Attempted Hacking? WTF can I do to stop this? - GoFuckYourself.com

jmcb420 · 07-05-2009, 10:59 AM

I took a few minutes to look at traffic on one of my bigger sites and noticed a huge increase in my 404 traffic on that site. 404's are already double this month what they were last month, that raised a red flag

.
So I checked it out. the SE's still list around 20 pages that no longer exist, and that is my normal 404 traffic. Nothing to care about at all.
Then I found these urls that do not and never have existed:

Required but not found URLs (HTTP code 404):

/krheupfile_flash.asp
/suozftp.rar
/srestmdqq.asp
/arknmirserver.rar
/xmwywebeditor/ewebeditor.asp
/pjhkplus/infosearch.php

What do you guys make of it? Hacking attempt? Thats my thought, but whats more is i've never been proactive in stopping anything like this beyond going with a decent host.

Anything I can do to safeguard myself from a low level attempt such as this?

Thanks in advance.

Phoenix · 07-05-2009, 11:01 AM

hit up your host...maybe they can help

roly · 07-05-2009, 11:05 AM

Quote:

Originally Posted by jmcb420

I took a few minutes to look at traffic on one of my bigger sites and noticed a huge increase in my 404 traffic on that site. 404's are already double this month what they were last month, that raised a red flag

.
So I checked it out. the SE's still list around 20 pages that no longer exist, and that is my normal 404 traffic. Nothing to care about at all.
Then I found these urls that do not and never have existed:

Required but not found URLs (HTTP code 404):

/krheupfile_flash.asp
/suozftp.rar
/srestmdqq.asp
/arknmirserver.rar
/xmwywebeditor/ewebeditor.asp
/pjhkplus/infosearch.php

What do you guys make of it? Hacking attempt? Thats my thought, but whats more is i've never been proactive in stopping anything like this beyond going with a decent host.

Anything I can do to safeguard myself from a low level attempt such as this?

Thanks in advance.

don't recognise any of those, but i get lots of similar requests for non existant urls on my servers and i think they are looking to see if you have certain scripts installed that they know have vulnerabilities that they can hack. it's nothing to worry about, unless someone knows different?

jmcb420 · 07-05-2009, 11:09 AM

Quote:

Originally Posted by Phoenix

hit up your host...maybe they can help

I already went there, they of course told me (without going into much detail) that "on thier end they have evey measure in place to protect my sites in the event of an attack."

I would say that if a client were asking me that question and my biz was hosting thier network.

Shit sometimes happens, you know? i'm a bit worried

HouseHead · 07-05-2009, 11:10 AM

Yea contact your host man..

Merrioc · 07-05-2009, 11:32 AM

it looks like simple exploit scanning. There isn't to much preventative that could be done.

unless your seeing actual load problems from this I wouldn't wast energy on it. If your really paranoid you could write some for of script to determine the number of 404 requests sent by a script kiddie, determine a threshold and drop them at the firewall level.

seeandsee · 07-05-2009, 11:50 AM

they do it across many sites looking for exploits, don't know how to block that

Klen · 07-05-2009, 12:03 PM

Yes looks like either exploit scanning or warez scanning (they looking for hosts with upload permissions where they can upload files).But more likely exploit scanning

jmcb420 · 07-05-2009, 12:03 PM

Quote:

Originally Posted by Merrioc

it looks like simple exploit scanning. There isn't to much preventative that could be done.

unless your seeing actual load problems from this I wouldn't wast energy on it. If your really paranoid you could write some for of script to determine the number of 404 requests sent by a script kiddie, determine a threshold and drop them at the firewall level.

Everything on the site and in my network loads fine and works like it should.

For peace of mind I should learn more about this from his point of view, learn a few tricks and try to hack my own stuff then learn what I can do to prevent others from being sucessful in the event that I should.

At the same time, I should install a 3 strikes your out script. Although, thats gonna take me learning new stuff too. Damnit.

For the most part it looks like I dont have to worry. Thanks for the input everyone, much appreciated.

Carmine Raguso · 07-05-2009, 03:21 PM

1.) Create the nonexistent pages they are scanning for on your server

2.) Become an affiliate for one of the bullshit scam antivirus companies

3.) Have pages autoinstall trojans

4.) ???????

5.) Profit.

fris · 07-05-2009, 03:59 PM

have your isp add the ip ranges to their firewall rules

psili · 07-05-2009, 04:12 PM

Don't know if it exists, but maybe for an added piece of mind:
- Take a recursive directory snapshot of known files you want / power your stuff.
- Every once in a while, take new snapshots and compare to the baseline.
- If there's a "new" file that looks amiss, research it.

Don't know if there's an automated solution that does that, and if so, unless it scans file contents, won't really help if someone's modified a pre-existing file.

Anyway. Just throwing my nonsense out there.

Babaganoosh · 07-05-2009, 04:16 PM

Just ignore it. Almost all of my sites get scanned for that crap. If you're using 3rd party scripts that you aren't sure about, .htaccess them to keep out the riff-raff.

