Hacking is the violation of server or network security via exploitation of weaknesses in that security.

learn more… | top users | synonyms (4)

287
votes
12answers
48k views

How do I deal with a compromised server?

This is a Canonical Question about Server Security - Responding to Breach Events (Hacking) See Also: Tips for Securing a LAMP Server Reinstall after a Root Compromise? Canonical ...
43
votes
6answers
3k views

Reinstall after a Root Compromise?

After reading this question on a server compromise, I started to wonder why people continue to seem to believe that they can recover a compromised system using detection/cleanup tools, or by just ...
34
votes
17answers
41k views

How can I disrupt my roommate's BitTorrent? [closed]

We're on a 50 mb/s Comcast connection and our connection right now is coming in under 1.5 mb/s. Our roommate left for a week with BitTorrent running (Azureus client, we think). Our latency is ...
33
votes
11answers
1k views

Got Hacked. Want to understand how

Someone has, for the second time, appended a chunk of javascript to a site I help run. This javascript hijacks Google adsense, inserting their own account number, and sticking ads all over. The ...
25
votes
7answers
3k views

How can I block hacking attempts targeting phpMyAdmin?

My website gets thousands of hits daily from different IPs trying to access: /php-myadmin/ /myadmin/ /mysql/ ...and thousands of other variations. None of these directories exist, I don't even have ...
20
votes
15answers
3k views

HELP! Production DB was SQL INJECTED! [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Geeze, I'm desperate! A few hours ago our production DB was sql-injected. I know we have some big holes in the system... because ...
18
votes
10answers
14k views

How do I know if my Linux server has been hacked?

What are the tell-tale signs that a Linux server has been hacked? Are there any tools that can generate and email an audit report on a scheduled basis?
17
votes
16answers
5k views

192.168.1.x more exploitable?

Our IT services firm is proposing a network reconfiguration to use the IP range 10.10.150.1 – 10.10.150.254 internally as they state the current IP scheme using manufacturer defaults of 192.168.1.x is ...
16
votes
10answers
1k views

How to Slow Down a Hacker

Some script kiddie in Delhi, India has been trying to hack our site since last night. He wrote a browser script that makes requests of our server in massive nested loops, trying everything under the ...
14
votes
8answers
2k views

What are main steps doing forensic analysis of linux box after it was hacked?

What are main steps doing forensic analysis of linux box after it was hacked? Lets say it is a generic linux server mail/web/database/ftp/ssh/samba. And it started sending spam, scanning other ...
13
votes
11answers
801 views

Is there a standard method of proving password security to non-mathematicians?

My client has a server that is being subjected to brute-force login attempts from a botnet. Due to the vagaries of the server and the client's client, we can't easily block the attempts through a ...
13
votes
1answer
932 views

How to do a post-mortem of a server hack

I have a Windows Server 2003 SP2 machine with IIS6, SQL Server 2005, MySQL 5 and PHP 4.3 installed on it. This is not a production machine, but it is exposed to the world via a domain name. Remote ...
12
votes
13answers
2k views

Is it ethical to hack real systems? [closed]

Is it ethical to hack real systems owned by someone else? Not for profit, but to test your security knowledge and learn something new. I talk only about hacks, which does not make any damage to ...
12
votes
8answers
1k views

is this a hack attempt?

Looking through my 404 logs I noticed the following two URLs, both of which occurred once: /library.php=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ and ...
12
votes
9answers
5k views

SSH server zero-day exploit - Suggestions to protect ourselves

According to the Internet Storm Center, there seems to be a SSH zero-day exploit out there. There is some proof of concept code in here and some reference: ...
12
votes
10answers
826 views

What is the best way to gain access when the password is unknown?

If you were provided a computer running Windows 2000 or newer and you have no passwords, what method do you use to gain access with administrator privileges so you can use the system?
12
votes
3answers
5k views

How can I detect unwanted intrusions on my servers?

