Questions tagged [hacking]
Hacking is the violation of server or network security via exploitation of weaknesses in that security.
482
questions
0
votes
1
answer
1k
views
Someone is sending email from my address. How can I prevent this from happening
I received a bunch of Mail delivery failed: returning message to sender messages and found out that someone is sending this email to random addresses:
Today we are reaching out to people, brothers ...
1
vote
1
answer
225
views
Was this a hacking attempt? (Docker container -> MariaDB)
since i am completely new to web hosting and setting up web servers, please excuse my dumb questions ;)
Yesterday i uploaded my web application on digitalocean. The application is a very simple ...
0
votes
1
answer
602
views
Server Abuse/Proxy Abuse -- Automated Tunneling (Unique IP's = Hundreds, Thousands of Requests)
I run a simple Proxy/General-Use website me and a few friends use at kerenua.xyz, however, starting 3~ weeks ago, an enormous amount of traffic started flooding in from hundreds of (unique) IP ...
0
votes
2
answers
2k
views
Stopping SSH brute force from China - fail2ban not working
I see things like this in my /var/log/auth.log
sshd[2173]: Unable to negotiate with 218.92.0.205 port 21029: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth]
sshd[1964]: ...
1
vote
2
answers
2k
views
How to combat/prevent repeated unauthorized attempts to login to my postfix server?
I recently setup my first postfix server and am loving life. :)
But, today I logged into the server to debug some connectivity issues that ended up being on my end, and noticed in the mail log that ...
0
votes
0
answers
18
views
Many requests over port 445 on Ubuntu VPS, what could it mean? [duplicate]
I own a small VPS hosted by Hetzner on which i run a small Minecraft game server. The VPS is running on Ubuntu, and the only software i installed are Java JRE and the required software to run a ...
0
votes
2
answers
560
views
Many HTTP CONNECT request for not owned domains
I had a cloud server with two ip, and each ip is configured respectively with apache and wildfly server. In each of them there are some domain/vhost setup in production.
Checking the apache access ...
0
votes
0
answers
142
views
(404 Errors) Why are hackers looking for directories named "/najwutoanfga/" and other 10-12 char strings of random letters?
I was looking through the 404 errors of my nginx logs today to see what the hackers are trying to do on my website.
I usued this command:
cat access.log | grep '404'
I saw the usual requests for ...
1
vote
0
answers
134
views
Very slow server and straight entries in error.log
I am running ubuntu 16.04 and suddenly over the last 2 days my server is basically at a stand still, I have upgraded everything and cleaned my error.log.
I rebooted the server and about about 5mins ...
1
vote
2
answers
823
views
How are hackers getting into our server without brute-force? [duplicate]
I am a web developer and we have no one specialising in the wellbeing of the server or the network currently at our office. Usually I can sort many of the issues that arise with my basic knowledge but ...
0
votes
2
answers
3k
views
local mysql was hacked with ransomware hack. How to check if database data was downloaded?
I had a test mysql database running on Vagrant dev box. Turns out the network wasn't that secure.
All of the databases were deleted (and replaced with a DB ransomware note) and in the logs I can see ...
0
votes
1
answer
418
views
Post request with host = "><script>alert('qualys_xss_joomla_2.5.3')</script>
On my web server
Yesterday I have caught a POST request with following text for a host
"><script>alert('qualys_xss_joomla_2.5.3')</script>
in full it was like this
headers
{
...
...
2
votes
1
answer
2k
views
Suspicious ssh log entries (“Accepted none for anonymous”)
I got this log entry chain (and similar repeatedly) on my server:
Nov 24 07:38:59 server sshd[28676]: SSH: Server;Ltype: Version;Remote: 54.38.81.12-40482;Protocol: 2.0;Client: OpenSSH_7.2p2 Ubuntu-...
0
votes
1
answer
389
views
Vulnerability risk in modern vlans
I'm looking at using VLAN to separate some traffic without buying a bunch of switches for two or three devices. The plan is to use untagged ports for dedicated lans with an external router connecting ...
3
votes
1
answer
1k
views
Catch backslashes, single and double quotes in GET requests
According to this SQL Injection Basics article:
<…> the operations mostly used for breaking\fuzzing the SQL query’s are.
' Single quote
" Double Quote
\ Backslash (MySQL Escape ...
1
vote
3
answers
7k
views
Someone just trying to hack me? login.cgi+wget
I'm build a new server on Apache, actually I am learning, so I'm trying different things. My security system is already done, but of course I may miss something, or, if not, I do understand that today ...