CYF · 07-05-2009, 04:20 PM

Quote:

Originally Posted by psili

Don't know if it exists, but maybe for an added piece of mind:
- Take a recursive directory snapshot of known files you want / power your stuff.
- Every once in a while, take new snapshots and compare to the baseline.
- If there's a "new" file that looks amiss, research it.

Don't know if there's an automated solution that does that, and if so, unless it scans file contents, won't really help if someone's modified a pre-existing file.

Anyway. Just throwing my nonsense out there.

If you're running unix I believe you're thinking of Tripwire.

07-05-2009, 04:25 PM

Not hard, all you have to do is create a link on a search engine crawled page with some random page that doesn't exist on your server, it it will come back 404 by the search engines.

Net Money · 07-05-2009, 04:25 PM

Quote:

Originally Posted by jmcb420

I already went there, they of course told me (without going into much detail) that "on thier end they have evey measure in place to protect my sites in the event of an attack."

I would say that if a client were asking me that question and my biz was hosting thier network.

Shit sometimes happens, you know? i'm a bit worried

You're at the wrong host dude. Any good host would tace it down and block them for you.

~Ray · 07-05-2009, 04:35 PM

have a script written to place on pages named after the exploits on your server, chmod your htaccess to allow your server to modify the htaccess file. Each time someone request one of those pages, the script will record their ip, and bann it by adding it to the htaccess file.

d-null · 07-05-2009, 10:25 PM

Quote:

Originally Posted by Carmine Raguso

1.) Create the nonexistent pages they are scanning for on your server

2.) Become an affiliate for one of the bullshit scam antivirus companies

3.) Have pages autoinstall trojans

4.) ???????

5.) Profit.

V_RocKs · 07-05-2009, 11:07 PM

Worrying about this is like worrying about the sky falling...

What they are doing is akin to fishing. If you are a fish and you don't want to get eaten, don't eat worms...

Other than that... Nothing to worry about.

niche25 · 07-05-2009, 11:30 PM

Google Webmaster tools is your friend. Remove pages in GWT, notify host, get a firewall & check shit regularly.

It is extremely rare I get hacked now and when I do its a quick turn around. A couple years ago I was getting hit regularly. Karma for me I guess LOL.

roly · 07-06-2009, 01:21 AM

Quote:

Originally Posted by Net Money

You're at the wrong host dude. Any good host would tace it down and block them for you.

why would they bother? it would be a never ending battle, this goes on all day, every day. as long as you haven't got outdated scripts and stuff with known exploits your safe (from the people who are scanning for this).

Iron Fist · 07-06-2009, 02:03 AM

Quote:

Originally Posted by Carmine Raguso

1.) Create the nonexistent pages they are scanning for on your server

2.) Become an affiliate for one of the bullshit scam antivirus companies

3.) Have pages autoinstall trojans

4.) ???????

5.) Profit.

Can you knock that down to 3 steps please? kthxbye.

HerPimp · 07-06-2009, 02:07 AM

Quote:

Originally Posted by fris

have your isp add the ip ranges to their firewall rules

i agree

milambur · 07-06-2009, 02:26 AM

IP banning is never a good solution, they use botnets that have millions of infected computers, you risk blocking out a lot of potential customers in the long run.
To be safer, use custom scripts that are coded to handle malicious input. If you have to use a script that is commonly available, make sure you always have the latest updates.

spook · 07-06-2009, 02:40 AM

looks like its just skiddies scanning for holes. Adding their ip's manually will be a pain in the arse if they are using proxies (which they most times do). Best thing to do is just make sure all your scripts and your box is up to date. Also you could install mod_security if you haven't already (but if you install it, get someone who knows what they are doing to tune it for you).

07-05-2009, 10:59 AM	#1
jmcb420 So Fucking Drunk Industry Role: Join Date: Oct 2006 Posts: 2,155	Attempted Hacking? WTF can I do to stop this? I took a few minutes to look at traffic on one of my bigger sites and noticed a huge increase in my 404 traffic on that site. 404's are already double this month what they were last month, that raised a red flag. So I checked it out. the SE's still list around 20 pages that no longer exist, and that is my normal 404 traffic. Nothing to care about at all. Then I found these urls that do not and never have existed: Required but not found URLs (HTTP code 404): /krheupfile_flash.asp /suozftp.rar /srestmdqq.asp /arknmirserver.rar /xmwywebeditor/ewebeditor.asp /pjhkplus/infosearch.php What do you guys make of it? Hacking attempt? Thats my thought, but whats more is i've never been proactive in stopping anything like this beyond going with a decent host. Anything I can do to safeguard myself from a low level attempt such as this? Thanks in advance. __________________ I'm funner than AIDS, and easier to explain to your parents.