How are other admins monitoring their servers to detect any unauthorized access and/or hacking attempts? In a larger organization it's easier to throw people at the problem but in a smaller shop how ...
11
votes
11answers
1k views

Site hacked, looking for security advice [duplicate]

Possible Duplicate: My server's been hacked EMERGENCY Last weekend my company's site was hacked. They did the nicest thing of doing that on a Friday evening so we only noticed the ...
11
votes
6answers
3k views

Should I bother to block these rather lame attempts at hacking my server?

I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like: 66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
11
votes
1answer
1k views

ubuntu 10.10 sshd contains “YOU WANNA SMOKE A SPLIFF” and pot leaf ascii art. Does this mean I've been hacked?

My sshd binary on an ubuntu 10.10 machine contains the following ascii artwork: ng: %.100sToo many lines in environment file %sUser %.100s not allowed because %s exists YOU WANNA . ...
10
votes
6answers
295 views

What are the attack vectors for passwords sent over http?

I am trying to convince a customer to pay for SSL for a web site that requires login. I want to make sure I correctly understand the major scenarios in which someone can see the passwords that are ...
10
votes
5answers
283 views

My site was recently attacked. What do I do?

This is a first for me. One of the sites I run was recently attacked. Not at all an intelligent attack - pure brute force - hit every page and every non-page with every extension possible. Posted ...
9
votes
4answers
1k views

Can a virtual machine (VM) “hack” another VM running on the same physical machine?

Questions: if a VM is corrupted (hacked), what do I risk on others VMs running on the same physical machine? What kind of security issues is there between VMs running on the same physical host? Is ...
9
votes
7answers
2k views

Hacking prevention, forensics, auditing and counter measures

Recently (but it is also a recurrent question) we saw 3 interesting threads about hacking and security: My server's been hacked EMERGENCY. Finding how a hacked server was hacked File ...
9
votes
2answers
4k views

My linux server was hacked. How do I find out how and when it was done?

I have a home server running a desktop ubuntu distribution. I found this in my crontab * * * * * /home/username/ /.access.log/y2kupdate >/dev/null 2>&1 and when looking in that directory ...
8
votes
3answers
737 views

Unsecured MySQL 'root'@'localhost' account accessed remotely?

A little background: We've just had our PBX system hacked. The server itself seems secure (no logged unauthorised console access - SSH etc), but somehow the hackers have managed to inject a new admin ...
7
votes
5answers
3k views

Should I report hacking attempts?

I am running a small (Windows-based) server. When I check the logs, I see a steady flow of (unsuccesfull) password-guessing hacking attempts. Should I try to report those attempts to the owners of the ...
7
votes
4answers
282 views

Could/Should you be held liable for server vulnerabilities? [closed]

Is there precedent in North America or elsewhere where a server administrator was held accountable for leaving a server vulnerable? For example, if there is a known exploit in IIS - Microsoft issue ...
7
votes
2answers
518 views

Dissecting a website attack through a compromised FTP account

My site has been hacked and at this point, I know some details, but I'm at a loss at exactly how it happened or how to prevent it in the future. I need your help in trying to dissect the attack so ...
7
votes
2answers
1k views

Bypassing htaccess restrictions?

I found this in my apache access logs access.log:555.555.555.555 - - [05/May/2011:12:12:21 -0400] "GET /somedir/ HTTP/1.1" 403 291 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 ...
6
votes
4answers
1k views

My linux box has been hacked. Some files are undeletable even by root. How can I replace them?

