Hello and welcome to our community! Is this your first visit?
Register
Enjoy an ad free experience by logging in. Not a member yet? Register.
Results 1 to 15 of 15
  1. #1
    Regular Coder
    Join Date
    Nov 2006
    Posts
    601
    Thanks
    1
    Thanked 2 Times in 2 Posts

    Website being hacked

    Hey guys,

    My forum on my website seems to have been hacked. The hacker has been able to delete all my posts. and add their own under my admin account quoting
    --------------------------------------------------------------------------------

    Charlie Chaplin once said something to the effect of:

    'Humour is an act of defiance; that we must laugh at our helplessness against the forces of nature, or go insane.'

    And where is he now? Dead.
    Are you guys able to help me atall with this??

    i have set up a demo account
    www.runningprofiles.com

    username:demo
    Password: demo

    If i need to verify the websites mine i can in any way. please help

    Jarratt

  • #2
    Regular Coder
    Join Date
    Dec 2009
    Location
    UK
    Posts
    495
    Thanks
    0
    Thanked 58 Times in 58 Posts
    What forum/cms are you running?
    My site: JayGilford.com
    Resources:
    PHP Pagination Class | Getting all page links | Handling PHP Errors properly
    If you like a users help, show your appreciation with the rep and thanks buttons :)

  • #3
    Regular Coder
    Join Date
    Nov 2006
    Posts
    601
    Thanks
    1
    Thanked 2 Times in 2 Posts
    Quote Originally Posted by JAY6390 View Post
    What forum/cms are you running?
    Home made saldy, thats why i belive that the security flaws are there.

  • #4
    Regular Coder
    Join Date
    Dec 2009
    Location
    UK
    Posts
    495
    Thanks
    0
    Thanked 58 Times in 58 Posts
    I see. In that case, I would take some time to read the securing php articles by Dave Child over at added bytes and see if there's anything you've missed. It might be that you're not filtering your data properly, weak passwords, or a lot of things really, so reading up on security is my advice since suggestions can be thrown around for days on this
    My site: JayGilford.com
    Resources:
    PHP Pagination Class | Getting all page links | Handling PHP Errors properly
    If you like a users help, show your appreciation with the rep and thanks buttons :)

  • #5
    Regular Coder
    Join Date
    Nov 2006
    Posts
    601
    Thanks
    1
    Thanked 2 Times in 2 Posts
    Ok but in mean time while i read this i would still love some assistance on this.

    If it help i dont think they can login to the account but using corss scripting or something like that as they haven access anything else on the site.

  • #6
    Senior Coder
    Join Date
    Jul 2009
    Location
    South Yorkshire, England
    Posts
    2,318
    Thanks
    6
    Thanked 304 Times in 303 Posts
    There's not really much that can be said in the way of specific advice. The list of possibilities could be as long as ones arm, and the only way to know which are applicable is to work through all possibilities. Research is pretty much your only option. The one thing that could be external to your scripts, security wise, is a poor quality shared host?

  • #7
    Regular Coder
    Join Date
    Nov 2006
    Posts
    601
    Thanks
    1
    Thanked 2 Times in 2 Posts
    Ok i have worked throuh the website posted above and i do belive they are secure. They are somehow accessing my db so how would they do that??

  • #8
    Regular Coder slappyjaw's Avatar
    Join Date
    Mar 2009
    Location
    Wonderland!
    Posts
    146
    Thanks
    14
    Thanked 3 Times in 3 Posts
    MYSQL INJECTION is what it sounds like. Make sure that you are useing the
    PHP Code:
    mysql_real_escape_string(); 
    for all of your variables etc. that are going to be inserted into a database.

  • #9
    Senior Coder
    Join Date
    Jul 2009
    Location
    South Yorkshire, England
    Posts
    2,318
    Thanks
    6
    Thanked 304 Times in 303 Posts
    Quote Originally Posted by runnerjp View Post
    Ok i have worked throuh the website posted above and i do belive they are secure. They are somehow accessing my db so how would they do that??
    By any number of means. You have insecure code, you're on a shared host with lax security, there's outdated and vulnerable software on the server etc. The list goes on and on. We have no idea what your code in general looks like, as you've not shown us any, so you'll have to wing it and appraise the situation yourself.

  • #10
    Master Coder
    Join Date
    Jun 2003
    Location
    Cottage Grove, Minnesota
    Posts
    9,468
    Thanks
    8
    Thanked 1,085 Times in 1,076 Posts
    Expanding on Slappyjaw's post .... which is probably where your problems are from ...

    For example,

    Don't using ANY variables in your queries that are not sanitized.
    Say you are looking for a username ...

    You might have this line,
    $username = $_POST['user'];

    Do this to it, and all others ...

    $username = mysql_real_escape_string($username);

    That's what Slappyjaw was talking about.

  • #11
    Regular Coder cyrus709's Avatar
    Join Date
    Dec 2008
    Posts
    102
    Thanks
    22
    Thanked 5 Times in 5 Posts
    I believe your error is in the URL, now im no sql injection genius or anything but you have "page=", and when you type ' (single quote) after "page=" you get a mysql error.