07-05-2009, 11:01 AM	#2
Phoenix BACON BACON BACON Industry Role: Join Date: Nov 2002 Location: Poems everybody, the laddie fancies himself a poet Posts: 35,457	hit up your host...maybe they can help __________________ Skype Phoenixskype1 Telegram PhoenixBrad https://quantads.io

07-05-2009, 11:10 AM	#5
HouseHead Confirmed User Join Date: Aug 2003 Location: Aim - Hydromorphone Posts: 5,539	Yea contact your host man.. __________________ The Sexiest place to Buy & Sell Adult Ads - JuicyAds is where YOUR profits matter! ---> SPOTS AVAILABLE :\|: SIGN UP RIGHT NOW <---

07-05-2009, 11:50 AM	#7
seeandsee Check SIG! Industry Role: Join Date: Mar 2006 Location: Europe (Skype: gojkoas) Posts: 50,945	they do it across many sites looking for exploits, don't know how to block that __________________ BUY MY SIG - 50$/Year Contact here

07-05-2009, 03:59 PM	#11
fris Too lazy to set a custom title Industry Role: Join Date: Aug 2002 Posts: 55,248	have your isp add the ip ranges to their firewall rules __________________ Since 1999: 69 Adult Industry awards for Best Hosting Company and professional excellence. WP Stuff

07-05-2009, 11:32 AM	#6
Merrioc Confirmed User Join Date: Jul 2003 Posts: 249	it looks like simple exploit scanning. There isn't to much preventative that could be done. unless your seeing actual load problems from this I wouldn't wast energy on it. If your really paranoid you could write some for of script to determine the number of 404 requests sent by a script kiddie, determine a threshold and drop them at the firewall level.

07-05-2009, 12:03 PM	#8
Klen Industry Role: Join Date: Aug 2006 Location: Little Vienna Posts: 32,235	Yes looks like either exploit scanning or warez scanning (they looking for hosts with upload permissions where they can upload files).But more likely exploit scanning

07-05-2009, 03:21 PM	#10
Carmine Raguso So Fucking Banned Join Date: Dec 2008 Location: Prescott, AZ Posts: 2,158	1.) Create the nonexistent pages they are scanning for on your server 2.) Become an affiliate for one of the bullshit scam antivirus companies 3.) Have pages autoinstall trojans 4.) ??????? 5.) Profit.

07-05-2009, 04:12 PM	#12
psili Confirmed User Join Date: Apr 2003 Location: Loveland, CO Posts: 5,526	Don't know if it exists, but maybe for an added piece of mind: - Take a recursive directory snapshot of known files you want / power your stuff. - Every once in a while, take new snapshots and compare to the baseline. - If there's a "new" file that looks amiss, research it. Don't know if there's an automated solution that does that, and if so, unless it scans file contents, won't really help if someone's modified a pre-existing file. Anyway. Just throwing my nonsense out there. __________________ Your post count means nothing.

07-05-2009, 04:16 PM	#13
Babaganoosh ♥♥♥ Likes Hugs ♥♥♥ Industry Role: Join Date: Nov 2001 Location: /home Posts: 15,841	Just ignore it. Almost all of my sites get scanned for that crap. If you're using 3rd party scripts that you aren't sure about, .htaccess them to keep out the riff-raff. __________________ I like pie.

07-05-2009, 04:25 PM	#15
Killswitch - BANNED FOR LIFE Guest Posts: n/a	Not hard, all you have to do is create a link on a search engine crawled page with some random page that doesn't exist on your server, it it will come back 404 by the search engines.

07-05-2009, 04:35 PM	#17
~Ray visit hardlinks.org Industry Role: Join Date: Jun 2003 Location: Las Vegas , Nv >>> [email protected] or icq 94994627 anytime Posts: 18,362	have a script written to place on pages named after the exploits on your server, chmod your htaccess to allow your server to modify the htaccess file. Each time someone request one of those pages, the script will record their ip, and bann it by adding it to the htaccess file. __________________ Adult Backlinks for Adult Websites - Testimonials Available Last edited by ~Ray; 07-05-2009 at 04:37 PM..

07-05-2009, 11:07 PM	#19
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,391	Worrying about this is like worrying about the sky falling... What they are doing is akin to fishing. If you are a fish and you don't want to get eaten, don't eat worms... Other than that... Nothing to worry about.

07-05-2009, 11:30 PM	#20
niche25 GoFuckYourself Industry Role: Join Date: Nov 2006 Location: Paradise Valley, AZ Posts: 407	Google Webmaster tools is your friend. Remove pages in GWT, notify host, get a firewall & check shit regularly. It is extremely rare I get hacked now and when I do its a quick turn around. A couple years ago I was getting hit regularly. Karma for me I guess LOL.

07-06-2009, 02:26 AM	#24
milambur Mainstream since 2010 Industry Role: Join Date: Jan 2003 Posts: 1,327	IP banning is never a good solution, they use botnets that have millions of infected computers, you risk blocking out a lot of potential customers in the long run. To be safer, use custom scripts that are coded to handle malicious input. If you have to use a script that is commonly available, make sure you always have the latest updates. __________________ Alea iacta est

07-06-2009, 02:40 AM	#25
spook Registered User Join Date: Jun 2009 Location: .au Posts: 16	looks like its just skiddies scanning for holes. Adding their ip's manually will be a pain in the arse if they are using proxies (which they most times do). Best thing to do is just make sure all your scripts and your box is up to date. Also you could install mod_security if you haven't already (but if you install it, get someone who knows what they are doing to tune it for you).