Questions tagged [hacking]
Hacking is the violation of server or network security via exploitation of weaknesses in that security.
482
questions
10
votes
6
answers
959
views
What are the attack vectors for passwords sent over http?
I am trying to convince a customer to pay for SSL for a web site that requires login. I want to make sure I correctly understand the major scenarios in which someone can see the passwords that are ...
- 203
0
votes
2
answers
207
views
Would SSL prevent replay tampering by the authenticated user
In the context of a game (HTML5/Flash/Silverlight) which sends data to an online service to record progress (e.g. player killed an orc), would communicating with the service over SSL implicitly ...
- 105
3
votes
3
answers
2k
views
How do hackers really achieve "anonymity"?
I asked if proxies really provide anonymity, and would like to know how hackers do it when they try to attack government websites and such.
They hack PCs making them zombies and them controlling ...
1
vote
1
answer
343
views
Blocking HTTP clients which request certain URLs repeatedly
I run a website on Windows Server 2008 R2. Looking through the IIS logs, I have noticed that there are some IP addresses repeatedly requesting certain URLs (such as for example /mysql/phpmyadmin/main....
- 123
10
votes
5
answers
356
views
My site was recently attacked. What do I do?
This is a first for me. One of the sites I run was recently attacked. Not at all an intelligent attack - pure brute force - hit every page and every non-page with every extension possible. Posted ...
- 297
41
votes
11
answers
2k
views
Got Hacked. Want to understand how
Someone has, for the second time, appended a chunk of javascript to a site I help run. This javascript hijacks Google adsense, inserting their own account number, and sticking ads all over.
The ...
- 1,677
0
votes
2
answers
3k
views
SMTP hacked by spammer using base64 encoding to authenticate [closed]
Over the past day we've detected someone from China using our server to send spam email. It's very likely that he's using a weak username/password to access our SMTP server, but the problem is that he ...
- 115
0
votes
2
answers
570
views
Website isolation in IIS shared environemnt?
How do I ensure website isolation in a shared environment on IIS 7 ?
basically I host multiple websites and I do not want one getting hacked, ending up in all getting hacked.
anyways I can ensure ...
Ramaz
0
votes
2
answers
972
views
smtp server in iis6/ win2003 - how to prevent hackers/spammers from using it
Anyone have any checklist for securing the smtp server on my web server so no one else can hack it and send spam fro it?
- 123
7
votes
3
answers
769
views
What is the ip range of EC2
I'd like to setup a rule to block ssh request from EC2 since I've been seeing a large amount of ssh based attack from there and was wondering if anyone knew what their IP ranges are.
EDIT:
Thank you ...
- 316
3
votes
3
answers
1k
views
Exploratory Question for Security Admins (/etc/passwd + PHP)
I've been seeing a few issues lately on a few of my servers where an account gets hacked via outdated scripts, and the hacker uploads a cPanel / FTP Brute forcing PHP script inside the account.
The ...
- 285
1
vote
4
answers
1k
views
Windows Server 2003 Hacked - Files Being Uploaded
Blank directories are being created on my Windows Server 2003 virtual server with sub directories that are weird (for example: "88ÿ ÿ ÿÿþþ þþ13þ"). It looks like they are uploading bootlegged DVDs ...
jreedinc
3
votes
1
answer
586
views
is there any valid reason for users to request phpinfo()
I'm working on writing a set of rules for fail2ban to make life a little more interesting for whoever is trying to bruteforce his way into my system. A good majority of the attempts tend to revolve ...
- 6,997
6
votes
8
answers
2k
views
(200 ok) ACCEPTED - Is this a hacking attempt?
I assume this is some type of hacking attempt. I've try to Google it but all I get are sites that look like they have been exploited already.
I'm seeing requests to one of my pages that looks like ...
- 337
18
votes
7
answers
9k
views
Should I bother to block these rather lame attempts at hacking my server?
I'm running a LAMP stack, with no phpMyAdmin (yes) installed. While poking through my Apache server logs I noticed things like:
66.184.178.58 - - [16/Mar/2010:13:27:59 +0800] "GET / HTTP/1.1" 200 ...
- 6,997
3
votes
1
answer
192
views
Should I be suspicious of this querystring?
I noticed in my application event log some errors:
Exception message: A potentially dangerous Request.QueryString value was detected from the client (term="DTİNST32")
Request URL: http://...
