Questions tagged [hacking]
Hacking is the violation of server or network security via exploitation of weaknesses in that security.
449
questions
0
votes
1answer
25 views
How to prevent Apache2 malware execute
Is there any way to prevent to execute some unwanted malware in Apache2.
One of our clients Wordpress website is hacked and there was a files like /wp-content/uploads/2020/05/U27I0x
Those files ...
0
votes
2answers
100 views
Unknown IP trying to sign in to my phpmyadmin
I am very worried.
I have a little web server hosting a PhpMyAdmin page (in which they are some important databases). Yesterday, I posted a full new webpage on my server (but a very simple HTML and ...
0
votes
1answer
75 views
I see an additional SSHD connection established from an IP that I don't recognise. Should I be worried? (output included)
Here's the output (I've changed my IP to 23.23.23.23)
[root@web01 centos]# lsof -i tcp:22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 3705 root 3u IPv4 ...
0
votes
0answers
53 views
Compromised Ubiquity ERLite 3?
I'm not a network administrator just trying to help a friend who's been having issues lately with his PPTP VPN.
At first glance I noticed a very high CPU usage as well as constantly >50Mbps of RX/TX
...
0
votes
0answers
32 views
Server hacked and lots of randomly named .php files in the webspace directories [duplicate]
So apparently my Server kinda got hacked. I don't think that someone got access to the root user or any other user but in every main directory of the www-data user there were a lot of weird files.
...
0
votes
0answers
27 views
Return 404 if key exists in querystring
Recently had a Wordpress website hacked and it submitted URL's to google in the format http://www.example.com/?ck=some-pharma-related-string
It seems to be a bit different than the "Pharma Hacks" ...
2
votes
1answer
52 views
How do I know if an abuse report about unsolicited is actually about my server?
I received an Abuse-Message from the operators of dnsbl.de. To me it sounds like it has nothing to do with me, but since it is too serious I don't want to do "guess work" and check whether it really ...
0
votes
0answers
26 views
Is someone trying to hack into my server? [duplicate]
I don't do server stuffs on regular basis, I was just wondering how to check SSH login logs and found that it can be checked using sudo cat /var/log/auth.log and checked on my server and there were ...
0
votes
1answer
217 views
How's hacker used cgi script on Apache2 server to hack and delete database
Today one of my server has been hacked and hacker deleted my app database. And to restore back they are asking to pay money in BTC.
Well, I started investigating to Apache2 logs and found many ...
0
votes
2answers
70 views
Server compromised or hacked
I don't understand how this subdomain appeared today: http://hainanbank.com.cn.croppio.com/.
I have only added https://croppio.com/ without any sub-domains.
I double checked the server configuration ...
0
votes
0answers
48 views
Finding unauthorized user changing files
I manage a client hosting account on [color]host platform. It is a VPS account, running CENTOS 6.10 kvm [server] v84.0.16 OS. There are PHP/MySQL sites, along with WordPress sites. All WordPress ...
0
votes
1answer
61 views
Why do I keep getting fake sign ups on my website?
I have a website and it is starting to get more users. To use the services offered by the site, a person has to sign up. The sign-up requires an email, password, and a five-number string for recapcha. ...
0
votes
1answer
56 views
How do I see the traffic of target device in WiFi Pineapple Portal?
I'm using Windows 10 PC connect via Ethernet cable.
I also connect my WiFi pine apple nano into my PC, and configure :
Ethernet sharing to share internet connection through : PineApple
PineApple, ...
0
votes
0answers
9 views
Ubuntu server compromised / hacked - task “apache -k” running high cpu, high load average [duplicate]
I'm sharing this in the hope of finding a way to block this hack, or perhaps what other problems I might have.
I found our web server running a task with owner www-data (apache) and the command '...
-1
votes
1answer
63 views
Is it possible to use a DNS server as a proxy? [closed]
My mobile internet provider cuts my internet service at times before it was due, I contacted them and they did nothing about it
I noticed I could still ping hostnames, thus I can connect to the dns ...
0
votes
1answer
328 views
Someone is sending email from my address. How can I prevent this from happening
I received a bunch of Mail delivery failed: returning message to sender messages and found out that someone is sending this email to random addresses:
Today we are reaching out to people, brothers ...
1
vote
1answer
53 views
Was this a hacking attempt? (Docker container -> MariaDB)
since i am completely new to web hosting and setting up web servers, please excuse my dumb questions ;)
Yesterday i uploaded my web application on digitalocean. The application is a very simple ...
