Site hacked?

[Isengard]

My client just called because she was having problem uploading files on her site. After doing some tests, I notices that in most of the dir on the server, there was php and htaccess scripts that were not supposed to ne there! I guess I was hacked by some lamer... What can I do to prevent this??? The admin pages are protected by a password with htaccess and htpasswd files, are those that easy to go through??

What do you guys advise to prevent this kind of attack?

Regards

Isengard

[Vin DSL]

Go through your server log[s] line-by-line, see how the perps got in, and what they did -- then harden the site against further attack...

[Isengard]

Don't you need to have access to an input field for sql injection?? If so, it means that they got access to the secure part of the site first cause there is no input fields of any kind on the public site... Am I right?

[Vin DSL]

Ygpm...

[jason]

Most likly, whatever piece of software you were running was out of date and someone got through vian an exploit in the code. This is pretty common in shared hosting because so many people run the same apps (like forums, blogs, CMSes, and whatnot) and they don't always keep them upgraded. As soon as a bug is discovered in a piece of software, your site becomes fair game for the script kiddies.

I'd recommend checking all of the sites for the software you use regularly so that you can update things as needed. Most projects have notification lists you can sign up on to be notified of important news, like updates and patches. I recommend subscribing to these, but DON't reply on them to alrert you to everything. You should still check the site yourself on a somewhat regular basis.

And, to answer your question, no, you don't need a form for someone to "get in." It is trivial to send data to a web script without using a form, and the receiving script really has no way to know if the data sent came from a legit form or from someone trying to do something malicious by another means.

--Jason

[Vin DSL]

And, to answer your question, no, you don't need a form for someone to "get in." It is trivial to send data to a web script without using a form...

This has been pointed out to him...