Questions tagged [hacking]
Hacking is the violation of server or network security via exploitation of weaknesses in that security.
-1
votes
0answers
22 views
Reverse shell on a closed port possible?
Recently my website was hacked. Luckily the hacker did not have any bad intentions and even left contact information. I contacted him to ask how he did it and he told me he create a reverse shell. I ...
0
votes
2answers
94 views
local mysql was hacked with ransomware hack. How to check if database data was downloaded?
I had a test mysql database running on Vagrant dev box. Turns out the network wasn't that secure.
All of the databases were deleted (and replaced with a DB ransomware note) and in the logs I can see ...
0
votes
1answer
105 views
Post request with host = "><script>alert('qualys_xss_joomla_2.5.3')</script>
On my web server
Yesterday I have caught a POST request with following text for a host
"><script>alert('qualys_xss_joomla_2.5.3')</script>
in full it was like this
headers
{
...
...
2
votes
1answer
108 views
Suspicious ssh log entries (“Accepted none for anonymous”)
I got this log entry chain (and similar repeatedly) on my server:
Nov 24 07:38:59 server sshd[28676]: SSH: Server;Ltype: Version;Remote: 54.38.81.12-40482;Protocol: 2.0;Client: OpenSSH_7.2p2 Ubuntu-...
0
votes
1answer
38 views
Vulnerability risk in modern vlans
I'm looking at using VLAN to separate some traffic without buying a bunch of switches for two or three devices. The plan is to use untagged ports for dedicated lans with an external router connecting ...
0
votes
0answers
73 views
Deploy to AWS EB and immediately get probed by Chinese-sounding hack
That's twice now I've deployed separate apps to AWS via Elastic Beanstalk and within 12 hours of instantiation, while I'm looking through the log files I see this:
------------------------------------...
2
votes
0answers
52 views
Catch backslashes, single and double quotes in GET requests
According to this SQL Injection Basics article:
<…> the operations mostly used for breaking\fuzzing the SQL query’s are.
' Single quote
" Double Quote
\ Backslash (MySQL Escape ...
1
vote
2answers
2k views
Someone just trying to hack me? login.cgi+wget
I'm build a new server on Apache, actually I am learning, so I'm trying different things. My security system is already done, but of course I may miss something, or, if not, I do understand that today ...
0
votes
0answers
20 views
Malicious Index.php files to remove or not to remove [duplicate]
My wordpress website was hacked badly. I need some help if it is possible. I noticed that serveral index.php files (around 10 index.php files) in my website was modified.
All the codes inside the php ...
0
votes
0answers
110 views
proxy_fgci:errors in Apache 2.4.25
Can someone tell me what is this error code?
is it a hacking attempt?
[proxy_fcgi:error] [pid 8497:tid 140283673036544] [client 87.139.108.253:53800] AH01071: Got error 'Primary script unknown\n'
0
votes
0answers
40 views
how to find the source of mail (host<->lxc container)
One of my lxc-containers is mail server. the others and the host use it to communicate with the world.
But something is using my mail server to sending mails. I found, that mail server receives it ...
0
votes
1answer
109 views
How can a hacker compromising the www-data user account install a rootkit?
Recently a site of mine was hacked. For sure the attacker can execute PHP and start an interactive shell, etc.
I understand a hacker can delete files, or delete DB, the site folder, write in the cron ...
6
votes
1answer
1k views
Apache 2.4 log PHP command 200 success, but what is it doing? POST /?q=die('z!a'.'x'); etc
I am running a CentOS 7.x VPS with Apache 2.4.29 and PHP 7.0.28 and I started seeing the following in my logs. I have php.ini secured as best as I can from articles online for a while now, but I am ...
0
votes
0answers
17 views
Wordpress site hacked [duplicate]
For past 2 months my wordpress sites are being hacked I changed themes deleted plugins updated wordpress installation.
I don't know how hackers write codes inside my wordpress files example in wp-...
0
votes
0answers
68 views
SSH Suspicious Commands on Hosting Server
I have a dedicated hosting server that is hosting few websites. I recently accessed my server thru Terminal command line and noticed that the last few commands that were executed weren't from me - ...
0
votes
1answer
67 views
Why is kjournald showing up 700 times in `netstat`?
AFAIK, kjournald is not a network program, but a program that deals with the journal of EXT3 (I am running EXT4 on Ubuntu 16.04). Still, when running sudo netstap -tapn it shows up almost 700 times, ...
0
votes
0answers
27 views
Debian 9 got attacked and disk filled (then emptied)? How can i track down the issue, or the vulnarable software?
It happened before, for reference: Debian 9 disk filled overnight, and emptied next morning? How to track down the issue?
Here is an attached munin screenshot: https://i.imgur.com/y1pLB78.png
And ...
3
votes
2answers
102 views
How can I keep one hacked website on my server from compromising the other websites?
I'm a teaching assistant in software security and running a server that is vulnerable by design.
It's an nginx server, and it has 40 ports open. Each port serves a web application, and all the web ...
1
vote
0answers
34 views
99% wa shell locks up, load at 19 crashed root filesystem?
I suspect my root file system crashed.
tail /var/log/syslog => locks
dmesg doesn't show anything interesting
I figure I can reboot and rebuild the system if necessary as its imaged, however I'm ...
2
votes
2answers
136 views
Why is IPScan detected as a virus?
Does anyone have a definitive answer to why Angry IP Scanner (IPScan) is detected as a virus (hacktool) by so many antivirus vendors, while similar tools such as Nmap and Advanced IP Scanner are not? ...
1
vote
1answer
74 views
Why do strange domains connect to my server?
I have set up a simple Windows 2012 webserver and developed a ASP.NET/MVC website that basically handles any requests to the default website and writes a message to a log database if the domain is ...
0
votes
1answer
53 views
Site hacked, need help to look for clues about how it happened [duplicate]
i recognized a successful hacking attempt where someone managed somehow to modify a file under my drupal installation and to inject javascript code
the file that was hacked was :jquery-1.9.1.min.js ...
3
votes
2answers
52 views
How do you get Google to update the index of your site after recovering from a hack?
I have a website that I took over as webmaster. It was in WordPress and was hacked and had thousands of SPAM pages injected to the website. These pages were indexed by Google and in the end had the ...
0
votes
1answer
398 views
Windows Server 2012: easiest way to monitor ports for error 4625 NTLM attacks
I'm getting thousands of hack attacks on a Windows server resulting in Security log error 4625 entries. Hackers are using random IPs, so the usual RDPguard, Syspeace, etc. tools don't work. Port 3389 ...
0
votes
0answers
55 views
Someone seems to have replicated my site
I just noticed a site which is a carbon copy of mine. I thought someone just scraped the content from my site but after closer inspection, it appeared that it was also directly getting all the content ...
0
votes
0answers
250 views
New user 'ubuntu' created automatically, is my server hacked?
Yesterday my blog(wordpress) went down and when I logged in(ssh) to my server there was message 'System restart required', I restarted the system and everything went back to normal(I mean wordpress ...
0
votes
0answers
45 views
Faulty GUIDs being sent in a URL
We have a C# .NET web application that uses a couple of GUIDs combined with a client ID to identify some of our data which is designed to be publicly accessible but difficult to stumble on other valid ...
0
votes
0answers
49 views
Why has the icon for my website changed on its own?
I installed the lamp stack on a Linode at the beginning of the year. It's just a personal website, accessed by IP address, so I doubt anyone else knows of it.
Recently the icon (next to the website's ...
0
votes
0answers
219 views
FTP Server keeps getting connections from router every few seconds
Background / Network Structure
The are two layers of routers. The router at the outer layer has public Internet IP 123.123.123.123 (fake as example) and private IP 192.168.11.1. The router at the ...
14
votes
1answer
3k views
Potential hijacked SSH session & SSH best practices
I'm freaking out a little bit at the moment. I am SSHing into a remote server that I have recently commissioned. I'm doing this as root. I have installed fail2ban and had a massive amount of banned ...
-3
votes
1answer
112 views
Please help identify any weird processes [duplicate]
I'm in need of a hand. We recently had a server compromise and manage to do a nice clean but I'm trying to get rid of the bug without moving server.
Can anybody review the running processes below ...
1
vote
2answers
428 views
MySQL hacked on AWS AMI: 'Pay to get data back' - how could this be possible and how to avoid it next time?
Today morning I noticed that some of the websites I host on a EC2 instance aren't working. When I verified the MySql database, it was wiped out! :( The only thing I have found was only a record ...
0
votes
0answers
37 views
Hacked by ruined@india.com [duplicate]
I was happily working on my Azure VM playpen last night via a remote desktop session. When I logged on this morning I was presented with the attached message:
The VM contained nothing of value and ...
24
votes
3answers
3k views
What can be learned about a user from a failed SSH attempt?
What can be learned about a 'user' from a failed malicious SSH attempt?
User name entered (/var/log/secure)
Password entered (if configured, i.e. by using a PAM module)
Source IP address (/var/log/...
0
votes
0answers
22 views
Spam sending on my machine with not write on log of exim and ASSP [duplicate]
This question it's diferent to How do I deal with a compromised server?
Obviously the server has a security commitment. But this question presents some specific and not generic issues, as generic and ...
0
votes
1answer
255 views
User root dissapear [duplicate]
I have a debian 8 box. It is a plesk server with 90+ websites.
It seems somebody access to my server and delete the user root. I go to /etc/passwd and the file is not owned by root:root is owned by ...
29
votes
4answers
7k views
Weird SSH, Server security, I might have been hacked
I am not sure if I've been hacked or not.
I tried to log in through SSH and it wouldn't accept my password. Root login is disabled so I went to rescue and turned root login on and was able to log in ...
0
votes
1answer
520 views
Prevent nginx to execute images as PHP script
My website has been compromized by an user who uploaded an image with PHP code in it. This code allows to upload files, and he uploaded a malicious PHP script.
He was able to call his "image-php" ...
1
vote
2answers
303 views
Someone try to hack my server
I have a linux machine running as a test server. My box redirects my port like 80 directly on this machine. I created it to train all kind of things (raid, tcp...).
Recently I tried to connect to my ...
1
vote
1answer
352 views
Server hacked, 301 redirect, domain lost?
My Ubuntu 16.04 with a new, up to date Wordpress installation (with only one or two Plugins) was hacked. I initiated a new server installation to get rid of anything bad.
It seems like nothing really ...
-1
votes
1answer
114 views
Apache being hit by requests (cpu 100%)
recently we moved to a new host (DO) for one of my client after being on a shared account .
I was monitoring the cpu and it was always at 100% , knowing that the site dosnt get a lot of traffic , ...
10
votes
1answer
863 views
Security Wordpress on IIS hosted sites.
Since yesterday I,ve got strange things happening on one of my websites.
The index.php of my wordpress site on IIS changed from 1 kb to 80 KB. Also map.xml and sitemap.xml are new in the directory. ...
0
votes
1answer
88 views
Detecting unauthorized changes to my Linux server
I had a thought and would be interested in seeing it is passes the sniff test by smarter folks here.
I have a web-facing server. I'll call it WEB1. I believe I have taken the standard precautions and ...
1
vote
1answer
165 views
Why are there so many attacks on a specific server?
I have a couple of web-servers running, and one of them have received 6000 attemps to gain access in the past 6 months.
The other practically none.
Is this a coincidence, or is there something that ...
1
vote
1answer
57 views
unknown mail going from my mail box , cant see while sending it
When I send mail from outlook an extra mail is being generated and send to an unknown id . Why does this happen and how can this be prevented.
1
vote
2answers
167 views
ISP is DNS Hijacking. Updated DNS to Google OpenDNS, but still hijacked [closed]
I'm visiting India, and saw that their main provider, Airtel, limits the entirety of the internet to just a small handful of websites festooned with their own advertisements, and annoying redirects.
...
-3
votes
1answer
149 views
Hacking attempt from Googlebot [closed]
Today I found this in my server log:
66.249.64.140 crawl-66-249-64-140.googlebot.com [22/Sep/2016:11:23:30 +0300] "GET /C/Users/%EF%BF%BD%C3%8A/Documents/%EF%BF%BD%EF%BF%BD%EF%BF%BD%C3%AF/Documents/...
0
votes
2answers
168 views
Second Site in a week on our Server hacked. How?
We are a hosting Company for customers and never had problems. Now, the second customer site was "hacked" in one week. Our passwords should be safe and we change them often, instead I think there were ...
19
votes
4answers
10k views
Someone is trying to brute force SSH access to my server [duplicate]
By coincidence I looked at my servers ssh log (/var/log/auth.log) and I noticed that someone is constantly trying to gain access:
Sep 7 13:03:45 virt01 sshd[14674]: pam_unix(sshd:auth): ...
3
votes
0answers
334 views
Strange hack attempt to postfix
Yesterday I got a email sent {@DOMAIN.ORG from my mailserver the mail was marked as spam.
The body included scripts download commands like ftp://ftp.ugotownedz.org/upfile2.sh
lines from syslog
Aug ...
