Questions tagged [hacking]

Hacking is the violation of server or network security via exploitation of weaknesses in that security.

Filter by
Sorted by
Tagged with
0 votes
1 answer
1k views

Someone is sending email from my address. How can I prevent this from happening

I received a bunch of Mail delivery failed: returning message to sender messages and found out that someone is sending this email to random addresses: Today we are reaching out to people, brothers ...
Toolkit's user avatar
  • 189
1 vote
1 answer
225 views

Was this a hacking attempt? (Docker container -> MariaDB)

since i am completely new to web hosting and setting up web servers, please excuse my dumb questions ;) Yesterday i uploaded my web application on digitalocean. The application is a very simple ...
chickenshifu's user avatar
0 votes
1 answer
602 views

Server Abuse/Proxy Abuse -- Automated Tunneling (Unique IP's = Hundreds, Thousands of Requests)

I run a simple Proxy/General-Use website me and a few friends use at kerenua.xyz, however, starting 3~ weeks ago, an enormous amount of traffic started flooding in from hundreds of (unique) IP ...
Riley Wells's user avatar
0 votes
2 answers
2k views

Stopping SSH brute force from China - fail2ban not working

I see things like this in my /var/log/auth.log sshd[2173]: Unable to negotiate with 218.92.0.205 port 21029: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth] sshd[1964]: ...
Woodstock's user avatar
  • 113
1 vote
2 answers
2k views

How to combat/prevent repeated unauthorized attempts to login to my postfix server?

I recently setup my first postfix server and am loving life. :) But, today I logged into the server to debug some connectivity issues that ended up being on my end, and noticed in the mail log that ...
ineedhelp's user avatar
  • 115
0 votes
0 answers
18 views

Many requests over port 445 on Ubuntu VPS, what could it mean? [duplicate]

I own a small VPS hosted by Hetzner on which i run a small Minecraft game server. The VPS is running on Ubuntu, and the only software i installed are Java JRE and the required software to run a ...
Leonardo Fiori's user avatar
0 votes
2 answers
560 views

Many HTTP CONNECT request for not owned domains

I had a cloud server with two ip, and each ip is configured respectively with apache and wildfly server. In each of them there are some domain/vhost setup in production. Checking the apache access ...
Giuseppe's user avatar
0 votes
0 answers
142 views

(404 Errors) Why are hackers looking for directories named "/najwutoanfga/" and other 10-12 char strings of random letters?

I was looking through the 404 errors of my nginx logs today to see what the hackers are trying to do on my website. I usued this command: cat access.log | grep '404' I saw the usual requests for ...
hexagonponytail's user avatar
1 vote
0 answers
134 views

Very slow server and straight entries in error.log

I am running ubuntu 16.04 and suddenly over the last 2 days my server is basically at a stand still, I have upgraded everything and cleaned my error.log. I rebooted the server and about about 5mins ...
Jamie Hutber's user avatar
1 vote
2 answers
823 views

How are hackers getting into our server without brute-force? [duplicate]

I am a web developer and we have no one specialising in the wellbeing of the server or the network currently at our office. Usually I can sort many of the issues that arise with my basic knowledge but ...
Emma's user avatar
  • 11
0 votes
2 answers
3k views

local mysql was hacked with ransomware hack. How to check if database data was downloaded?

I had a test mysql database running on Vagrant dev box. Turns out the network wasn't that secure. All of the databases were deleted (and replaced with a DB ransomware note) and in the logs I can see ...
BrocolliRob's user avatar
0 votes
1 answer
418 views

Post request with host = "><script>alert('qualys_xss_joomla_2.5.3')</script>

On my web server Yesterday I have caught a POST request with following text for a host "><script>alert('qualys_xss_joomla_2.5.3')</script> in full it was like this headers { ... ...
Yevgeniy Afanasyev's user avatar
2 votes
1 answer
2k views

Suspicious ssh log entries (“Accepted none for anonymous”)

I got this log entry chain (and similar repeatedly) on my server: Nov 24 07:38:59 server sshd[28676]: SSH: Server;Ltype: Version;Remote: 54.38.81.12-40482;Protocol: 2.0;Client: OpenSSH_7.2p2 Ubuntu-...
Cigydd's user avatar
  • 21
0 votes
1 answer
389 views

Vulnerability risk in modern vlans

I'm looking at using VLAN to separate some traffic without buying a bunch of switches for two or three devices. The plan is to use untagged ports for dedicated lans with an external router connecting ...
Matthew Good's user avatar
3 votes
1 answer
1k views

Catch backslashes, single and double quotes in GET requests

According to this SQL Injection Basics article: <…> the operations mostly used for breaking\fuzzing the SQL query’s are. ' Single quote " Double Quote \ Backslash (MySQL Escape ...
ᴍᴇʜᴏᴠ's user avatar
1 vote
3 answers
7k views

Someone just trying to hack me? login.cgi+wget

I'm build a new server on Apache, actually I am learning, so I'm trying different things. My security system is already done, but of course I may miss something, or, if not, I do understand that today ...
Robbie KN's user avatar
  • 113
0 votes
0 answers
129 views

how to find the source of mail (host<->lxc container)

One of my lxc-containers is mail server. the others and the host use it to communicate with the world. But something is using my mail server to sending mails. I found, that mail server receives it ...
SledgehammerPL's user avatar
0 votes
1 answer
2k views

How can a hacker compromising the www-data user account install a rootkit?

