Website hacked !!! A lesson to Newbies!!!

Status
Not open for further replies.
Advertise on BHW
I hope you took a backup now that you have it restored.

While there may be plugins, here's how to do it manually:

Get FTP access and SSH access to your site.

SSH and run this command line backup:
mysqldump --add-drop-table -u mysql_username -p mysql_database > backupfilename_mm.dd.yy.sql

Then
FTP all the files from your site (plus the database backup,) down to your local machine.

If you ever need to restore the database, you can use this command:
mysql mysql_database < backupfilename_mm.dd.yy.sql
 
Thx Beerman,

I Downloaded every single file. lol and the Database to make sure I have everything.

Your Command's will come in handy, as Im sure that Backups Must be made more often. so will download a copy every week. or as more data is added I will Download the Database Daily.

Thank You, and Im sure there is a lot of us that can use this.

beerman said:
I hope you took a backup now that you have it restored.

While there may be plugins, here's how to do it manually:

Get FTP access and SSH access to your site.

SSH and run this command line backup:
mysqldump --add-drop-table -u mysql_username -p mysql_database > backupfilename_mm.dd.yy.sql

Then
FTP all the files from your site (plus the database backup,) down to your local machine.

If you ever need to restore the database, you can use this command:
mysql mysql_database < backupfilename_mm.dd.yy.sql
Click to expand...
 
While we're on the topic of command line backups, here's how to zip your whole site up as well:

After you SSH in, from your root directory run this:

tar -zcvf yourdomain.com_mm.dd.yyyy.tar.gz public_html

This will zip your whole site into one file, so you only need to backup two files then, your database file and your site file.
 
One of my sites, a PR3, was hacked recently and I didn't find out until Google had marked it as compromised in the SERPS. Someone stole my FTP password and used my site to host hundreds of backlinks.

I wish I had a lesson to give but the only one I can think of is don't use a cheap web host. Reason being, this hack has happened to others across multiple hosts, regardless of what website software they are running, and they all report someone has stolen their FTP password. Naturally my host said someone must have sniffed out my password, but this has the fingerprint of an unknown backdoor that someone is probably using by signing up to the same shared host and hacking into the accounts. Not sure if it's a system hack or maybe a control panel hack of some sort. But cheap hosts don't care and don't have the time/talent to investigate.

Had I logged into Google Webmaster Tools more frequently I might have noticed this sooner but now I'm on a long waiting list for reinclusion.
 
The following files were found on my site that was the culprit files : demons.php ; ezsy.php ; korengal.old.php ..

Then also if you check the 2 folders on your website. .log and . logs

These 2 folders are fulllllll of downloaded shit . all html files.


I resubmitted to Google, and Immediately the day after actually today. 13/05/2011 It is back on and running like always.


mustachio said:
One of my sites, a PR3, was hacked recently and I didn't find out until Google had marked it as compromised in the SERPS. Someone stole my FTP password and used my site to host hundreds of backlinks.

I wish I had a lesson to give but the only one I can think of is don't use a cheap web host. Reason being, this hack has happened to others across multiple hosts, regardless of what website software they are running, and they all report someone has stolen their FTP password. Naturally my host said someone must have sniffed out my password, but this has the fingerprint of an unknown backdoor that someone is probably using by signing up to the same shared host and hacking into the accounts. Not sure if it's a system hack or maybe a control panel hack of some sort. But cheap hosts don't care and don't have the time/talent to investigate.

Had I logged into Google Webmaster Tools more frequently I might have noticed this sooner but now I'm on a long waiting list for reinclusion.
Click to expand...
 
Glad to hear it all turned out well!, If you're absolutely positive you didn't install any rogue wordpress plugins and there's nothing OTHER THAN WORDPRESS in your public_html then it could be the host themselves. You did say it was a host out of some foreign country so it may not be up to date, so to speak, when it comes to security of their boxes so that's another thing I'd be worried about...see if any of their other clients have had similar problems. Another possibility is someone dropped a db of some random forum you joined years ago and used the password you signed up with, with the email you signed up and logged into your email, password re-usage is a HUGE factor in these attacks and seems to be the most likely as there were shells on the server sounds like and your host mentioned ftp credentials...

In any event change your passwords for wordpress, email, FTP, MySQL, and any other access you have to the host and to get rid of the malicious iframe by going into your theme folder (or wp-admin panel->theme->theme_editor) and checking the corresponding files (footer.php, header.php, etc.) for the code and get back out there, you can do much better than 5$/day believe me ;)

and as you said backups are a bit of an inconvenience but they CAN be automated to make it much easier, be sure to set this up as soon as possible.
 
As I told Jennifer,

I had 2 other website's that was hacked about a month ago, But nothing searious, it was simple HTML stuff, But I completely forgot about it before writeing this post, so Im sure that It might have been a Host problem.

Im now keeping a stricked eye on everything and If I have more problems, a Host change is most likely the best thing.


OrderZero said:
Glad to hear it all turned out well!, If you're absolutely positive you didn't install any rogue wordpress plugins and there's nothing OTHER THAN WORDPRESS in your public_html then it could be the host themselves. You did say it was a host out of some foreign country so it may not be up to date, so to speak, when it comes to security of their boxes so that's another thing I'd be worried about...see if any of their other clients have had similar problems. Another possibility is someone dropped a db of some random forum you joined years ago and used the password you signed up with, with the email you signed up and logged into your email, password re-usage is a HUGE factor in these attacks and seems to be the most likely as there were shells on the server sounds like and your host mentioned ftp credentials...

In any event change your passwords for wordpress, email, FTP, MySQL, and any other access you have to the host and to get rid of the malicious iframe by going into your theme folder (or wp-admin panel->theme->theme_editor) and checking the corresponding files (footer.php, header.php, etc.) for the code and get back out there, you can do much better than 5$/day believe me ;)

and as you said backups are a bit of an inconvenience but they CAN be automated to make it much easier, be sure to set this up as soon as possible.
Click to expand...
 
Advertise on BHW
Status
Not open for further replies.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top