0

I have an app that was in a folder on my main site's root directory www.example.com/app which was recently hacked and the entire website was offline because the server load was too high and the database was corrupted somehow.

Now, before I find the exploit in the app I would like to have it back online. Would placing it in a subdomain like app.example.com make any difference? Assuming the attacker will do the same on the new location, is my main site safer?

10
  • What do you mean by "hacked"? – yeah_well Jun 4 '19 at 10:08
  • Don't know another term for it. Some IP is hitting the app registration form page with a GET, followed with a POST and then it gets redirected to the main site. I'm not a security expert but I'm pretty sure this is the cause for the server load I've mentioned and problems I've had. Removed the app and all is working fine for 2 days now. – Sergiu Elmi Jun 4 '19 at 10:29
  • I've checked the IP and it's responsible for 5000 attacks in the last days. If anyone is interested this is the IP 188.138.188.34. – Sergiu Elmi Jun 4 '19 at 10:35
  • 1
    I guess this answers my question. "In addition to cookie theft, the ability to load arbitrary code on a subdomain could also help attackers to bypass same-origin and cross-domain security restrictions for the corresponding domain.". Taken from - pcworld.com/article/2857212/… – Sergiu Elmi Jun 4 '19 at 10:47
  • 1
    by 5000 attacks I was referring to 5000 reports made by other people. This is what I was referring to - cleantalk.org/blacklists/188.138.188.34 – Sergiu Elmi Jun 4 '19 at 13:14
0

Now, before I find the exploit in the app I would like to have it back online

Now since you don't know what kind of "hack" it is.I am gonna go ahead and assume that it's a remote code execution,which means now the attacker can execute arbitrary code in the server.If that is the case then your server is compromised.The only way now is to start clean and plug the bug.

Now, before I find the exploit in the app I would like to have it back online. Would placing it in a subdomain like app.example.com make any difference

Yes,If and only if the (application with the bug) points to a different machine then and only then is the attack separated from the main application which is now in a different machine

Some IP is hitting the app registration form page with a GET, followed with a POST and then it gets redirected to the main site. I'm not a security expert but I'm pretty sure this is the cause for the server load I've mentioned and problems I've had

Now that you mention this.This seems more like a DOS or Searching a vuln of some kind.There are better solutions to prevent that like DOS Protection or even a Web application firewall along with it.

I've checked the IP and it's responsible for 5000 attacks in the last days. If anyone is interested this is the IP 188.138.188.34.

Simply blacklist the I.P address and do the above things i mentioned.

3
  • my question was in regards to the same server's subdomain, like here.samedomain.com and I assume it's working on the same machine which won't work. Will get another domain + host and place it there. I'll redirect the traffic to this new server and hopefully my main site will be OK. Thanks for your anwer – Sergiu Elmi Jun 4 '19 at 13:06
  • Or you could try blacklisting along with a web application firewall or a dos protection service.Moving your application to another machine should not be your solution – yeah_well Jun 4 '19 at 13:10
  • I have already blocked that IP and it's no longer causing any trouble but an IP can easily be changed. I'm moving to another server until I find what exploit was found in the app, while also keeping it online without affecting my main site. – Sergiu Elmi Jun 4 '19 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.