2022 Developer Survey is open! Take survey.

Questions tagged [hacking]

Hacking is the violation of server or network security via exploitation of weaknesses in that security.

Filter by
Sorted by
Tagged with
-2 votes
1 answer
9 views

What is Data Encryption? Why it is important in network security?

Data encryption is a technique in which the sender converts the message into a code. It allows only authorized user to gain access.
user avatar
-1 votes
0 answers
9 views

How to enumerate/scan for private dns subdomains through a VPN connection

I need to enumerate/scan a target IP address through a VPN on a private network. The target has an apache web server on port 80. No DNS server is available for the target since it is on the Hackthebox ...
user avatar
1 vote
1 answer
35 views

Are security updates applied with `dnf update` or is it separate procedure in Linux?

I found this vulnerability with polkit. It was found in Jan 22. How does keeping Linux updated security wise works in general? If I run dnf update on CentOS9 - will it fix it? Or shall I look into ...
user avatar
0 votes
2 answers
22 views

How to track specific logs in Ubuntu? (CPU)

We have this EC2 instance: T2.medium, running apache, with 4 virtual hosts (4 sites). Sometimes, out of nowhere, the CPU reaches very high levels, maybe an attack. I've seen some of our wordpress ...
user avatar
0 votes
0 answers
11 views

How to research what dominated my CPU for a few hours

I have a little server (CentoOS 7 running on Linode) that is normally very quiet. But while I was asleep last night it went nuts for about 6.5 hours running something. By the time I got a chance to ...
user avatar
1 vote
2 answers
213 views

SSHD: Difference between "connection closed..." and "disconnected from..." in log file

The sshd service on my Ubuntu server is under constant attack for various IP and user id. According to /var/log/auth.log file, there are three different types of fails from unknown id and IP address: ...
user avatar
  • 113
0 votes
0 answers
29 views

Introduction problems with some server log file

I have that problem, that my server is flooded with some kind of requests as you see it here: 26/Jan/2022 66.240.205.34 "Gh0st\xad" "-" 26/Jan/2022 139.162.145.250 "GET 400 26/...
user avatar
  • 1
0 votes
1 answer
117 views

Hacked file regenerates whenever it is deleted - ubuntu/apache2 [duplicate]

Have just had a hacked website flagged by Sucuri There were a number of backdoor PHP files flagged, which I HAVE been able to delete However, the index.php file has a spam link injected in to the ...
user avatar
  • 109
0 votes
0 answers
43 views

What is this hacker trying to achieve? [duplicate]

I have hundreds of lines like this in my syslog from many different ip addresses: Oct 16 17:03:06 example named[857]: client @0x7fa2dc083e40 104.190.220.183#3075 (sl): query (cache) 'sl/ANY/IN' denied ...
user avatar
3 votes
1 answer
264 views

Malicious requests from private network (Kubernetes)

Recently I'm having many malicious requests to my nginx-ingress pod but I don't understand how's possible they're from a private network. Some examples: 10.114.0.3 - - [11/Oct/2021:09:07:09 +0000] &...
user avatar
0 votes
0 answers
26 views

Who has done what during the course of visiting wordpress site?

I run a small wordpress site. I use Korean. Today my statistics shows like the below. My blog has no more than 100 posts so I am suspicious about the 100+ hits from the same ip. Can this be an ...
user avatar
  • 113
0 votes
1 answer
818 views

Postfix blank sender from= <>

Recently I received spam report form my vps provider and Trend Micro, I think my vps got suspended because a or some unknow "blank sender" using my mail server as a "jump point", I ...
user avatar
2 votes
1 answer
577 views

My Node.JS program running on an internet-facing server is printing impossible text to the stdout log. Have I been compromised?

(EDIT: Turns out the "strange behavior" is explained by a simple oversight. Keeping this question here in case anyone else overlooks it) I hope I am asking this question right. I have a ...
user avatar
0 votes
0 answers
1k views

Is it possible to hack a server with a SSTP_DUPLEX_POST request?

How is it possible to use the method : SSTP_DUPLEX_POST and the url : /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ to hack a server ? I have this request in my logs from a well known malicious IP ...
user avatar
0 votes
2 answers
57 views

How to restrict access between folders on the same virtual host

We plan to host WordPress Blog and an Ecommerce store on the same domain, so the URL's will look like this: example.com <--- Magento Store example.com/blog/ <--- WordPress Blog Our main concern ...
user avatar
  • 173
0 votes
0 answers
45 views

.htaccess file hacked [duplicate]

How can we protect our htaccess file? This code has appeared there several times now: (inserted by hackers) RewriteBase / RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR] RewriteCond %{...
user avatar
  • 1
0 votes
0 answers
32 views

