Website Hacked

[hybrid]

Just come online to find one of my websites has been hacked and some code has been injected into each of my 302 pages. The last line added to each page is a load of rubbish which downloads a trojan onto your PC.

Could someone tell me a way to check the logs on a webserver? Be it Apache logs for access or any other way.

Cheers

 

[Una]

Well it depends where you set your apache logs directory. /var/log/apache2 is a good chance... likely to be in /var/ though.

 

[hybrid]

Just checked in my logs and it shows no signs of anything unusual. It's a school website so not many people visit the site out of hours.

Anywhere else i could check? The attack looks like a PHP hole somewhere. Is there any decent logs to check for injections?

 

[Una]

Just checked in my logs and it shows no signs of anything unusual. It's a school website so not many people visit the site out of hours.

Anywhere else i could check? The attack looks like a PHP hole somewhere. Is there any decent logs to check for injections?

It could be anywhere really... Looking at that code your using website baker? <= 2.6.0 ? If so I know of one attack against that at least...

See that iframe src="" encoded URL, decode that and whack it into google and see if anything comes up.

 

[hybrid]

.5 yeah. Thats the first thing i need to do tomorrow and update it.

 

[Una]

.5 yeah. Thats the first thing i need to do tomorrow and update it.

http://projects.websitebaker.org/websitebaker2/ticket/376

You at least need to upgrade but it could be anything really.

 

[hybrid]

Good stuff. I'll get that patched up tomorrow morning.

Thanks for the pointers Una.