- 303
1
vote
2
answers
3k
views
My cPanel site was hacked - any advise on what to do? [duplicate]
My cPanel site was hacked. The attacker has changed my cPanel password. How could he do that and how can I gain access to my site back?
Thanks.
Moutaz
29
votes
1
answer
5k
views
How to do a post-mortem of a server hack
I have a Windows Server 2003 SP2 machine with IIS6, SQL Server 2005, MySQL 5 and PHP 4.3 installed on it. This is not a production machine, but it is exposed to the world via a domain name. Remote ...
- 800
4
votes
2
answers
6k
views
code injected inside PHP file with 777 permission
I woke up to find that all the folders in my shared-web-host with 777 permission had two new php file. The code inside the file could not be read - here is the decoded version: http://pastie.org/...
- 203
1
vote
2
answers
2k
views
rkhunter reports change in file properties, but I don't see that they've been updated by yum
Maybe I'm being overcautious, but I recently received the following warnings from rkhunter:
Warning: The file properties have changed:
File: /bin/dmesg
Current hash: ...
- 125
1
vote
5
answers
2k
views
Server Potentially Compromised -- c99madshell [duplicate]
So, low and behold, a legacy site we've been hosting for a client had a version of FCKEditor that allowed someone to upload the dreaded c99madshell exploit onto our web host.
I'm not a big security ...
- 519
5
votes
5
answers
1k
views
How do companies know they've been hacked?
With the news of Google and others getting hacked, I was wondering how companies find out, detect, and/or know they've been hacked in the first place?
Sure, if they find a virus/trojan on user's ...
Chad
1
vote
4
answers
1k
views
How to prevent hackers from uploading files into ftp server [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
I have been design an asp.net site with .net framework 3.5 all thing is good until my site hacked suddenly it says a chines group and ...
- 133
4
votes
6
answers
35k
views
How long do DDoS attacks last? [duplicate]
I realize the answer to this question will vary, which is why I'm asking it. If you've suffered a DDoS attack before - how long did it last?
Just trying to get an idea of how long we'll have to ...
- 391
1
vote
3
answers
508
views
Mysterious file on server - hack or something else?
Found an odd file we didn't create in one of our directories.
It was named ".moreinfoege.php.KJt"
In the directory we also had a file called moreinfo.php
We've been having server issues lately (...
- 391
2
votes
3
answers
278
views
Strange requests coming from Korean Site
Lately I've been finding a lot of strange requests like this coming to my rails app:
Processing ApplicationController#index (for 189.30.242.61 at 2009-12-14 07:38:24) [GET]
Parameters: {"_SERVER"=&...
- 133
1
vote
3
answers
2k
views
How to hack my own server?
Hello Im using Windows Server 2008 R2, yesterday I notice that my AD was not working propertly cause I cant manage users and mmc console dont allow me to work with any ad, dns relative consoles.
So I ...
2
votes
3
answers
7k
views
sudo without password?
Some strange things are happening with my Ubuntu box today as a regular (non-root user):
As soon as I log in, I can sudo without typing my password (normally, I believe I always have to type my ...
- 429
1
vote
6
answers
424
views
Appropriate response to an anonymous attempt to hack my servers
If I identify an anonymous attempt to hack my servers is there an appropriate response? Or is it a case of look at what they were attempting and make sure we're covered against it and similar attacks?
...
- 827
1
vote
2
answers
729
views
Where do I find high security dedicated servers?
I'm currently working on a project that will need to protect sensitive data. I use servers on amazon and gigenet, but I'm not sure they are the most secure alternative.
The servers must be a .net ...
- 335
7
votes
7
answers
1k
views
Website hacked again
Final Update:
Things have been peaceful for the past few weeks and taught me much more about website security and risks. Here's my version of story -
I was using an older version of wordpress and ...
- 481
0
votes
2
answers
228
views
Site compromised, has anyone seen this hack before? - googleanalyticsresearchengine.eu
One of our sites has been compromised and we have had a warning email from google. The site has been blocked by Google in Firefox, has anyone seen this type of attack before?
Of the 1 pages we tested ...
-4
votes
2
answers
321
views
How to prevent my site from hackers?
How should I protect my website from hackers adding malicious code to my html files and js files
- 149
3
votes
2
answers
3k
views
Decrypting ESP Packets with IPSEC Transport Mode if Pre-Shared Key is Known
I am reading up on IPSec, and was wondering if I could use wireshark to decrypt ESP packets from IPSEC transport mode sessions that are using a preshared key . From reading this thread, I have ...