Trojan:PHP/Obfuse.AR!MSR Detection by Windows Defender [duplicate]

I have an AWS server running Windows 2016 Datacenter. From the past few days, Windows Defender has been reporting Trojan:PHP/Obfuse.AR!MSR pointing to random phpXXXX.tmp files inside C:\Windows\Temp ...
user avatar
0 votes
2 answers
320 views

Block all outgoing ssh traffic

My EC2 instance reported got suspicious activity and I got this email: has been implicated in activity which resembles scanning remote hosts on the internet for security vulnerabilities. Activity of ...
user avatar
0 votes
2 answers
75 views

TCP modification in-the-middle and acknowledge number

For some private purposes I need to enrich HTTP header with additional information (which will be handled by app on the HTTP server side). The basic idea was to modify received packet, send it to ...
user avatar
3 votes
2 answers
2k views

Email smtp credentials keep getting compromised every now and then (laravel 7)

Just as the title says, we have a website that uses third party smtp credentials to send emails, but, we keep getting our smtp credentials hacked and used to send spams emails, which results in our ...
user avatar
  • 99
0 votes
0 answers
40 views

Are requests with no headers a sign of hacking?

I run a NodeJS web application with packages up to date and secured with a strong password and RSA for ssh. The application runs on two domains. I check the request headers to get the domain and found ...
user avatar
-1 votes
1 answer
433 views

Hack attempt Windows Server 2019 [duplicate]

I have a Windows Server 2019 VPS for hosting websites. It has all the latest updates. But somehow there is a (partial) hacking attempt. I first noticed it by the SMS I got for high CPU usage of the ...
user avatar
  • 101
0 votes
1 answer
184 views

Google redirect failing on symfony website

I am helping a friend with her website mainteinance and there is some strange behaviour that I do not fully understand. When you search for her site on google.com, and click on her main website, the ...
user avatar
  • 101
63 votes
15 answers
32k views

Should I respond to an "ethical hacker" who's requesting a bounty?

I run a small internet based business from home and make a living at it to feed my family, but I'm still a one man show and internet security is far from my area of expertise. Yesterday I received two ...
user avatar
  • 696
0 votes
1 answer
148 views

How and where do you report "bad" servers?

I recently setup an nginx that was open to the world in order to serve an API to global users. It's getting a lot of "prodding" (ie: weakness testing/hacking attempts) from an IP address ...
user avatar
  • 113
1 vote
1 answer
62 views

Guess current date/time on remote server [closed]

I want to know the current date/time of a remote server. I do not have any access on this server. This server expose OpenSSH (port 22) and apache2 (port 80) Is there a fingerprint technique that can ...
user avatar
  • 415
0 votes
1 answer
125 views

How to prevent Apache2 malware execute

Is there any way to prevent to execute some unwanted malware in Apache2. One of our clients Wordpress website is hacked and there was a files like /wp-content/uploads/2020/05/U27I0x Those files ...
user avatar
0 votes
3 answers
737 views

Unknown IP trying to sign in to my phpmyadmin

I am very worried. I have a little web server hosting a PhpMyAdmin page (in which they are some important databases). Yesterday, I posted a full new webpage on my server (but a very simple HTML and ...
user avatar
0 votes
1 answer
177 views

I see an additional SSHD connection established from an IP that I don't recognise. Should I be worried? (output included)

Here's the output (I've changed my IP to 23.23.23.23) [root@web01 centos]# lsof -i tcp:22 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME sshd 3705 root 3u IPv4 ...
user avatar
  • 101
0 votes
0 answers
32 views

Server hacked and lots of randomly named .php files in the webspace directories [duplicate]

So apparently my Server kinda got hacked. I don't think that someone got access to the root user or any other user but in every main directory of the www-data user there were a lot of weird files. ...
user avatar
  • 113
2 votes
1 answer
69 views

How do I know if an abuse report about unsolicited is actually about my server?

I received an Abuse-Message from the operators of dnsbl.de. To me it sounds like it has nothing to do with me, but since it is too serious I don't want to do "guess work" and check whether it really ...
user avatar
  • 177
0 votes
0 answers
27 views

Is someone trying to hack into my server? [duplicate]

I don't do server stuffs on regular basis, I was just wondering how to check SSH login logs and found that it can be checked using sudo cat /var/log/auth.log and checked on my server and there were ...
user avatar
  • 1
0 votes
1 answer
572 views

How's hacker used cgi script on Apache2 server to hack and delete database

Today one of my server has been hacked and hacker deleted my app database. And to restore back they are asking to pay money in BTC. Well, I started investigating to Apache2 logs and found many ...
user avatar
  • 103
0 votes
2 answers
88 views

Server compromised or hacked

I don't understand how this subdomain appeared today: http://hainanbank.com.cn.croppio.com/. I have only added https://croppio.com/ without any sub-domains. I double checked the server configuration ...
user avatar
0 votes
0 answers
62 views

Finding unauthorized user changing files

I manage a client hosting account on [color]host platform. It is a VPS account, running CENTOS 6.10 kvm [server] v84.0.16 OS. There are PHP/MySQL sites, along with WordPress sites. All WordPress ...
user avatar
0 votes
1 answer
76 views

Why do I keep getting fake sign ups on my website?

