EzyPal Hacking

Hi guys. I have ONE big problem.

For the guys who use ezypal script:

I was hacked for 5 times. And the file that was modified is index.php.

Like this:



In the footer thay put IFRAME.

Please how can i resolve this problem?
But PLEASE dont tell me to buy'it.

Thanks

If i'ts nulled script propably you have backdor in one (or more) file.
You have to find it and remove.

to find it you should check your server logs

There are loads of ways your site might get hacked.
First there are some variables that have little to do with your own website for instance;

*vunerablity of your home pc/ no proper updated virus scanners. Think key loggers, infected ftp software, browser hacks
*Shared hosting. Maybe the vulnerability is not with you but with your neighbor on the server. A hacked site isn't necessarily a scripting issue.

Then there are also some other factors that come to play.
Script vulnerabilities. Be it via php vulnerability or scripting errors.

Use of code injection is typically viewed as a malevolent action, and it often is. Code injection techniques are popular in system hacking or cracking to gain information, Privilege escalation or unauthorised access to a system.
Code injection can be used malevolently to:
Arbitrarily modify values in a database through a type of code injection called SQL injection. The impact of this can range from defacement of a web site to serious compromisation of sensitive data.
Install malware on a computer by exploiting code injection vulnerabilities in a web browser or its plugins when the user visits a malicious site.
Install malware or execute malevolent code on a server, by PHP or ASP Injection.
Privilege escalation to root permissions by exploiting Shell Injection vulnerabilities in a setuid root binary on UNIX.
Privilege escalation to Local System permissions by exploiting Shell Injection vulnerabilities in a service on Windows.
Stealing sessions/cookies from web browsers using HTML/Script Injection (Cross-site scripting).

Click to expand...

To prevent XSS
Simple things to protect yourself is to filter out any symbols from text input.
Can easily be done by using preg_replace and the symbols with nothing or just return a error message to the user saying symbols are not allowed.
Second is to encode input to sql and decode on output. That way the code can never become active inside because its scrambled.
PHP offers escapeshellarg() and escapeshellcmd() to perform encoding before calling methods;
Ones a shell is intstalled it will change your files inputting for instance an iframe which you had.
When you remove the iframe you haven't removed the shell so when you continue, the shell is also going to continue it's work and the iframe will keep on coming back.
There are lots of tutorials you can find via google on how to remove one.
Or on how to find one in the first place.


Another thing php is flawed with is that it is very vulnerable when exposed to the public directly.
For instance index.php.
A way to work around this is to not allow acces to the core php files.
But then logically no one would have access to your site.
You can generate html or xml files from your php core affectively making a html mirror of the php file.
This has a few advantages. Your site load will be lighter and your page will be faster because it doesn't have to load any sql data.
Plus its very hard to hack due to it's pure simplistic nature, you limit the hackers possibilities to a few parameters that are easy for you to controle.
See the image for an example on how it works



You can even generate php file from your core folder. So you can refresh a script each morning or a certain file everytime someone has made a comment.

You can do any of the above or not but there is still something that you must do regardless and that is; "Make Backups"!

olimpiu_stefan

I may have a solution to your problem, PM me.

I am looking for better threads about hacking. I am a noob on this. Can anyone help?

remove write permission from your files, use:
chmod 644

Disable writing.