4 ms·
There are many ways a site can be hacked. This could range from a silly error in one of your PHP scripts, to some other software on the server being vulnerable.
by nzmsv 17y ago
There are many ways a site can be hacked. This could range from a silly error in one of your PHP scripts, to some other software on the server being vulnerable.
Often sites are hacked by automated bots rather than an actual person. Which means you are using some popular piece of code with a vulnerability. Whatever you run, you need to keep track of security announcements for that product. Especially if it is popular, like Drupal for example. I'm not saying Drupal is bad, it's just that lots of people look for vulnerabilities in it.
Look at your server logs (assuming they are still there). This should give you a clue as to how they got access. Also, you say permissions are 755. And the owner is...?
- gaoshan 17y agomy username is displayed as the owner. I've looked at the access, error and secure logs and the only thing I see that looks odd is a GET request that contains a short (40 or 50 characters total) string of hex like \xc3\x83\etc, etc. But that request indicate it comes from msnbot. Could that be the culprit and they faked the user agent?
- noodle 17y agowhats the get request contain? and whats the variable? search the source for the variable and see what it does.
- gaoshan 17y ago/somecategory/apage.php?id=34\xc3\x83\xc6\x92\xc3\x86\xe2\x80\x99\xc3\x83\xe2\x80\x9a\xc3\x82\xc2\x9d&listing=989 Thing is, removing that hex and just putting in /somecategory/apage.php?id=34&listing=989 does the same thing. I get the same output to the browser regardless of which is used.