Questions tagged [hacking]
Hacking is the violation of server or network security via exploitation of weaknesses in that security.
479
questions
0
votes
0
answers
13
views
Different domain latched on my server [closed]
I created a wordpress site using AWS Lighsail. My server was hosted on public ip (https://52.11.83.83). I also configured AWS Cloudfront CDN on it. Then I saw a domain (hacker: fyiliving.com) which ...
0
votes
0
answers
36
views
How to prevent compromising the email server if user credentials leaked?
I've been using AWS SES as an SMTP relay (Postfix + Dovecot) for years and now am facing the pausing of sending emails for the second time. We use this combination as an email server for business ...
- 153
-4
votes
1
answer
61
views
Is there any way to access Hyper-V host from a network adapter not shared with host? [closed]
I am considering to move my firewall inside Hyper-V. There will be only one Guest OS that is connected to the virtual Switch, and the guest OS is the Firewall OS. While the second adapter at the ...
- 608
-3
votes
2
answers
169
views
Network is gone when I start arp spoofing [closed]
So for context I have two virtual machines one is running on kali linux which is the "Hacker's" machine and the other one is running on windows 10 pro which is supposed to be the victim's ...
0
votes
0
answers
114
views
Vultr firewall opened ports by anonymous party. nslookup of open IP address shows non-authoritative answer "name = noptr.midphase.com". Was I hacked?
I am running a cloud server on Vultr.com. Recently, I logged into Vultr.com in my web cloud instances web interface and checked my firewall. I noticed that port 53/udp had been opened in the vultr ...
- 113
-1
votes
1
answer
60
views
Weird user creation / Is this some sort of attack?
For a few years now, a bot-like user tries to create 10-12 users a couple of times during a day first and last names like "rlpzieqT WHKLpdGQr" (on a website of mine). The ip address is ...
0
votes
1
answer
183
views
VirtualBox network settings for multiple isolated virtual machines where only one can access internet
So I want to make a virtual hacking lab using VirtualBox. There will be two type of machines.
Attack Machine : Kali Linux
Target Machine : This can be any type of OS; Ubuntu, CentOS etc.
I want my ...
1
vote
1
answer
179
views
Since S3 charges by request, couldn't a malicious hacker cause a huge AWS bill just by spamming requests?
What would stop them from doing so, against, say, a static website hosted using S3? Is there a good way to deny some requests such that one avoids getting billed for them?
(Context: I want to host a ...
- 111
0
votes
0
answers
121
views
problems with someone trying to get into my server - fail2ban
I know there are many posts on the subject, but I did not find a solution, every time someone tries to enter my server which gives me the following log ..
Aug 21 11:37:05 postfix/smtpd[27750]: ...
0
votes
0
answers
10
views
How to detect malicious programs on VPS or find remote connections to it [duplicate]
Serveral months ago, my VPS got hacked and used to attack other servers automatically. Knowing nothing about what to do, I just rebooted the server and changed the passwords. However, I continue to ...
0
votes
1
answer
994
views
What are all these requests?
I was checking my server's web server log where I'm installing a wordpress website, and found all these requests, the site is new!
Should I be worried? Is my site hacked or something? I don't ...
0
votes
0
answers
20
views
Hacked website and cannot delete hacked file [duplicate]
First of all, I might be on the total wrong place to post this, but my researches lead to here and I've found "similar" questions being asked here. But still since I lack knowledge in this ...
- 1
1
vote
1
answer
109
views
Are security updates applied with `dnf update` or is it separate procedure in Linux?
I found this vulnerability with polkit. It was found in Jan 22. How does keeping Linux updated security wise works in general?
If I run dnf update on CentOS9 - will it fix it? Or shall I look into ...
- 752
0
votes
2
answers
43
views
How to track specific logs in Ubuntu? (CPU)
We have this EC2 instance: T2.medium, running apache, with 4 virtual hosts (4 sites).
Sometimes, out of nowhere, the CPU reaches very high levels, maybe an attack.
I've seen some of our wordpress ...
- 1
2
votes
3
answers
7k
views
SSHD: Difference between "connection closed..." and "disconnected from..." in log file
The sshd service on my Ubuntu server is under constant attack for various IP and user id.
According to /var/log/auth.log file, there are three different types of fails from unknown id and IP address:
...
- 123
0
votes
0
answers
106
views
Introduction problems with some server log file
I have that problem, that my server is flooded with some kind of requests as you see it here:
26/Jan/2022 66.240.205.34 "Gh0st\xad" "-"
26/Jan/2022 139.162.145.250 "GET 400
26/...
