Web Hosting Talk







View Full Version : site hacked...how to?


WFWH
12-12-2004, 04:12 PM
I have a client whos forum got hacked, and he would like to get the ip of the people who accessed a certain page at a certain time, can anyone tell me how to obtain this info?

Thanks

andreyka
12-12-2004, 04:24 PM
I think you didn't secure php. Try show access and error log, may be you find something interested.

beachtrader
12-12-2004, 04:27 PM
Look through the raw logs for the past couple of days and look for any entries which are not normal (such as character encoding, wget, etc.) The raw log should list the IPs along with the request string entered so you can backtrack them. Unfortunately the Ip will probably just lead to a hacked server somewhere else but at least you can ban the Ips.

WFWH
12-12-2004, 04:44 PM
Well what it looks like is he has phpbb installed, and someone stole his password and went and edited only the forums. I will take a look at the raw file and see.

Thanks

Steven
12-12-2004, 04:53 PM
phpbb had an exploit that allowed an attacker to execute system commands on the forum.

Brett M
12-12-2004, 05:44 PM
yes, the exploit fix can be found here (http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=240513)
You may want to suggest to any of your clients that have phpBB forums to upgrade, or upgrade the forum(s) your self