captured network packets (by ...
0
votes
1answer
216 views

Securing the Django web site which is run with Apache mod_wsgi

I have made a website in Django 1.6 with PostgreSQL database which is hosted on Ubuntu 12.04.3 with Apache 2.2.22 and I have recently noticed lots of hacking (probing) attempts from various IPs ...
0
votes
1answer
478 views

Hidden Spam Meta Descriptions

I have found out that a client's site (WordPress CMS) was somehow infected with spam / hacked and did some serious cleaning, updating and upgrading and cleaning cache. I used various tools and search ...
0
votes
1answer
259 views

hiden iframe unescape

started helping a company with a web site a few days ago... i notices some strange code in some html and php files on the server: <script>eval(unescape('%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%...
1
vote
0answers
273 views

Is my site getting hacked (Bluehost)?

I'm running a simple website off of Bluehost, and I needed to use custom Python scripts so I created a cgi-bin folder in my site's directory and added my cgi python files there. Everytime I tried to ...
1
vote
0answers
227 views

suspicious connection on server

OS: Windows Server 2003 Monitoring tool: CurrPorts When monitoring traffic on the server for traffic going out on port 80, example of results: 5/1/2014 2:36:23 PM Added cscript.exe TCP server-IP:...
1
vote
0answers
166 views

How to secure tmp directory from hard link attacks when host doesn't allow partitioning

I'm a new sysadmin in the making, have learned that I need to have /tmp and /home directories on separate partitions in order to prevent possibilities of privilege escalation through hard links based ...
1
vote
0answers
542 views

Server getting constant DNS TXT queries - What is the hazard potential?

recently I discovered that my server was generating a lot more traffic than normal. Normally I get around 1-10 Mb per day, since the server only works as a host for eMail and static websites. ...
1
vote
0answers
25 views

What is ClixSmart+ServiceMonitor from my IIS log?

Our IIS6 log (W3SVC1) is showing entries with suffix ClixSmart+ServiceMonitor 200 0 0. There are over 10 of them per second and it lasts about 20 seconds when happened. Is our server being hacked? ...
0
votes
0answers
14 views

Blocking creation of PHP files on cPanel/WHM server

I am running WHM 56.0 Build 2 with an updated cPanel installation, and the server hosts 14 Wordpress sites in a Multisite formation. Every site in the multisite is run by a different person; some ...
0
votes
0answers
20 views

How to determine how a file was created on ubuntu web server?

I recently installed inotify to monitor my server, I was alerted to the following file being created. Which I promptly deleted. But obviously that isn't good. How can I find out how or where the ...
0
votes
0answers
19 views

Tripwire security

I have installed Tripwire on a temporary server to get a feel for it. Everything seems to be working (e.g. it detects changes and sends an email report). If I understand Tripwire correctly it is ...
0
votes
0answers
23 views

netstat -r on debian give abnormal output

after looking for stuff with Debian "netstat" and try list stuff with "nestat -r" my main Server out a Long list of unkown Hosts ( mostly hacked IP´s by looking on abuseDB ) here a small example for ...
0
votes
0answers
168 views

http cookie contains datr not working (none packets is returned) wireshark

When I filter in wireshark: http.cookie contains datr none packets is returned, the list in null. What's I going wrong?
0
votes
0answers
132 views

whos hacking my FreeSwitch from my own IP?

i have a very odd thing happening in my FreeSWITCH log, it seems that someone is calling me from my own ip address for example [NOTICE] switch_channel.c:1053 New Channel sofia/external/9909@12.34.56....
0
votes
0answers
91 views

mod_evasive: Stop attacks against wp-login.php

i would like to stop attacks against some user's WordPress-installations on my server. This is an example of an attack: 91.208.65.12 - - [20/Oct/2015:10:33:08 +0200] "POST /wp-login.php HTTP/1.0" ...
0
votes
0answers
254 views

Suspicious SELinux Audit Log Entries PHP-FPM Write Denied - How to investigate?

I found a few /var/log/audit/audit.log entries which have me a little bit concerned. SEAlert explains them as such: SELinux is preventing /usr/sbin/php-fpm from write access on the directory ...
0
votes
0answers
227 views

Auto black list hackers from Apache server that hit website too fast

I notice some hackers jumping from website to website iterating all possible IP addresses and hitting them so fast and hard with their attack URLs to get some flaws. I am more interested in how to ...
0
votes
0answers
175 views

Automatic IPSec IP Blacklist

A new client of ours has a legacy web app on Win Server 2008 R2 and when we started diagnosing the event logs, there were multiple ip's in China trying to hit both their sa sql account and trying to ...