- 1
0
votes
1
answer
518
views
Hacked file regenerates whenever it is deleted - ubuntu/apache2 [duplicate]
Have just had a hacked website flagged by Sucuri
There were a number of backdoor PHP files flagged, which I HAVE been able to delete
However, the index.php file has a spam link injected in to the ...
- 109
0
votes
0
answers
47
views
What is this hacker trying to achieve? [duplicate]
I have hundreds of lines like this in my syslog from many different ip addresses:
Oct 16 17:03:06 example named[857]: client @0x7fa2dc083e40 104.190.220.183#3075 (sl): query (cache) 'sl/ANY/IN' denied
...
- 1
3
votes
1
answer
367
views
Malicious requests from private network (Kubernetes)
Recently I'm having many malicious requests to my nginx-ingress pod but I don't understand how's possible they're from a private network. Some examples:
10.114.0.3 - - [11/Oct/2021:09:07:09 +0000] &...
- 135
0
votes
0
answers
27
views
Who has done what during the course of visiting wordpress site?
I run a small wordpress site.
I use Korean.
Today my statistics shows like the below.
My blog has no more than 100 posts so I am suspicious about the 100+ hits from the same ip.
Can this be an ...
- 113
0
votes
1
answer
2k
views
Postfix blank sender from= <>
Recently I received spam report form my vps provider and Trend Micro, I think my vps got suspended because a or some unknow "blank sender" using my mail server as a "jump point", I ...
2
votes
1
answer
1k
views
My Node.JS program running on an internet-facing server is printing impossible text to the stdout log. Have I been compromised?
(EDIT: Turns out the "strange behavior" is explained by a simple oversight. Keeping this question here in case anyone else overlooks it)
I hope I am asking this question right.
I have a ...
1
vote
0
answers
3k
views
Is it possible to hack a server with a SSTP_DUPLEX_POST request?
How is it possible to use the method : SSTP_DUPLEX_POST and the url : /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ to hack a server ?
I have this request in my logs from a well known malicious IP ...
- 11
0
votes
2
answers
148
views
How to restrict access between folders on the same virtual host
We plan to host WordPress Blog and an Ecommerce store on the same domain, so the URL's will look like this:
example.com <--- Magento Store
example.com/blog/ <--- WordPress Blog
Our main concern ...
- 173
0
votes
0
answers
45
views
.htaccess file hacked [duplicate]
How can we protect our htaccess file?
This code has appeared there several times now: (inserted by hackers)
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR]
RewriteCond %{...
- 1
0
votes
0
answers
33
views
Trojan:PHP/Obfuse.AR!MSR Detection by Windows Defender [duplicate]
I have an AWS server running Windows 2016 Datacenter. From the past few days, Windows Defender has been reporting Trojan:PHP/Obfuse.AR!MSR pointing to random phpXXXX.tmp files inside C:\Windows\Temp ...
- 193
0
votes
2
answers
598
views
Block all outgoing ssh traffic
My EC2 instance reported got suspicious activity and I got this email:
has been implicated in activity which resembles scanning remote hosts
on the internet for security vulnerabilities. Activity of ...
0
votes
2
answers
313
views
TCP modification in-the-middle and acknowledge number
For some private purposes I need to enrich HTTP header with additional information (which will be handled by app on the HTTP server side). The basic idea was to modify received packet, send it to ...
4
votes
2
answers
3k
views
Email smtp credentials keep getting compromised every now and then (laravel 7)
Just as the title says, we have a website that uses third party smtp credentials to send emails, but, we keep getting our smtp credentials hacked and used to send spams emails, which results in our ...
- 119
0
votes
0
answers
92
views
Are requests with no headers a sign of hacking?
I run a NodeJS web application with packages up to date and secured with a strong password and RSA for ssh.
The application runs on two domains. I check the request headers to get the domain and found ...
- 249
-1
votes
1
answer
549
views
Hack attempt Windows Server 2019 [duplicate]
I have a Windows Server 2019 VPS for hosting websites. It has all the latest updates. But somehow there is a (partial) hacking attempt. I first noticed it by the SMS I got for high CPU usage of the ...
- 101
0
votes
1
answer
291
views
Google redirect failing on symfony website
I am helping a friend with her website mainteinance and there is some strange behaviour that I do not fully understand.
When you search for her site on google.com, and click on her main website, the ...
- 101
71
votes
15
answers
44k
views
Should I respond to an "ethical hacker" who's requesting a bounty?
I run a small internet based business from home and make a living at it to feed my family, but I'm still a one man show and internet security is far from my area of expertise.
Yesterday I received two ...
