0

Someone has hacked my website recently & changed the codes. I have changed the cpanel password & banned some IPS. but still they are posting some content to database using a URL. punadirallu.org/newsitem.php?id=513. actually there is no newsitem with that id. & even if they open that URL, the iP ban script in the header section should block them from opening the page. I don't know how it is happening. Please suggest.

1
  • 8
    Please give us the source code for your website and root access to your server.
    – Bombe
    Aug 11, 2009 at 7:15

6 Answers 6

4

Once a hacker gets in, they can plant MANY different ways to get into your server.

If this is a web hosting account, completely wipe all files and reinstall your website. If this is a virtual server or physical server, COMPLETELY reinstall the server.

2
if (OS = Windows)
   format C:
else
     fdisk
     mkfs.ext3
1

did you only change the cpanel login? what about logins for ftp and the database?

1
  • +10 if I could give it to you. Aug 13, 2009 at 10:00
0

You need to find the exploit being used and fix it.

Have you checked your access logs and viewed the HTTP Requests being used to post data to your site?

0

A "meta" solution would be the apache mod_security.

0

You need to back up your own data and wipe and reinstall the server. You can never trust a system once it's been breached; you don't know what trojans or other code paths have been inserted on the server. Sealing the breach won't stop what has already been altered internally!

Hopefully you have backups from before the breach occurred. Otherwise you may have trouble knowing what can be trusted on the system. Worse, your system can be used as a platform from which to launch other attacks or monitor traffic from other systems on the network.

After you reinstall fresh and then do all the updates, you may need to look and see if you can find where the breach occurred (or did you already find it?). Were there unnecessary accounts open? Unnecessary services? Anything in the logs? Are you the only authorized user on the system?

You could also look at a program like Tripwire for monitoring alterations to the filesystem. May help with tracking what is replaced down the road. Also use programs like rkhunter for finding known trojans, scanning periodically and have results emailed to you.

I didn't see if you're running Windows or Linux, but the above tools are for Linux systems. I am not sure what you'd use for Windows...