Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have got a Joomla site that got hacked and I am looking at the server logs and I see something like:

GET /bind.php ho=mx01.1and1.es&po=25&ma=cristina%40bpmlighting.com&lo=cristina&pa=cristbpm2013&mt=johnkarpan%40yahoo.com&fn=Dr.+Sue+Metts&or=docswgacm&eh=bpmlighting.com&sd=95.141.32.169%2Fstat1&sh=&sp=&sl=&sc=&rt=5&ch=utf-8&cm=1&ht=1&at=&su=%E1%BD%92%E1%BF%97%E1%BE%8C%C4%9E%E2%84%9C%E1%BE%8C+%D0%85%E1%BE%8C%E2%86%B3%C4%98&bo=%3Ca+href%3D%22http%3A%2F%2Fpaowcx.coolebrity.com%2Fod5ba77.html%22%3E%E1%B9%BE%E1%B8%AE%E1%BE%B7%C4%9D%C9%BC%E1%BE%B7+%C5%A1%E1%BE%B7%E2%8C%8A%E1%BC%9C%3C%2Fa%3E 80 - 95.141.32.169 HTTP/1.0 - - - mywebsite.com 500 0 64 0 544 308

I guess that is a hit on bind.php - I am not sure what the "ho=" stands for. Can anyone clarify?

share|improve this question
    
Welcome to Webmasters. Be sure to give the About page a read if you haven't already. –  Mister Dood Jun 11 '13 at 3:11
add comment

1 Answer

up vote 0 down vote accepted

I believe that's the Request URI, or the page that was loaded from your server. It gave a 500 error (which means nothing was executed), but it looks like an attempted hack of some kind. Give me a few minutes, and I'll URL decode the string and see what they were trying to do and tell you if you really need to worry or not.

UPDATE: I'm not entirely sure what they were trying t do, but it looks like they were looking for general vulnerabilities. I'd recommend that you:

  1. immediately check that particular file for any lines like eval(base64_decode(Long string of seemingly-random text));. This is usually a PHP shell, and gives anybody full access to your server. They can be clever about hiding it, so do a search in your program for the phrase eval( and let the program find it for you.

  2. Make sure you have no SQL injection vulnerabilities. Make sure you've sanitized your inputs.

  3. Make sure that any files you load where the name i specified with a PHP GET variable will not load external files. Also make sure it doesn't accept values containing ../ or anything starting with / as a value because this will allow a malicious person to run any file on your server.

Note that even if your server is secure, people will still look for vulnerabilities. If you're confident in your server's security, don't worry about it.

share|improve this answer
    
Thank you so much for your answer. I wish I had more points so that I could +1 your answer –  open_sourse Jun 11 '13 at 19:58
    
You can start by accepting my answer. That's +2 for you and +15 for me. If you answer a couple of questions, or ask a couple of questions you'll get to 15 rep in no time. The key is to put effort into your contributions, and try to make them helpful for more than just you. –  Mister Dood Jun 12 '13 at 3:42
    
right you are. done :) –  open_sourse Jun 12 '13 at 16:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.