Timeline for How to prevent my site from being hacked by learning from server log?
Current License: CC BY-SA 3.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Dec 23, 2017 at 12:49 | comment | added | Tejas Pandya | @forest yes you are right . I'm currently working on that and placing validation both side to check for file . | |
| Dec 23, 2017 at 12:26 | comment | added | forest | Almost definitely used (chances are good, but it is not a guarantee). What's even more important though is closing the exploitation vector. Judging by the URLs you gave, it seems like it was simply someone who uploaded a PHP shell as an image. There are many ways to prevent that. | |
| Dec 23, 2017 at 12:24 | comment | added | Tejas Pandya | @forest and schroeder thank you guys for your guidance , so my conclusion is > This guy definitely used Android 4.4.2 and UCBrowser for this and as forest said . i should configure my server to log X-Forwarded i will work on that . | |
| Dec 23, 2017 at 12:07 | history | edited | schroeder♦ | CC BY-SA 3.0 |
edited body
|
| Dec 23, 2017 at 12:00 | history | edited | schroeder♦ | CC BY-SA 3.0 |
added 175 characters in body
|
| Dec 23, 2017 at 11:58 | comment | added | forest | @Tej You should configure your server to log the X-Forwarded-For header next time, as caching proxies like this very often add the original IP address to that, given that the purpose of the proxy is performance rather than anonymity. There may not be much you can do this time, but if you are able to record the original IP from the headers, you don't need to go about (potentially illegally) trying to use Java applets or Flash to deanonymize your users. | |
| Dec 23, 2017 at 11:57 | comment | added | schroeder♦ | @Tej I am trying to find proof of this, but I suspect that UCWeb offers caching, which makes it look like the traffic is coming from the UCWeb server, even though a user device actually made the request. | |
| Dec 23, 2017 at 11:53 | comment | added | Tejas Pandya | @schroeder ok get it but what does this mean from an ISP who are the same makers of the browser ? maker of the browser tries to hack my site ? is it so ? | |
| Dec 23, 2017 at 11:53 | comment | added | forest | I wonder if it had X-Forwarded-For. If it is a caching proxy, it almost certainly does. | |
| Dec 23, 2017 at 11:52 | comment | added | schroeder♦ | @Tej you cannot know the real IP, but you know at least one of the IPs involved. You might not need to know the real IP in order to get this one incident investigated and stopped. | |
| Dec 23, 2017 at 11:47 | history | edited | schroeder♦ | CC BY-SA 3.0 |
added 57 characters in body
|
| Dec 23, 2017 at 11:43 | history | edited | schroeder♦ | CC BY-SA 3.0 |
added 124 characters in body
|
| Dec 23, 2017 at 11:42 | comment | added | Tejas Pandya |
thank you for your response . but how can i know the real ip and as you wrote they do help you understand who sent this attack can you explain how can i know who sent this attack ?
|
|
| Dec 23, 2017 at 11:41 | history | edited | schroeder♦ | CC BY-SA 3.0 |
added 45 characters in body
|
| Dec 23, 2017 at 11:32 | history | answered | schroeder♦ | CC BY-SA 3.0 |