0
votes
1answer
193 views
Server Abuse/Proxy Abuse — Automated Tunneling (Unique IP's = Hundreds, Thousands of Requests)
I run a simple Proxy/General-Use website me and a few friends use at kerenua.xyz, however, starting 3~ weeks ago, an enormous amount of traffic started flooding in from hundreds of (unique) IP ...
0
votes
2answers
496 views
Stopping SSH brute force from China - fail2ban not working
I see things like this in my /var/log/auth.log
sshd[2173]: Unable to negotiate with 218.92.0.205 port 21029: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth]
sshd[1964]: ...
1
vote
2answers
100 views
How to combat/prevent repeated unauthorized attempts to login to my postfix server?
I recently setup my first postfix server and am loving life. :)
But, today I logged into the server to debug some connectivity issues that ended up being on my end, and noticed in the mail log that ...
0
votes
0answers
18 views
Many requests over port 445 on Ubuntu VPS, what could it mean? [duplicate]
I own a small VPS hosted by Hetzner on which i run a small Minecraft game server. The VPS is running on Ubuntu, and the only software i installed are Java JRE and the required software to run a ...
0
votes
0answers
61 views
My VPS tried to DDoS (or port scan) Columbia University, what can i do? [duplicate]
I own a small VPS hosted by Hetzner on which i run a small Minecraft game server. The VPS is running on Ubuntu, and the only software i installed are Java JRE and the required software to run a MC ...
0
votes
2answers
78 views
Many HTTP CONNECT request for not owned domains
I had a cloud server with two ip, and each ip is configured respectively with apache and wildfly server. In each of them there are some domain/vhost setup in production.
Checking the apache access ...
0
votes
0answers
56 views
(404 Errors) Why are hackers looking for directories named “/najwutoanfga/” and other 10-12 char strings of random letters?
I was looking through the 404 errors of my nginx logs today to see what the hackers are trying to do on my website.
I usued this command:
cat access.log | grep '404'
I saw the usual requests for ...
1
vote
0answers
105 views
Very slow server and straight entries in error.log
I am running ubuntu 16.04 and suddenly over the last 2 days my server is basically at a stand still, I have upgraded everything and cleaned my error.log.
I rebooted the server and about about 5mins ...
1
vote
2answers
136 views
How are hackers getting into our server without brute-force? [duplicate]
I am a web developer and we have no one specialising in the wellbeing of the server or the network currently at our office. Usually I can sort many of the issues that arise with my basic knowledge but ...
0
votes
2answers
2k views
local mysql was hacked with ransomware hack. How to check if database data was downloaded?
I had a test mysql database running on Vagrant dev box. Turns out the network wasn't that secure.
All of the databases were deleted (and replaced with a DB ransomware note) and in the logs I can see ...
0
votes
1answer
231 views
Post request with host = "><script>alert('qualys_xss_joomla_2.5.3')</script>
On my web server
Yesterday I have caught a POST request with following text for a host
"><script>alert('qualys_xss_joomla_2.5.3')</script>
in full it was like this
headers
{
...
...
2
votes
1answer
561 views
Suspicious ssh log entries (“Accepted none for anonymous”)
I got this log entry chain (and similar repeatedly) on my server:
Nov 24 07:38:59 server sshd[28676]: SSH: Server;Ltype: Version;Remote: 54.38.81.12-40482;Protocol: 2.0;Client: OpenSSH_7.2p2 Ubuntu-...
0
votes
1answer
221 views
Vulnerability risk in modern vlans
I'm looking at using VLAN to separate some traffic without buying a bunch of switches for two or three devices. The plan is to use untagged ports for dedicated lans with an external router connecting ...
3
votes
1answer
350 views
Catch backslashes, single and double quotes in GET requests
According to this SQL Injection Basics article:
<…> the operations mostly used for breaking\fuzzing the SQL query’s are.
' Single quote
" Double Quote
\ Backslash (MySQL Escape ...
1
vote
3answers
5k views
Someone just trying to hack me? login.cgi+wget
I'm build a new server on Apache, actually I am learning, so I'm trying different things. My security system is already done, but of course I may miss something, or, if not, I do understand that today ...
0
votes
0answers
78 views
how to find the source of mail (host<->lxc container)
One of my lxc-containers is mail server. the others and the host use it to communicate with the world.
But something is using my mail server to sending mails. I found, that mail server receives it ...
0
votes
1answer
422 views
How can a hacker compromising the www-data user account install a rootkit?