I have a website and it is starting to get more users. To use the services offered by the site, a person has to sign up. The sign-up requires an email, password, and a five-number string for recapcha. ...
user avatar
  • 113
0 votes
1 answer
479 views

How do I see the traffic of target device in WiFi Pineapple Portal?

I'm using Windows 10 PC connect via Ethernet cable. I also connect my WiFi pine apple nano into my PC, and configure : Ethernet sharing to share internet connection through : PineApple PineApple, ...
user avatar
  • 171
0 votes
1 answer
104 views

Is it possible to use a DNS server as a proxy? [closed]

My mobile internet provider cuts my internet service at times before it was due, I contacted them and they did nothing about it I noticed I could still ping hostnames, thus I can connect to the dns ...
user avatar
0 votes
1 answer
793 views

Someone is sending email from my address. How can I prevent this from happening

I received a bunch of Mail delivery failed: returning message to sender messages and found out that someone is sending this email to random addresses: Today we are reaching out to people, brothers ...
user avatar
  • 149
1 vote
1 answer
119 views

Was this a hacking attempt? (Docker container -> MariaDB)

since i am completely new to web hosting and setting up web servers, please excuse my dumb questions ;) Yesterday i uploaded my web application on digitalocean. The application is a very simple ...
user avatar
0 votes
1 answer
425 views

Server Abuse/Proxy Abuse -- Automated Tunneling (Unique IP's = Hundreds, Thousands of Requests)

I run a simple Proxy/General-Use website me and a few friends use at kerenua.xyz, however, starting 3~ weeks ago, an enormous amount of traffic started flooding in from hundreds of (unique) IP ...
user avatar
0 votes
2 answers
2k views

Stopping SSH brute force from China - fail2ban not working

I see things like this in my /var/log/auth.log sshd[2173]: Unable to negotiate with 218.92.0.205 port 21029: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth] sshd[1964]: ...
user avatar
1 vote
2 answers
876 views

How to combat/prevent repeated unauthorized attempts to login to my postfix server?

I recently setup my first postfix server and am loving life. :) But, today I logged into the server to debug some connectivity issues that ended up being on my end, and noticed in the mail log that ...
user avatar
  • 115
0 votes
0 answers
18 views

Many requests over port 445 on Ubuntu VPS, what could it mean? [duplicate]

I own a small VPS hosted by Hetzner on which i run a small Minecraft game server. The VPS is running on Ubuntu, and the only software i installed are Java JRE and the required software to run a ...
user avatar
0 votes
2 answers
203 views

Many HTTP CONNECT request for not owned domains

I had a cloud server with two ip, and each ip is configured respectively with apache and wildfly server. In each of them there are some domain/vhost setup in production. Checking the apache access ...
user avatar
0 votes
0 answers
86 views

(404 Errors) Why are hackers looking for directories named "/najwutoanfga/" and other 10-12 char strings of random letters?

I was looking through the 404 errors of my nginx logs today to see what the hackers are trying to do on my website. I usued this command: cat access.log | grep '404' I saw the usual requests for ...
user avatar
1 vote
0 answers
126 views

Very slow server and straight entries in error.log

I am running ubuntu 16.04 and suddenly over the last 2 days my server is basically at a stand still, I have upgraded everything and cleaned my error.log. I rebooted the server and about about 5mins ...
user avatar
1 vote
2 answers
522 views

How are hackers getting into our server without brute-force? [duplicate]

I am a web developer and we have no one specialising in the wellbeing of the server or the network currently at our office. Usually I can sort many of the issues that arise with my basic knowledge but ...
user avatar
  • 11
0 votes
2 answers
3k views

local mysql was hacked with ransomware hack. How to check if database data was downloaded?

I had a test mysql database running on Vagrant dev box. Turns out the network wasn't that secure. All of the databases were deleted (and replaced with a DB ransomware note) and in the logs I can see ...
user avatar
0 votes
1 answer
334 views

Post request with host = "><script>alert('qualys_xss_joomla_2.5.3')</script>

On my web server Yesterday I have caught a POST request with following text for a host "><script>alert('qualys_xss_joomla_2.5.3')</script> in full it was like this headers { ... ...
user avatar

1
2 3 4 5
10