0
votes
0
answers
129
views
how to find the source of mail (host<->lxc container)
One of my lxc-containers is mail server. the others and the host use it to communicate with the world.
But something is using my mail server to sending mails. I found, that mail server receives it ...
0
votes
1
answer
2k
views
How can a hacker compromising the www-data user account install a rootkit?
Recently a site of mine was hacked. For sure the attacker can execute PHP and start an interactive shell, etc.
I understand a hacker can delete files, or delete DB, the site folder, write in the cron ...
6
votes
1
answer
1k
views
Apache 2.4 log PHP command 200 success, but what is it doing? POST /?q=die('z!a'.'x'); etc
I am running a CentOS 7.x VPS with Apache 2.4.29 and PHP 7.0.28 and I started seeing the following in my logs. I have php.ini secured as best as I can from articles online for a while now, but I am ...
1
vote
1
answer
117
views
Why is kjournald showing up 700 times in `netstat`?
AFAIK, kjournald is not a network program, but a program that deals with the journal of EXT3 (I am running EXT4 on Ubuntu 16.04). Still, when running sudo netstap -tapn it shows up almost 700 times, ...
3
votes
2
answers
349
views
How can I keep one hacked website on my server from compromising the other websites?
I'm a teaching assistant in software security and running a server that is vulnerable by design.
It's an nginx server, and it has 40 ports open. Each port serves a web application, and all the web ...
1
vote
0
answers
57
views
99% wa shell locks up, load at 19 crashed root filesystem?
I suspect my root file system crashed.
tail /var/log/syslog => locks
dmesg doesn't show anything interesting
I figure I can reboot and rebuild the system if necessary as its imaged, however I'm ...
5
votes
2
answers
3k
views
Why is IPScan detected as a virus?
Does anyone have a definitive answer to why Angry IP Scanner (IPScan) is detected as a virus (hacktool) by so many antivirus vendors, while similar tools such as Nmap and Advanced IP Scanner are not? ...
1
vote
1
answer
325
views
Why do strange domains connect to my server?
I have set up a simple Windows 2012 webserver and developed a ASP.NET/MVC website that basically handles any requests to the default website and writes a message to a log database if the domain is ...
0
votes
1
answer
70
views
Site hacked, need help to look for clues about how it happened [duplicate]
i recognized a successful hacking attempt where someone managed somehow to modify a file under my drupal installation and to inject javascript code
the file that was hacked was :jquery-1.9.1.min.js ...
3
votes
2
answers
146
views
How do you get Google to update the index of your site after recovering from a hack?
I have a website that I took over as webmaster. It was in WordPress and was hacked and had thousands of SPAM pages injected to the website. These pages were indexed by Google and in the end had the ...
-1
votes
1
answer
2k
views
Windows Server 2012: easiest way to monitor ports for error 4625 NTLM attacks
I'm getting thousands of hack attacks on a Windows server resulting in Security log error 4625 entries. Hackers are using random IPs, so the usual RDPguard, Syspeace, etc. tools don't work. Port 3389 ...
0
votes
0
answers
85
views
Why has the icon for my website changed on its own?
I installed the lamp stack on a Linode at the beginning of the year. It's just a personal website, accessed by IP address, so I doubt anyone else knows of it.
Recently the icon (next to the website's ...
0
votes
0
answers
650
views
FTP Server keeps getting connections from router every few seconds
Background / Network Structure
The are two layers of routers. The router at the outer layer has public Internet IP 123.123.123.123 (fake as example) and private IP 192.168.11.1. The router at the ...
15
votes
1
answer
4k
views
Potential hijacked SSH session & SSH best practices
I'm freaking out a little bit at the moment. I am SSHing into a remote server that I have recently commissioned. I'm doing this as root. I have installed fail2ban and had a massive amount of banned ...
-3
votes
1
answer
343
views
Please help identify any weird processes [duplicate]
I'm in need of a hand. We recently had a server compromise and manage to do a nice clean but I'm trying to get rid of the bug without moving server.
Can anybody review the running processes below ...
1
vote
2
answers
1k
views
MySQL hacked on AWS AMI: 'Pay to get data back' - how could this be possible and how to avoid it next time?
Today morning I noticed that some of the websites I host on a EC2 instance aren't working. When I verified the MySql database, it was wiped out! :( The only thing I have found was only a record ...
0
votes
0
answers
37
views
Hacked by [email protected] [duplicate]
I was happily working on my Azure VM playpen last night via a remote desktop session. When I logged on this morning I was presented with the attached message:
The VM contained nothing of value and ...