Recently a site of mine was hacked. For sure the attacker can execute PHP and start an interactive shell, etc.
I understand a hacker can delete files, or delete DB, the site folder, write in the cron ...
6
votes
1answer
1k views
Apache 2.4 log PHP command 200 success, but what is it doing? POST /?q=die('z!a'.'x'); etc
I am running a CentOS 7.x VPS with Apache 2.4.29 and PHP 7.0.28 and I started seeing the following in my logs. I have php.ini secured as best as I can from articles online for a while now, but I am ...
1
vote
1answer
100 views
Why is kjournald showing up 700 times in `netstat`?
AFAIK, kjournald is not a network program, but a program that deals with the journal of EXT3 (I am running EXT4 on Ubuntu 16.04). Still, when running sudo netstap -tapn it shows up almost 700 times, ...
0
votes
0answers
28 views
Debian 9 got attacked and disk filled (then emptied)? How can i track down the issue, or the vulnarable software?
It happened before, for reference: Debian 9 disk filled overnight, and emptied next morning? How to track down the issue?
Here is an attached munin screenshot: https://i.imgur.com/y1pLB78.png
And ...
3
votes
2answers
149 views
How can I keep one hacked website on my server from compromising the other websites?
I'm a teaching assistant in software security and running a server that is vulnerable by design.
It's an nginx server, and it has 40 ports open. Each port serves a web application, and all the web ...
1
vote
0answers
47 views
99% wa shell locks up, load at 19 crashed root filesystem?
I suspect my root file system crashed.
tail /var/log/syslog => locks
dmesg doesn't show anything interesting
I figure I can reboot and rebuild the system if necessary as its imaged, however I'm ...
4
votes
2answers
571 views
Why is IPScan detected as a virus?
Does anyone have a definitive answer to why Angry IP Scanner (IPScan) is detected as a virus (hacktool) by so many antivirus vendors, while similar tools such as Nmap and Advanced IP Scanner are not? ...
1
vote
1answer
93 views
Why do strange domains connect to my server?
I have set up a simple Windows 2012 webserver and developed a ASP.NET/MVC website that basically handles any requests to the default website and writes a message to a log database if the domain is ...
0
votes
1answer
60 views
Site hacked, need help to look for clues about how it happened [duplicate]
i recognized a successful hacking attempt where someone managed somehow to modify a file under my drupal installation and to inject javascript code
the file that was hacked was :jquery-1.9.1.min.js ...
3
votes
2answers
61 views
How do you get Google to update the index of your site after recovering from a hack?
I have a website that I took over as webmaster. It was in WordPress and was hacked and had thousands of SPAM pages injected to the website. These pages were indexed by Google and in the end had the ...
0
votes
1answer
778 views
Windows Server 2012: easiest way to monitor ports for error 4625 NTLM attacks
I'm getting thousands of hack attacks on a Windows server resulting in Security log error 4625 entries. Hackers are using random IPs, so the usual RDPguard, Syspeace, etc. tools don't work. Port 3389 ...
0
votes
0answers
51 views
Why has the icon for my website changed on its own?
I installed the lamp stack on a Linode at the beginning of the year. It's just a personal website, accessed by IP address, so I doubt anyone else knows of it.
Recently the icon (next to the website's ...
0
votes
0answers
387 views
FTP Server keeps getting connections from router every few seconds
Background / Network Structure
The are two layers of routers. The router at the outer layer has public Internet IP 123.123.123.123 (fake as example) and private IP 192.168.11.1. The router at the ...
14
votes
1answer
4k views
Potential hijacked SSH session & SSH best practices
I'm freaking out a little bit at the moment. I am SSHing into a remote server that I have recently commissioned. I'm doing this as root. I have installed fail2ban and had a massive amount of banned ...
-3
votes
1answer
196 views
Please help identify any weird processes [duplicate]
I'm in need of a hand. We recently had a server compromise and manage to do a nice clean but I'm trying to get rid of the bug without moving server.
Can anybody review the running processes below ...
1
vote
2answers
956 views
MySQL hacked on AWS AMI: 'Pay to get data back' - how could this be possible and how to avoid it next time?
Today morning I noticed that some of the websites I host on a EC2 instance aren't working. When I verified the MySql database, it was wiped out! :( The only thing I have found was only a record ...
0
votes
0answers
37 views
Hacked by ruined@india.com [duplicate]
I was happily working on my Azure VM playpen last night via a remote desktop session. When I logged on this morning I was presented with the attached message:
The VM contained nothing of value and ...