Recently a site of mine was hacked. For sure the attacker can execute PHP and start an interactive shell, etc. I understand a hacker can delete files, or delete DB, the site folder, write in the cron ...
Beto Aveiga's user avatar
6 votes
1 answer
1k views

Apache 2.4 log PHP command 200 success, but what is it doing? POST /?q=die('z!a'.'x'); etc

I am running a CentOS 7.x VPS with Apache 2.4.29 and PHP 7.0.28 and I started seeing the following in my logs. I have php.ini secured as best as I can from articles online for a while now, but I am ...
Tim's user avatar
  • 203
1 vote
1 answer
117 views

Why is kjournald showing up 700 times in `netstat`?

AFAIK, kjournald is not a network program, but a program that deals with the journal of EXT3 (I am running EXT4 on Ubuntu 16.04). Still, when running sudo netstap -tapn it shows up almost 700 times, ...
oligofren's user avatar
  • 641
3 votes
2 answers
349 views

How can I keep one hacked website on my server from compromising the other websites?

I'm a teaching assistant in software security and running a server that is vulnerable by design. It's an nginx server, and it has 40 ports open. Each port serves a web application, and all the web ...
Magnus's user avatar
  • 255
1 vote
0 answers
57 views

99% wa shell locks up, load at 19 crashed root filesystem?

I suspect my root file system crashed. tail /var/log/syslog => locks dmesg doesn't show anything interesting I figure I can reboot and rebuild the system if necessary as its imaged, however I'm ...
encore2097's user avatar
5 votes
2 answers
3k views

Why is IPScan detected as a virus?

Does anyone have a definitive answer to why Angry IP Scanner (IPScan) is detected as a virus (hacktool) by so many antivirus vendors, while similar tools such as Nmap and Advanced IP Scanner are not? ...
DarkMoon's user avatar
  • 1,059
1 vote
1 answer
325 views

Why do strange domains connect to my server?

I have set up a simple Windows 2012 webserver and developed a ASP.NET/MVC website that basically handles any requests to the default website and writes a message to a log database if the domain is ...
Wim ten Brink's user avatar
0 votes
1 answer
70 views

Site hacked, need help to look for clues about how it happened [duplicate]

i recognized a successful hacking attempt where someone managed somehow to modify a file under my drupal installation and to inject javascript code the file that was hacked was :jquery-1.9.1.min.js ...
Jacob's user avatar
  • 1
3 votes
2 answers
146 views

How do you get Google to update the index of your site after recovering from a hack?

I have a website that I took over as webmaster. It was in WordPress and was hacked and had thousands of SPAM pages injected to the website. These pages were indexed by Google and in the end had the ...
Denver Chiwakira's user avatar
-1 votes
1 answer
2k views

Windows Server 2012: easiest way to monitor ports for error 4625 NTLM attacks

I'm getting thousands of hack attacks on a Windows server resulting in Security log error 4625 entries. Hackers are using random IPs, so the usual RDPguard, Syspeace, etc. tools don't work. Port 3389 ...
serverfault's user avatar
0 votes
0 answers
85 views

Why has the icon for my website changed on its own?

I installed the lamp stack on a Linode at the beginning of the year. It's just a personal website, accessed by IP address, so I doubt anyone else knows of it. Recently the icon (next to the website's ...
Ginger's user avatar
  • 103
0 votes
0 answers
650 views

FTP Server keeps getting connections from router every few seconds

Background / Network Structure The are two layers of routers. The router at the outer layer has public Internet IP 123.123.123.123 (fake as example) and private IP 192.168.11.1. The router at the ...
midnite's user avatar
  • 151
15 votes
1 answer
4k views

Potential hijacked SSH session & SSH best practices

I'm freaking out a little bit at the moment. I am SSHing into a remote server that I have recently commissioned. I'm doing this as root. I have installed fail2ban and had a massive amount of banned ...
MarMan29's user avatar
  • 343
-3 votes
1 answer
343 views

Please help identify any weird processes [duplicate]

I'm in need of a hand. We recently had a server compromise and manage to do a nice clean but I'm trying to get rid of the bug without moving server. Can anybody review the running processes below ...
Django Black's user avatar
1 vote
2 answers
1k views

MySQL hacked on AWS AMI: 'Pay to get data back' - how could this be possible and how to avoid it next time?

Today morning I noticed that some of the websites I host on a EC2 instance aren't working. When I verified the MySql database, it was wiped out! :( The only thing I have found was only a record ...
Edmond Tamas's user avatar
0 votes
0 answers
37 views

Hacked by [email protected] [duplicate]

I was happily working on my Azure VM playpen last night via a remote desktop session. When I logged on this morning I was presented with the attached message: The VM contained nothing of value and ...
tr0users's user avatar
  • 423
24 votes
3 answers
3k views

What can be learned about a user from a failed SSH attempt?

