0

Are this an example of an attack that had happened to my server?

This happened few days before I checked the logs... I checked the logs to see if something was wrong since my server suddenly uses all of its resources ( CPU and Memory )...

Edit: I have a cron that ran every day that clears access_log which is an idiotic thing to do (removed it today).

enter image description here

  • It's very likely a hacking attempt. Wordpress is a very common target. – Steve Sether Aug 30 '18 at 3:15
  • I am using wordfence as a security plugin, it worked well and blocked some attacks on the server but not this time... atm I was relying on it and some basic firewalls... It's time to search some methods to help strengthen the security of the server. Thanks for confirming @SteveSether – NeedHelpBasicallyOnEverything Aug 30 '18 at 3:44
2

It might be an attack as well as the preparation for an attack. Most likely one tries to find out about installed wordpress plugins or (depending on your apache/nginx config) just tries various default names for files (calles website enumeration) to figure out what you are doing. This might lead to some attempt to actually breach the site or he may just collect data. This article shows what happens if you do this on govt sites ;). If it is an actual attempt the attacker probably collected a lot of exploits, set some dependencies (like './cmv.php must exist and return...') and tries to execute them. (You could tell from more detailed access-logs.)

Anyway. If your access logs were more precise you could distinguish those two options but chances are you don't need to. This happens to most of the public IPs that have port 80 or 443 exposed on a daily basis because there is a lot of automated scanning and exploitation going on. If your security basis is working well (such as updates, maybe ModSecurity and so on) it's nothing to really worry about.

  • Thanks for the article link ( reading it atm ). My server has not been updated for a few months that have accumulated 140+ updates waiting to be downloaded. I'm also researching regarding website enumeration that you have mentioned. – NeedHelpBasicallyOnEverything Aug 30 '18 at 6:03
  • Nova Scottia did retract that claim, btw. Please do not link articles that are already outdated. Also, additional plus: The logs look like someone is scanning specifically for already installed SKOTS (Script Kiddie of the shelf) web shells. Maybe you should consider adding this aspect to your answer. – Tobi Nary Aug 30 '18 at 9:05
  • @SmokeDispenser I see, noted and thanks for the additional plus too :) – NeedHelpBasicallyOnEverything Sep 3 '18 at 0:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.