    You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'demo',`user_id`='31'' at line 1
    perhaps the issue is that he is replacing demo with admin, and user id to 1? or something to that effect, also your html is very buggy, and i can only imagine what your php looks like
    Last edited by cyrus709; 02-10-2010 at 12:03 AM.
    Last night I lay in bed looking up at the stars in the sky and I thought to myself, where the heck is the ceiling.

  • #12
    Regular Coder
    Join Date
    Nov 2006
    Posts
    601
    Thanks
    1
    Thanked 2 Times in 2 Posts
    Thanks guys,,, im going through each page one by one tidying it and tightining security..

    cyrus709@ i have tried the whole http://www.runningprofiles.com/members/index.php?page=' but all i get is my home page :S if this is the problem does any 1 know how to fix this?

  • #13
    Regular Coder
    Join Date
    Nov 2006
    Posts
    601
    Thanks
    1
    Thanked 2 Times in 2 Posts
    Ah yes i see what cyrus709 means (not just the pants php/html layout, but im onto that as we speak) but the adding of ' brings up the error message.

    Now i was trying to look up what was up but with myself being at work atm i cant bring up with websites telling me abotu how it works for obv reasons, so i was wondering if someone could tell me what happens/how they do it and/or how i solve it!

  • #14
    Master Coder
    Join Date
    Jun 2003
    Location
    Cottage Grove, Minnesota
    Posts
    9,468
    Thanks
    8
    Thanked 1,085 Times in 1,076 Posts
    Please bring-up the websites you found for how it works.

    There are probably others here who would like to see your code and other sites,
    for educating themselves on how to secure a MySQL website. You have an opportunity
    here to get a lot of ideas and "do's and dont's". Take advantage of it for your sake
    and others who are watching this post, but not participating.

  • #15
    Regular Coder
    Join Date
    Nov 2006
    Posts
    601
    Thanks
    1
    Thanked 2 Times in 2 Posts
    Sorry about this but on this page can any 1 tell me what i need to chnage to prevent the erro message 'You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Admin',`user_id`='1'' at line 1' appearing? as i cant seem to find the area involved/

    cut down code as much as possible

    PHP Code:
    <link rel="stylesheet" type="text/css" href="http://www.runningprofiles.com/css/login.css"> <link rel="stylesheet" type="text/css" href="http://www.runningprofiles.com/members/include/style.css"> <?php//look to see if the forum is currently locked    $sQry = "SELECT `locked` FROM forum_lock LIMIT 1";    $obQry = mysql_query($sQry) or die(sprintf("Could not query forums (%d): %s",mysql_errno(),mysql_error()));    $record = mysql_fetch_array($obQry);    if (isset($record['locked']) && $record['locked'])        {        die("Sorry, the forums are currently locked."); //error message        }    else    {//Here we count the number of results    $data = mysql_query("Select * from forumtutorial_posts where parentid='0' AND forum = '$forum' ORDER BY important, lastrepliedto")or die("Could not get users");    $rows = mysql_num_rows($data);    $page_rows = 25; //This is the number of results displayed per page    $pagenum = $_GET['pagenum']; //This sets the range to display in our query                        if ($pagenum === "last")        {            $query = "Select COUNT(*) as C from forumtutorial_posts where parentid='$id'";            $result = mysql_query($query);            $data = mysql_fetch_array($result);            $pagenum = ceil($data['C'] / $page_rows);                }                $pagenum = (is_numeric($pagenum) && $pagenum >= 1) ? (int)$pagenum : 1;                $max = 'limit ' . ($pagenum - 1) * $page_rows . ',' . $page_rows;                                {/* gets users online */                $getusersonline = "SELECT user_id,user FROM useronline    WHERE  file = 'http://www.runningprofiles.com/members/index.php?page=forum&forum=$forum' AND                timestamp > " . (time() - 900); //grab from sql users on in last 15 minutes                $getusersonline2 = mysql_query($getusersonline) or die("Could not get users");                $num = mysql_num_rows($getusersonline2);                                $getthreads = "Select * from forumtutorial_posts where parentid='0' and forum = '$forum' ORDER BY important ASC, lastrepliedto DESC $max";$getthreads2 = mysql_query($getthreads) or die("Could not get threads");while ($getthreads3 = mysql_fetch_array($getthreads2))    {                                            $important = $getthreads3['important'];                                                $query1 = mysql_query("SELECT COUNT(postid) FROM forumtutorial_posts WHERE( postid= '$getthreads3[postid]' OR parentid = '$getthreads3[postid]' ) AND author='$username'");$count = mysql_result($query1, 0, 0); echo ($count != 0)  ? '<img src="/images/posted.jpg" />' : '<img src="/images/posted2.jpg" />';   ?>
    Last edited by runnerjp; 02-10-2010 at 03:24 PM.


  •  

    Posting Permissions

    • You may not post new threads
    • You may not post replies
    • You may not post attachments
    • You may not edit your posts
    •