What can be learned about a 'user' from a failed malicious SSH attempt? User name entered (/var/log/secure) Password entered (if configured, i.e. by using a PAM module) Source IP address (/var/log/...
Exbi's user avatar
  • 373
0 votes
0 answers
22 views

Spam sending on my machine with not write on log of exim and ASSP [duplicate]

This question it's diferent to How do I deal with a compromised server? Obviously the server has a security commitment. But this question presents some specific and not generic issues, as generic and ...
abkrim's user avatar
  • 416
0 votes
1 answer
359 views

User root dissapear [duplicate]

I have a debian 8 box. It is a plesk server with 90+ websites. It seems somebody access to my server and delete the user root. I go to /etc/passwd and the file is not owned by root:root is owned by ...
D. Ramoray's user avatar
31 votes
4 answers
8k views

Weird SSH, Server security, I might have been hacked

I am not sure if I've been hacked or not. I tried to log in through SSH and it wouldn't accept my password. Root login is disabled so I went to rescue and turned root login on and was able to log in ...
PhysiOS's user avatar
  • 432
0 votes
1 answer
1k views

Prevent nginx to execute images as PHP script

My website has been compromized by an user who uploaded an image with PHP code in it. This code allows to upload files, and he uploaded a malicious PHP script. He was able to call his "image-php" ...
Patator's user avatar
  • 151
2 votes
2 answers
1k views

Someone try to hack my server

I have a linux machine running as a test server. My box redirects my port like 80 directly on this machine. I created it to train all kind of things (raid, tcp...). Recently I tried to connect to my ...
M. Ozn's user avatar
  • 123
1 vote
1 answer
682 views

Server hacked, 301 redirect, domain lost?

My Ubuntu 16.04 with a new, up to date Wordpress installation (with only one or two Plugins) was hacked. I initiated a new server installation to get rid of anything bad. It seems like nothing really ...
vellip's user avatar
  • 13
-1 votes
1 answer
323 views

Apache being hit by requests (cpu 100%)

recently we moved to a new host (DO) for one of my client after being on a shared account . I was monitoring the cpu and it was always at 100% , knowing that the site dosnt get a lot of traffic , ...
Tarek's user avatar
  • 101
10 votes
1 answer
1k views

Security Wordpress on IIS hosted sites.

Since yesterday I,ve got strange things happening on one of my websites. The index.php of my wordpress site on IIS changed from 1 kb to 80 KB. Also map.xml and sitemap.xml are new in the directory. ...
Lt Lev's user avatar
  • 101
0 votes
1 answer
296 views

Detecting unauthorized changes to my Linux server

I had a thought and would be interested in seeing it is passes the sniff test by smarter folks here. I have a web-facing server. I'll call it WEB1. I believe I have taken the standard precautions and ...
MonkeyFarmer's user avatar
1 vote
1 answer
175 views

Why are there so many attacks on a specific server?

I have a couple of web-servers running, and one of them have received 6000 attemps to gain access in the past 6 months. The other practically none. Is this a coincidence, or is there something that ...
C.A. Vuyk's user avatar
  • 632
1 vote
1 answer
71 views

unknown mail going from my mail box , cant see while sending it

When I send mail from outlook an extra mail is being generated and send to an unknown id . Why does this happen and how can this be prevented.
pckabeer's user avatar
1 vote
2 answers
236 views

ISP is DNS Hijacking. Updated DNS to Google OpenDNS, but still hijacked [closed]

I'm visiting India, and saw that their main provider, Airtel, limits the entirety of the internet to just a small handful of websites festooned with their own advertisements, and annoying redirects. ...
Trip's user avatar
  • 205
-3 votes
1 answer
358 views

Hacking attempt from Googlebot [closed]

Today I found this in my server log: 66.249.64.140 crawl-66-249-64-140.googlebot.com [22/Sep/2016:11:23:30 +0300] "GET /C/Users/%EF%BF%BD%C3%8A/Documents/%EF%BF%BD%EF%BF%BD%EF%BF%BD%C3%AF/Documents/...
Uzgraph's user avatar
0 votes
2 answers
191 views

Second Site in a week on our Server hacked. How?

We are a hosting Company for customers and never had problems. Now, the second customer site was "hacked" in one week. Our passwords should be safe and we change them often, instead I think there were ...
xTheWolf's user avatar
  • 101
23 votes
4 answers
19k views

Someone is trying to brute force SSH access to my server [duplicate]

By coincidence I looked at my servers ssh log (/var/log/auth.log) and I noticed that someone is constantly trying to gain access: Sep 7 13:03:45 virt01 sshd[14674]: pam_unix(sshd:auth): ...
Vingtoft's user avatar
  • 1,597
2 votes
0 answers
487 views

Strange hack attempt to postfix

Yesterday I got a email sent {@DOMAIN.ORG from my mailserver the mail was marked as spam. The body included scripts download commands like ftp://ftp.ugotownedz.org/upfile2.sh lines from syslog Aug ...
RubbelDeCatc's user avatar

1
2
3 4 5
10