- 798
0
votes
1
answer
216
views
How and where do you report "bad" servers?
I recently setup an nginx that was open to the world in order to serve an API to global users.
It's getting a lot of "prodding" (ie: weakness testing/hacking attempts) from an IP address ...
- 113
1
vote
1
answer
193
views
Guess current date/time on remote server [closed]
I want to know the current date/time of a remote server.
I do not have any access on this server.
This server expose OpenSSH (port 22) and apache2 (port 80)
Is there a fingerprint technique that can ...
- 299
0
votes
1
answer
232
views
How to prevent Apache2 malware execute
Is there any way to prevent to execute some unwanted malware in Apache2.
One of our clients Wordpress website is hacked and there was a files like /wp-content/uploads/2020/05/U27I0x
Those files ...
- 101
0
votes
3
answers
1k
views
Unknown IP trying to sign in to my phpmyadmin
I am very worried.
I have a little web server hosting a PhpMyAdmin page (in which they are some important databases). Yesterday, I posted a full new webpage on my server (but a very simple HTML and ...
0
votes
1
answer
235
views
I see an additional SSHD connection established from an IP that I don't recognise. Should I be worried? (output included)
Here's the output (I've changed my IP to 23.23.23.23)
[root@web01 centos]# lsof -i tcp:22
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sshd 3705 root 3u IPv4 ...
- 101
0
votes
0
answers
32
views
Server hacked and lots of randomly named .php files in the webspace directories [duplicate]
So apparently my Server kinda got hacked. I don't think that someone got access to the root user or any other user but in every main directory of the www-data user there were a lot of weird files.
...
- 113
2
votes
1
answer
80
views
How do I know if an abuse report about unsolicited is actually about my server?
I received an Abuse-Message from the operators of dnsbl.de. To me it sounds like it has nothing to do with me, but since it is too serious I don't want to do "guess work" and check whether it really ...
- 177
0
votes
0
answers
28
views
Is someone trying to hack into my server? [duplicate]
I don't do server stuffs on regular basis, I was just wondering how to check SSH login logs and found that it can be checked using sudo cat /var/log/auth.log and checked on my server and there were ...
- 1
0
votes
1
answer
694
views
How's hacker used cgi script on Apache2 server to hack and delete database
Today one of my server has been hacked and hacker deleted my app database. And to restore back they are asking to pay money in BTC.
Well, I started investigating to Apache2 logs and found many ...
- 103
0
votes
2
answers
95
views
Server compromised or hacked
I don't understand how this subdomain appeared today: http://hainanbank.com.cn.croppio.com/.
I have only added https://croppio.com/ without any sub-domains.
I double checked the server configuration ...
- 113
0
votes
0
answers
65
views
Finding unauthorized user changing files
I manage a client hosting account on [color]host platform. It is a VPS account, running CENTOS 6.10 kvm [server] v84.0.16 OS. There are PHP/MySQL sites, along with WordPress sites. All WordPress ...
- 131
0
votes
1
answer
78
views
Why do I keep getting fake sign ups on my website?
I have a website and it is starting to get more users. To use the services offered by the site, a person has to sign up. The sign-up requires an email, password, and a five-number string for recapcha. ...
- 113
0
votes
1
answer
843
views
How do I see the traffic of target device in WiFi Pineapple Portal?
I'm using Windows 10 PC connect via Ethernet cable.
I also connect my WiFi pine apple nano into my PC, and configure :
Ethernet sharing to share internet connection through : PineApple
PineApple, ...
- 191
0
votes
1
answer
145
views
Is it possible to use a DNS server as a proxy? [closed]
My mobile internet provider cuts my internet service at times before it was due, I contacted them and they did nothing about it
I noticed I could still ping hostnames, thus I can connect to the dns ...
0
votes
1
answer
978
views
Someone is sending email from my address. How can I prevent this from happening
I received a bunch of Mail delivery failed: returning message to sender messages and found out that someone is sending this email to random addresses:
Today we are reaching out to people, brothers ...
- 169
1
vote
1
answer
176
views
Was this a hacking attempt? (Docker container -> MariaDB)
since i am completely new to web hosting and setting up web servers, please excuse my dumb questions ;)
Yesterday i uploaded my web application on digitalocean. The application is a very simple ...
- 13
0
votes
1
answer
510
views
Server Abuse/Proxy Abuse -- Automated Tunneling (Unique IP's = Hundreds, Thousands of Requests)
I run a simple Proxy/General-Use website me and a few friends use at kerenua.xyz, however, starting 3~ weeks ago, an enormous amount of traffic started flooding in from hundreds of (unique) IP ...
