Computer hacker help!

[hooked 0]

I want to know if a site is hit, what exactly the hacker can do? What are their capabilities?

I don't want to do this, relax, I wouldn't even know how. There are a couple of sites I visit and this is a big concern of mine.

--------------------------------------
Sometimes we're just being Humans.....But we're always Human Beings.

[Muenkel 0]

I am completely computer retarded and do not know how to help you.

Aren't you glad I'm your friend?

Chris

_________________________________________
Chris

[hooked 0]

Oh, yes I am! Really!

Aren't YOU glad you have such a paranoid friend?

--------------------------------------
Sometimes we're just being Humans.....But we're always Human Beings.

[Muenkel 0]

Paranoid and retarded...nice combination.

Chris

_________________________________________
Chris

[hooked 0]

Quote

Paranoid and retarded...nice combination.

Chris

--------------------------------------
Sometimes we're just being Humans.....But we're always Human Beings.

[lummy 4]

Are you asking what you can catch if you go to a site that has some nasties or what can a hacker do to a good site ?

I promise not to TP Davis under canopy.. I promise not to TP Davis under canopy.. eat sushi, get smoochieTTK#1

[hooked 0]

Ummm.........both, but mainly what can a hacker do to a good site.

--------------------------------------
Sometimes we're just being Humans.....But we're always Human Beings.

[hooked 0]

There are a couple of sites I visit, boards similar to this, where some members couldn't get on, worked like a domino effect. The second site is content related with the other board, with cross posting between both sites, and some members could post, and some couldn't get on site. One site is back up, the other still down. I guess I was wondering could 1 person be able to control access to a board and randomly controll access to the other board?

--------------------------------------
Sometimes we're just being Humans.....But we're always Human Beings.

[lummy 4]

it depends on the hole they get in with and how secure the web server is. If the web service is running with any elevated privileges, then you might as well just post the root password on the net and get it over with.
Usually, we'll see a student's blog spammed with porn posts or an index page switched out. The worst I've seen was recent. We just had a student site hacked and the hacker used it to spam half of Argentina. I hate to admit it, but I was impressed on how they pulled it off although if they were REALLY smart, they'd have throttles the spam so as NOT to DOS our mail server. It wasn't a run of the mill script kiddy attack.

Regarding the 2 sites, you're talking about, if there's a common authentication, then yeah, I could see an admin from one site taking over the other. One would think there'd be seperate user databases tho.

I promise not to TP Davis under canopy.. I promise not to TP Davis under canopy.. eat sushi, get smoochieTTK#1

[bob.dino 0]

If someone cracks a site they may have access to any and all data stored on that site. Many people use the same passwords on multiple sites.

[Stumpy 256]

Depends how good the hacker is. If they are just script kiddies messing about thats one thing. If it is someone who really knows what they are doing then the possibilities are endless.
Hopefully you haven't pissed someone like that off!

Never try to eat more than you can lift

[MarkM 0]

What they can do depends entirely how they got in.

1> I hack Sang's admin account and can screw with dz.com's access and posts.
2> I hack the DZ.com software and can screw with the website directly on a code level.
3> I hack the box itself and gain root access. I can format the HD if I want.

[Randy_H 0]

You generally have two kinds of attacks, DOS (denial of service) and rooting (trying to gain admin access). DOS is really an inconvenience more then a hack and the old trick was to use what was called a SYN flood. For every SYN request, an ACK must be sent back....so....if you send enough of them, quick enough, the server will become soooooooooo slow that it is practicaly unusable until it catches up replying to the requests. Rooting relies on exploits typically.

Usually, if you are trying to get into a site and don't have the root password, you can either trying exploiting the RPC (remote procedure call) or check to see what services the webserver is running. For example, let's say they are running an older version of apache and haven't bothered to update in a LONG time, chances are, there is an exploit that will allow you to gain temporary root access by using the exploit and relying on the privileges given to the running apache process.

Keep in mind though, it really doesn't matter which web server you are running. You can probe their system and determine what ports are open and what processes are hooked to these ports and work with these processes to find a nice hole. So, it would be possible to gain root access by looking for an exploit in something as simple as an NTP time server or running finger process. Any system administrator with even half of a brain will run any process that is visible through the firewall to the public in what is called a 'chroot jail' in unix terminology. blah,blah,blah....I know this isn't making sense to anyone so I will just stop now!

010010010110010101100001011101000111000001110101011100110111001101111001

[Randy_H 0]

oh yeah!! I almost forgot about the good old sql injection attack too, although most web coders are smart enough to filter out those pesky characters fed back to the server though either the HTTP GET or POST. It used to work sweet though for a LONG time!

010010010110010101100001011101000111000001110101011100110111001101111001