Questions tagged [hacking]
Hacking is the violation of server or network security via exploitation of weaknesses in that security.
463
questions
1
vote
1answer
54 views
My Node.JS program running on an internet-facing server is printing impossible text to the stdout log. Have I been compromised?
(EDIT: Turns out the "strange behavior" is explained by a simple oversight. Keeping this question here in case anyone else overlooks it)
I hope I am asking this question right.
I have a ...
0
votes
0answers
66 views
Is it possible to hack a server with a SSTP_DUPLEX_POST request?
How is it possible to use the method : SSTP_DUPLEX_POST and the url : /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ to hack a server ?
I have this request in my logs from a well known malicious IP ...
1
vote
0answers
35 views
Recommendation to fix the slow HTTP post vulnerability reported by Qualys on IIS
I am trying to solve a vulnerability in an IIS server (Reported by Qualys) in which we have a "Slow HTTP Post DDoS" risk and we already apply the following solution:
Delimit the request ...
0
votes
1answer
25 views
How to restrict access between folders on the same virtual host
We plan to host WordPress Blog and an Ecommerce store on the same domain, so the URL's will look like this:
example.com <--- Magento Store
example.com/blog/ <--- WordPress Blog
Our main concern ...
0
votes
0answers
34 views
.htaccess file hacked [duplicate]
How can we protect our htaccess file?
This code has appeared there several times now: (inserted by hackers)
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR]
RewriteCond %{...
0
votes
0answers
31 views
Trojan:PHP/Obfuse.AR!MSR Detection by Windows Defender [duplicate]
I have an AWS server running Windows 2016 Datacenter. From the past few days, Windows Defender has been reporting Trojan:PHP/Obfuse.AR!MSR pointing to random phpXXXX.tmp files inside C:\Windows\Temp ...
0
votes
0answers
16 views
Anyone saw this Powered byNsfocus Collapsar before? [duplicate]
While visiting one of my Websites i saw this black screen in the Screenshot attached.
It was just for some seconds. Anyone know what it is? is it a hack?
Im running on Centos8, with Litespeed and ...
0
votes
0answers
33 views
How to stop malware with Synced folder
Let's assume that we have synced folder between 2 Co-Servers, a ransom is affect one of the servers that have synced folder and the files is encrypted.
The encrypted files will synced and encrypt the ...
0
votes
2answers
117 views
Block all outgoing ssh traffic
My EC2 instance reported got suspicious activity and I got this email:
has been implicated in activity which resembles scanning remote hosts
on the internet for security vulnerabilities. Activity of ...
0
votes
2answers
35 views
TCP modification in-the-middle and acknowledge number
For some private purposes I need to enrich HTTP header with additional information (which will be handled by app on the HTTP server side). The basic idea was to modify received packet, send it to ...
2
votes
2answers
902 views
Email smtp credentials keep getting compromised every now and then (laravel 7)
Just as the title says, we have a website that uses third party smtp credentials to send emails, but, we keep getting our smtp credentials hacked and used to send spams emails, which results in our ...
0
votes
0answers
34 views
Are requests with no headers a sign of hacking?
I run a NodeJS web application with packages up to date and secured with a strong password and RSA for ssh.
The application runs on two domains. I check the request headers to get the domain and found ...
-1
votes
1answer
207 views
Hack attempt Windows Server 2019 [duplicate]
I have a Windows Server 2019 VPS for hosting websites. It has all the latest updates. But somehow there is a (partial) hacking attempt. I first noticed it by the SMS I got for high CPU usage of the ...
0
votes
1answer
141 views
Google redirect failing on symfony website
I am helping a friend with her website mainteinance and there is some strange behaviour that I do not fully understand.
When you search for her site on google.com, and click on her main website, the ...
0
votes
0answers
20 views
Netcat listner is automatically terminating the session
I'm in a virtual environment set up by the school, in which I'm supposed to change a user to root.
I have a program that runs each 5 minutes and added this code to the program. The code is provided ...
60
votes
15answers
22k views
Should I respond to an “ethical hacker” who's requesting a bounty?
I run a small internet based business from home and make a living at it to feed my family, but I'm still a one man show and internet security is far from my area of expertise.
Yesterday I received two ...
0
votes
1answer
72 views
How and where do you report “bad” servers?
I recently setup an nginx that was open to the world in order to serve an API to global users.
It's getting a lot of "prodding" (ie: weakness testing/hacking attempts) from an IP address ...
0
votes
0answers
17 views
Detecting Spyrix Keylogger in a system [duplicate]
Our UTM (Firewall) logs showed Spyrix(Key Logger) has been downloaded on a particular IP in our network. While, on that system, we couldn't see Spyrix. what are the ways to detect traces of syprix in ...
1
vote
1answer
42 views
Guess current date/time on remote server [closed]
I want to know the current date/time of a remote server.
I do not have any access on this server.
This server expose OpenSSH (port 22) and apache2 (port 80)
Is there a fingerprint technique that can ...
0
votes
1answer
63 views
How to prevent Apache2 malware execute
Is there any way to prevent to execute some unwanted malware in Apache2.
One of our clients Wordpress website is hacked and there was a files like /wp-content/uploads/2020/05/U27I0x
Those files ...
1
vote
3answers
347 views
Unknown IP trying to sign in to my phpmyadmin
I am very worried.
I have a little web server hosting a PhpMyAdmin page (in which they are some important databases). Yesterday, I posted a full new webpage on my server (but a very simple HTML and ...
0
votes
1answer
110 views
I see an additional SSHD connection established from an IP that I don't recognise. Should I be worried? (output included)
Here's the output (I've changed my IP to 23.23.23.23)
[root@web01 centos]# lsof -i tcp:22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 3705 root 3u IPv4 ...
0
votes
0answers
32 views
Server hacked and lots of randomly named .php files in the webspace directories [duplicate]
So apparently my Server kinda got hacked. I don't think that someone got access to the root user or any other user but in every main directory of the www-data user there were a lot of weird files.
...
2
votes
1answer
62 views
How do I know if an abuse report about unsolicited is actually about my server?
I received an Abuse-Message from the operators of dnsbl.de. To me it sounds like it has nothing to do with me, but since it is too serious I don't want to do "guess work" and check whether it really ...
0
votes
0answers
26 views
Is someone trying to hack into my server? [duplicate]
I don't do server stuffs on regular basis, I was just wondering how to check SSH login logs and found that it can be checked using sudo cat /var/log/auth.log and checked on my server and there were ...
0
votes
1answer
431 views
How's hacker used cgi script on Apache2 server to hack and delete database
Today one of my server has been hacked and hacker deleted my app database. And to restore back they are asking to pay money in BTC.
Well, I started investigating to Apache2 logs and found many ...
0
votes
2answers
81 views
Server compromised or hacked
I don't understand how this subdomain appeared today: http://hainanbank.com.cn.croppio.com/.
I have only added https://croppio.com/ without any sub-domains.
I double checked the server configuration ...
0
votes
0answers
56 views
Finding unauthorized user changing files
I manage a client hosting account on [color]host platform. It is a VPS account, running CENTOS 6.10 kvm [server] v84.0.16 OS. There are PHP/MySQL sites, along with WordPress sites. All WordPress ...
0
votes
1answer
69 views
Why do I keep getting fake sign ups on my website?
I have a website and it is starting to get more users. To use the services offered by the site, a person has to sign up. The sign-up requires an email, password, and a five-number string for recapcha. ...
0
votes
1answer
219 views
How do I see the traffic of target device in WiFi Pineapple Portal?
I'm using Windows 10 PC connect via Ethernet cable.
I also connect my WiFi pine apple nano into my PC, and configure :
Ethernet sharing to share internet connection through : PineApple
PineApple, ...
-1
votes
1answer
91 views
Is it possible to use a DNS server as a proxy? [closed]
My mobile internet provider cuts my internet service at times before it was due, I contacted them and they did nothing about it
I noticed I could still ping hostnames, thus I can connect to the dns ...
0
votes
1answer
648 views
Someone is sending email from my address. How can I prevent this from happening
I received a bunch of Mail delivery failed: returning message to sender messages and found out that someone is sending this email to random addresses:
Today we are reaching out to people, brothers ...
1
vote
1answer
70 views
Was this a hacking attempt? (Docker container -> MariaDB)
since i am completely new to web hosting and setting up web servers, please excuse my dumb questions ;)
Yesterday i uploaded my web application on digitalocean. The application is a very simple ...
0
votes
1answer
338 views
Server Abuse/Proxy Abuse — Automated Tunneling (Unique IP's = Hundreds, Thousands of Requests)
I run a simple Proxy/General-Use website me and a few friends use at kerenua.xyz, however, starting 3~ weeks ago, an enormous amount of traffic started flooding in from hundreds of (unique) IP ...
0
votes
2answers
1k views
Stopping SSH brute force from China - fail2ban not working
I see things like this in my /var/log/auth.log
sshd[2173]: Unable to negotiate with 218.92.0.205 port 21029: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth]
sshd[1964]: ...
1
vote
2answers
384 views
How to combat/prevent repeated unauthorized attempts to login to my postfix server?
I recently setup my first postfix server and am loving life. :)
But, today I logged into the server to debug some connectivity issues that ended up being on my end, and noticed in the mail log that ...
0
votes
0answers
18 views
Many requests over port 445 on Ubuntu VPS, what could it mean? [duplicate]
I own a small VPS hosted by Hetzner on which i run a small Minecraft game server. The VPS is running on Ubuntu, and the only software i installed are Java JRE and the required software to run a ...
0
votes
2answers
95 views
Many HTTP CONNECT request for not owned domains
I had a cloud server with two ip, and each ip is configured respectively with apache and wildfly server. In each of them there are some domain/vhost setup in production.
Checking the apache access ...
0
votes
0answers
70 views
(404 Errors) Why are hackers looking for directories named “/najwutoanfga/” and other 10-12 char strings of random letters?
I was looking through the 404 errors of my nginx logs today to see what the hackers are trying to do on my website.
I usued this command:
cat access.log | grep '404'
I saw the usual requests for ...
1
vote
0answers
120 views
Very slow server and straight entries in error.log
I am running ubuntu 16.04 and suddenly over the last 2 days my server is basically at a stand still, I have upgraded everything and cleaned my error.log.
I rebooted the server and about about 5mins ...
1
vote
2answers
302 views
How are hackers getting into our server without brute-force? [duplicate]
I am a web developer and we have no one specialising in the wellbeing of the server or the network currently at our office. Usually I can sort many of the issues that arise with my basic knowledge but ...
0
votes
2answers
3k views
local mysql was hacked with ransomware hack. How to check if database data was downloaded?
I had a test mysql database running on Vagrant dev box. Turns out the network wasn't that secure.
All of the databases were deleted (and replaced with a DB ransomware note) and in the logs I can see ...
0
votes
1answer
289 views
Post request with host = "><script>alert('qualys_xss_joomla_2.5.3')</script>
On my web server
Yesterday I have caught a POST request with following text for a host
"><script>alert('qualys_xss_joomla_2.5.3')</script>
in full it was like this
headers
{
...
...
2
votes
1answer
917 views
Suspicious ssh log entries (“Accepted none for anonymous”)
I got this log entry chain (and similar repeatedly) on my server:
Nov 24 07:38:59 server sshd[28676]: SSH: Server;Ltype: Version;Remote: 54.38.81.12-40482;Protocol: 2.0;Client: OpenSSH_7.2p2 Ubuntu-...
0
votes
1answer
270 views
Vulnerability risk in modern vlans
I'm looking at using VLAN to separate some traffic without buying a bunch of switches for two or three devices. The plan is to use untagged ports for dedicated lans with an external router connecting ...
3
votes
1answer
644 views
Catch backslashes, single and double quotes in GET requests
According to this SQL Injection Basics article:
<…> the operations mostly used for breaking\fuzzing the SQL query’s are.
' Single quote
" Double Quote
\ Backslash (MySQL Escape ...
1
vote
3answers
5k views
Someone just trying to hack me? login.cgi+wget
I'm build a new server on Apache, actually I am learning, so I'm trying different things. My security system is already done, but of course I may miss something, or, if not, I do understand that today ...
0
votes
0answers
87 views
how to find the source of mail (host<->lxc container)
One of my lxc-containers is mail server. the others and the host use it to communicate with the world.
But something is using my mail server to sending mails. I found, that mail server receives it ...
0
votes
1answer
662 views
How can a hacker compromising the www-data user account install a rootkit?
Recently a site of mine was hacked. For sure the attacker can execute PHP and start an interactive shell, etc.
I understand a hacker can delete files, or delete DB, the site folder, write in the cron ...
6
votes
1answer
1k views
Apache 2.4 log PHP command 200 success, but what is it doing? POST /?q=die('z!a'.'x'); etc
I am running a CentOS 7.x VPS with Apache 2.4.29 and PHP 7.0.28 and I started seeing the following in my logs. I have php.ini secured as best as I can from articles online for a while now, but I am ...
