I have an app that was in a folder on my main site's root directory www.example.com/app which was recently hacked and the entire website was offline because the server load was too high and the database was corrupted somehow.
Now, before I find the exploit in the app I would like to have it back online. Would placing it in a subdomain like app.example.com make any difference? Assuming the attacker will do the same on the new location, is my main site safer?
Now, before I find the exploit in the app I would like to have it back online
Now since you don't know what kind of "hack" it is.I am gonna go ahead and assume that it's a remote code execution,which means now the attacker can execute arbitrary code in the server.If that is the case then your server is compromised.The only way now is to start clean and plug the bug.
Now, before I find the exploit in the app I would like to have it back online. Would placing it in a subdomain like app.example.com make any difference
Yes,If and only if the (application with the bug) points to a different machine then and only then is the attack separated from the main application which is now in a different machine
Some IP is hitting the app registration form page with a GET, followed with a POST and then it gets redirected to the main site. I'm not a security expert but I'm pretty sure this is the cause for the server load I've mentioned and problems I've had
Now that you mention this.This seems more like a DOS or Searching a vuln of some kind.There are better solutions to prevent that like DOS Protection or even a Web application firewall along with it.
I've checked the IP and it's responsible for 5000 attacks in the last days. If anyone is interested this is the IP 188.138.188.34.
Simply blacklist the I.P address and do the above things i mentioned.
