HACKED - TWO OF MY SITES WERE TODAY

Sells PC To Pay For Divorce Joined: Posts: 5661

86.16.61.105 = U.K
202.149.36.158 = India
80.74.199.146 = Finland
87.82.20.199 = U.K

Hangin' Around Joined: May 09, 2004 Posts: 32

Found the SQL Hack it's in `nuke_config'

Posted: Tue Apr 04, 2006 5:04 pm

This hack has been know for awhile and was discussed ALOT on some of the script kiddie pages. Apperently the authors refused to except the exploit as being a hack and ignored the problem. Perhaps they will learn from this.

Posted: Tue Apr 04, 2006 9:58 pm

panda wrote:

Found the SQL Hack it's in `nuke_config'

Posted: Wed Apr 05, 2006 3:38 pm

Still knacked !! Does this change any files in nuke cause i thought i had sorted it but all the admin blocks were missing and the site prefenaces wont save !! and i cant view some modules

Andy

Posted: Wed Apr 05, 2006 3:48 pm

well thats the signature of a hacker yes,the mess up your stuff....
dive into your tables and check it all...

Posted: Wed Apr 05, 2006 4:00 pm

Ok so all they can really do is mess up your DB not edit php files etc on ya host ?

Thanks

Andy

Posted: Wed Apr 05, 2006 5:34 pm

No Worries my cock up all sorted !!

Posted: Thu Apr 06, 2006 9:19 am

Probably better to restore a backup of your tables, if they've done so many changes Smile

Posted: Thu Apr 06, 2006 2:50 pm

I wont be putting vwar bck on !! It got hacked again on the new patch so they have brought out a new new patch !!
[ Only registered users can see links on this board! Get registered or login! ]

Posted: Thu Aug 03, 2006 12:01 pm

IP info can be found out easily enough:
[ Only registered users can see links on this board! Get registered or login! ]

Paste the IP into the 'WHOIS' function. Rinse, repeat.

Posted: Thu Aug 03, 2006 1:58 pm

Those look like they were added by Sentinel but there are a number of sites which will look up the specifics of those IP's or if you just need the country, you can look them up in Sentinel.

Posted: Thu Aug 03, 2006 2:02 pm

Oops, sorry, seems half the universe posted her before I hit send lol

Posted: Thu Aug 03, 2006 2:26 pm

LOL, you beat me Hitwalker.

You can look up the sites yourself with:

http://www.dnsstuff.com/tools/whois.ch?ip=86.16.61.105

Then just substitute in the IP's with a copy/paste. I keep the url as a favorite and it's also in Sentinel. You will get a lot of information including, sometimes, a range of IP's to ban and an email address to complain to.

edit: sorry, everyone is on this one, sorry for the repetition.