Typical patterns of a hacking attack in Apache logs? - Joomla! Forum - community, help and support
hi all.
our department @ university of mainz, germany, suffered hack of our joomla system yesterday. hacker(s) managed break joomla, register new administrator user , deleted joomla files , folders in our htdocs directory. contents of joomla database not touched, neither contents of our other mysql databases (at least not detectably).
i cannot joomla version running while hack happened pre-1.012 system. due extended panicking, copied 1.012 installation on old joomla folder. no third party tools/mambots/components installed in joomla. our server information is: apache/2.2.3 (unix) dav/2 mod_ssl/2.2.3 openssl/0.9.8d php/5.1.6 mod_apreq2-20051231/2.5.7 mod_perl/2.0.2 perl/v5.8.7.
my question: there typical patterns of hacking attempt identified in apache log files (access.log, error.log, or else)? suspect hacker come university context , try backtrace ip. so, need find crucial file accesses lead hack in apache logs.
any appreciated.
best regards,
malte.
our department @ university of mainz, germany, suffered hack of our joomla system yesterday. hacker(s) managed break joomla, register new administrator user , deleted joomla files , folders in our htdocs directory. contents of joomla database not touched, neither contents of our other mysql databases (at least not detectably).
i cannot joomla version running while hack happened pre-1.012 system. due extended panicking, copied 1.012 installation on old joomla folder. no third party tools/mambots/components installed in joomla. our server information is: apache/2.2.3 (unix) dav/2 mod_ssl/2.2.3 openssl/0.9.8d php/5.1.6 mod_apreq2-20051231/2.5.7 mod_perl/2.0.2 perl/v5.8.7.
my question: there typical patterns of hacking attempt identified in apache log files (access.log, error.log, or else)? suspect hacker come university context , try backtrace ip. so, need find crucial file accesses lead hack in apache logs.
any appreciated.
best regards,
malte.
this thread should give ideas on for: http://forum.joomla.org/index.php/topic ... 76575.html
Comments
Post a Comment