- 84.4k
0
votes
1
answer
85
views
Ever encountered this "http://mattker.hu/images/image.php" in scripts in your site? [duplicate]
My site was hacked.
Most html and javascript files in my site were modified to included the link in the question title.
What strategies should I employ to reduce the likelihood of my site being hacked ...
- 103
3
votes
2
answers
326
views
My website is infected, I restored a backup of the uninfected files, how long will it take to un-mark as dangerous?
My website www.sagamountain.com was recently infected by a malware distributor (or at least I think it may have been).
I have removed all external content, google ads, firefly chat, etc.
I uploaded ...
- 206
3
votes
4
answers
660
views
Rogue processess in linux
I'm running Apache on Linux server. I have noticed the following processes running which I am not expecting to see, and appear rogue.
Can anyone please advise me what they mean?
Running ps aux | ...
Mark Blades
0
votes
7
answers
381
views
Can databases alone host a hack?
I was hacked recently. The hack seems to redirect any site on my server to a fake virus site. So I deleted all my website files and the hack seemed to go away. About a week later, it's back -- the ...
- 115
1
vote
2
answers
243
views
How can a sysadmin trap potential attackers?
After honeypots comes IBM's Billy Goat to lock horns with malicious coders.
So, is there any other approach to detect and collect potential attacks from malicious people?
What is your security plan ...
4
votes
1
answer
362
views
How to get the identity of the owner of a box trying to hack my server
I saw in the logs of my server that an IP was repeatedly trying to logon as sa onto my SQL Server. The ip is: 75.145.243.233 it resolves back to 5-145-243-233-richmond-va.hfc.comcastbusiness.net.
Is ...
Peter
1
vote
5
answers
439
views
Is my server being hacked? [duplicate]
Possible Duplicate:
My server's been hacked EMERGENCY
I got this weird page, which I am very sure was not created by me:
<iframe src="http://a.bad.site:8080/ts/in.cgi?pepsi106" width=125 ...
canonball09
2
votes
8
answers
1k
views
Alternative Linux Detection Methods To Detect A Compromised Host
This is a rewrite of my previous post as it was not entirely clear what I was trying to achieve. Hopefully this will make more sense :)
In a nutshell what I am looking for is alternative methods to ...
0
votes
2
answers
2k
views
Server hacked for SPAM, The BAT in X-Mailer
Our server has been hacked and I am trying to track down the cause. The server is being for SPAM purposes and it looks like IIS is being using to send the emails as the badmail and queue folder are ...
- 111
0
votes
9
answers
453
views
Are there internal Proxy Hackers?
Someone in management has suggested that our proxy has been hacked by someone on the inside.
Our proxy is set up to log each user as they access the Internet, but someone has reason to believe that ...
- 175
1
vote
2
answers
3k
views
Hits to our web server at /EWS/Exchange.asmx, is this a hack/script?
I'm getting logged error messages about hits to /EWS/Exchange.asmx (does not exist) in the root of one of our web sites on our own server (IIS6 on Windows 2003)
The server does not run exchange at ...
- 282
1
vote
2
answers
1k
views
My website was used by a freak hacker as a phishing site! What can I do?
My website was taken down a day back - got a message form the host saying that they recieved a complaint from the Bank of America that my website was being used for phishing customers. I managed to ...
- 279
6
votes
5
answers
1k
views
NAT as a firewall
Network Address Translation ( NAT ), seems to sort of act as a firewall for the hosts behind it because they are not available. Although I would never rely on this as my firewall, what are its ...
- 84.4k
0
votes
3
answers
515
views
Recover from server phishing hijack
My server was compromised last year and a phishing site was uploaded. It was detected and removed within a few days. A year later I'm still getting huge volumes of traffic to the dodgy url on my ...
James
0
votes
2
answers
1k
views
How to detect brute force in mod-security
I checked the core rules set in the mod-security but it's didn't contain the rules related to Brute-Force Attack!!! Did anyone know how to write the rules or the existing rules for this kind of Attack!...
6
votes
7
answers
4k
views
How Could My Website Be Hacked
I wonder how this could happen. Someone deleted my index.php files from all my domains and puts his own index.php files with the next message:
Hacked by Z4i0n - Fatal Error - 2009
[Fatal Error ...
- 175