An intruder tried to install a rootkit on my box. I want it back, before reinstallation. How do I replace invalid files installed by the attacker? I cannot chown or rm them. It says "Operation not ...
6
votes
7answers
494 views

Server was hacked. Now login wont accept 'root' as username comes up invalid

On Fedora, root is coming up invalid. WHat is solution?
6
votes
6answers
2k views

Attempted hack on VPS, how to protect in future, what were they trying to do? [duplicate]

UPDATE: They're still here. Help me stop or trap them! Hi SF'ers, I've just had someone hack one of my clients sites. They managed to get to change a file so that the checkout page on the site ...
6
votes
9answers
1k views

Is it worth hiring a hacker to perform some penetration testing on my servers? [closed]

I'm working in a small IT company with paranoid clients, so security has always been an important consideration to us. In the past, we've already mandated penetration testing from two independent ...
6
votes
3answers
624 views

What is the ip range of EC2

I'd like to setup a rule to block ssh request from EC2 since I've been seeing a large amount of ssh based attack from there and was wondering if anyone knew what their IP ranges are. EDIT: Thank you ...
6
votes
7answers
1k views

Website hacked again, what to do? please help

Final Update: Things have been peaceful for the past few weeks and taught me much more about website security and risks. Here's my version of story - I was using an older version of wordpress and ...
6
votes
3answers
357 views

Need help recovering a corrupt SQL database

I have a very special case that I have been working on for several days. I have a very large SQL Server 2008 database (about 2 TB) that contains 500 filegroups to support very large partitioned ...
6
votes
8answers
1k views

(200 ok) ACCEPTED - Is this a hacking attempt?

I assume this is some type of hacking attempt. I've try to Google it but all I get are sites that look like they have been exploited already. I'm seeing requests to one of my pages that looks like ...
6
votes
3answers
375 views

Somebody eating all our bandwidth, what should I do?

OK, this is frustrating, my site got thousands of page views/connections in the last 3 days and finally we ran out of monthly bandwidth. We bought more bandwidth and closed the site for maintenance. ...
6
votes
6answers
541 views

Database is hacked over and over again; already cleaned the site for SQL injection

I have a client who's asked me to try and analyze a site for vulnerability. What's happening is, every weekend or so, on field of one record of one table in the database gets changed to the same ...
5
votes
15answers
1k views

How can I be notified if somone is attempting to hack into a Linux server?

I'd like to be notified via email if our Linux servers are under any kind of hacking attempt or service attack. Is there some kind of all-in-one solution that can monitor for suspicious activity and ...
5
votes
7answers
895 views

Real experience of being hacked on linux?

I would like to hear real stories, how your linux box/server was hacked and what you do not to fall in to the same hole again.
5
votes
5answers
442 views

How do companies know they've been hacked?

With the news of Google and others getting hacked, I was wondering how companies find out, detect, and/or know they've been hacked in the first place? Sure, if they find a virus/trojan on user's ...
5
votes
3answers
827 views

Hacked? How does appending a filename allow access to data on site… see example

Visiting all of the following sends you to the login screen: http://mysite.com/admin/configuration.php http://mysite.com/admin/login.php However if you visit (note the last two portions of the url ...
5
votes
7answers
3k views

How Could My Website Be Hacked

I wonder how this could happen. Someone deleted my index.php files from all my domains and puts his own index.php files with the next message: Hacked by Z4i0n - Fatal Error - 2009 [Fatal Error ...
5
votes
1answer
3k views

How do I decode this WordPress hack? [closed]

I found an offending string in a client's WordPress-powered website, and I just want to know what it does. ...
5
votes
5answers
754 views

NAT as a firewall

Network Address Translation ( NAT ), seems to sort of act as a firewall for the hosts behind it because they are not available. Although I would never rely on this as my firewall, what are its ...
5
votes
3answers
890 views

Weird set of shell commands in root's .bash_history

I have probably just detected that a user on a server of mine has rooted my server, but that's not what I'm asking. Has anyone ever seen command like these: echo _EoT_0.249348813417008_; id; echo ...
4
votes
6answers
6k views

How did they hack my Wordpress sites

I have many wordpress sites hosted in a Bluehost shared hosting environment. Recently when I searched one of the sites in Google, it said "The site might be compromised". I got alerts from Google ...
4
votes
4answers
3k views

Site Hacked Using ?cmd=ls

A Joomla site I'm running was hacked the other day. The hacker dropped some files into the tmp directory and was running an HTTP Daemon there somehow (at least that's what my host told me). At any ...