Detecting inbound attacks:
- Server running slow – this is an obvious sign you might getting hacked. Especially if you haven’t changed anything else on the site and traffic is still the same.
- Check for high server (CPU) load
grep processor /proc/cpuinfo | wc -l. Unnecessary if your webhosting control panel already has a GUI for this. Anything at or above the number of CPU cores you have is considered really high (i.e. load of “5” when you only have 4 cores). High CPU usually means an attack at network level (bombarding services).
- Check for high memory usage
cat /proc/meminfoortop. High swap messages in your control panel at random intervals are also an obvious indicator. Sometimes the attacks will erratic and you’ll just have to scan logs. High memory usually means an attack at software level (bombarding php scripts).
- Check connections per IP . Up to 50 connections from one IP can be normal, anything over 100 is suspicious.
netstat -ntu|awk '{print $5}'|cut -d: -f1 -s|sort|uniq -c|sort -nk1 -r- Alternate commands to check connections per IP . Use these if the previous ones didn’t help.
tail -n 10000 yourweblog.log|cut -f 1 -d ' '|sort|uniq -c|sort -nr|more and netstat -n|grep :80|cut -c 45-|cut -f 1 -d ':'|sort|uniq -c|sort -nr|more- Check for syn connections
netstat -n | grep :80 | grep SYN- Check logs for failed login attempts
cat /var/log/secure(RHEL, Centos, Fedora) orcat /var/log/auth.log(Ubuntu, Debian).
- Check for WordPress wp-login brute-force attack (current day)
grep -s $(date +"%d/%b/%Y:") /usr/local/apache/domlogs/* | grep wp-login.php | awk {'print $1,$6,$7'} | sort | uniq -c | sort -n- Check for WordPress XMLRPC attack (current day)
grep -s $(date +"%d/%b/%Y:") /usr/local/apache/domlogs/* | grep xmlrpc | awk {'print $1,$6,$7'} | sort | uniq -c | sort -n
Leave a Comment