24
votes
3
answers
3k
views
What can be learned about a user from a failed SSH attempt?
What can be learned about a 'user' from a failed malicious SSH attempt?
User name entered (/var/log/secure)
Password entered (if configured, i.e. by using a PAM module)
Source IP address (/var/log/...
0
votes
0
answers
22
views
Spam sending on my machine with not write on log of exim and ASSP [duplicate]
This question it's diferent to How do I deal with a compromised server?
Obviously the server has a security commitment. But this question presents some specific and not generic issues, as generic and ...
0
votes
1
answer
359
views
User root dissapear [duplicate]
I have a debian 8 box. It is a plesk server with 90+ websites.
It seems somebody access to my server and delete the user root. I go to /etc/passwd and the file is not owned by root:root is owned by ...
31
votes
4
answers
8k
views
Weird SSH, Server security, I might have been hacked
I am not sure if I've been hacked or not.
I tried to log in through SSH and it wouldn't accept my password. Root login is disabled so I went to rescue and turned root login on and was able to log in ...
0
votes
1
answer
1k
views
Prevent nginx to execute images as PHP script
My website has been compromized by an user who uploaded an image with PHP code in it. This code allows to upload files, and he uploaded a malicious PHP script.
He was able to call his "image-php" ...
2
votes
2
answers
1k
views
Someone try to hack my server
I have a linux machine running as a test server. My box redirects my port like 80 directly on this machine. I created it to train all kind of things (raid, tcp...).
Recently I tried to connect to my ...
1
vote
1
answer
682
views
Server hacked, 301 redirect, domain lost?
My Ubuntu 16.04 with a new, up to date Wordpress installation (with only one or two Plugins) was hacked. I initiated a new server installation to get rid of anything bad.
It seems like nothing really ...
-1
votes
1
answer
323
views
Apache being hit by requests (cpu 100%)
recently we moved to a new host (DO) for one of my client after being on a shared account .
I was monitoring the cpu and it was always at 100% , knowing that the site dosnt get a lot of traffic , ...
10
votes
1
answer
1k
views
Security Wordpress on IIS hosted sites.
Since yesterday I,ve got strange things happening on one of my websites.
The index.php of my wordpress site on IIS changed from 1 kb to 80 KB. Also map.xml and sitemap.xml are new in the directory. ...
0
votes
1
answer
296
views
Detecting unauthorized changes to my Linux server
I had a thought and would be interested in seeing it is passes the sniff test by smarter folks here.
I have a web-facing server. I'll call it WEB1. I believe I have taken the standard precautions and ...
1
vote
1
answer
175
views
Why are there so many attacks on a specific server?
I have a couple of web-servers running, and one of them have received 6000 attemps to gain access in the past 6 months.
The other practically none.
Is this a coincidence, or is there something that ...
1
vote
1
answer
71
views
unknown mail going from my mail box , cant see while sending it
When I send mail from outlook an extra mail is being generated and send to an unknown id . Why does this happen and how can this be prevented.
1
vote
2
answers
236
views
ISP is DNS Hijacking. Updated DNS to Google OpenDNS, but still hijacked [closed]
I'm visiting India, and saw that their main provider, Airtel, limits the entirety of the internet to just a small handful of websites festooned with their own advertisements, and annoying redirects.
...
-3
votes
1
answer
358
views
Hacking attempt from Googlebot [closed]
Today I found this in my server log:
66.249.64.140 crawl-66-249-64-140.googlebot.com [22/Sep/2016:11:23:30 +0300] "GET /C/Users/%EF%BF%BD%C3%8A/Documents/%EF%BF%BD%EF%BF%BD%EF%BF%BD%C3%AF/Documents/...
0
votes
2
answers
191
views
Second Site in a week on our Server hacked. How?
We are a hosting Company for customers and never had problems. Now, the second customer site was "hacked" in one week. Our passwords should be safe and we change them often, instead I think there were ...
23
votes
4
answers
19k
views
Someone is trying to brute force SSH access to my server [duplicate]
By coincidence I looked at my servers ssh log (/var/log/auth.log) and I noticed that someone is constantly trying to gain access:
Sep 7 13:03:45 virt01 sshd[14674]: pam_unix(sshd:auth): ...
2
votes
0
answers
487
views
Strange hack attempt to postfix
Yesterday I got a email sent {@DOMAIN.ORG from my mailserver the mail was marked as spam.
The body included scripts download commands like ftp://ftp.ugotownedz.org/upfile2.sh
lines from syslog
Aug ...