-1

I have a company that has been attacked through SQL and their tables were removed. The attacker put a message replace it with all database entries.

The first thing that I did was to figure out if the sql port is open globally. What I saw was the sql 3306 open locally on 127.0.0.1. How the attacker reach it?

Hint: he didn't get any access to the server. The server is pretty secure outside.

They are running phpMyAdmin on the website and the website is running globally on port 80. What I know is that the sql is running locally. How could it be accessed?

No sql injection too, I guess.

Improve this question
1
  • There is no way to tell with zero data. We could only guess.
    – schroeder ♦
    Commented Mar 24, 2020 at 16:44

1 Answer 1

Reset to default
1

This is not something we can answer here, there are way too many possibilities.

For instance: you assume he didn't get access to the server because it is 'pretty secure', how do you know? You also state that 3306 is closed, but phpMyAdmin is running. So an attacker might enter there. SQL injection is always a possibility, why do you think it is not?

It can also be that admin credentials or SSH keys are leaked, weak passwords are used or a vulnerability exists in one of the used services/libraries/packages on the server/application.

Your best way to investigate this is looking at access logs for the apache/nginx server and the MySQL logs. There should be information about access into the system, unless the attacker cleared it.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .