Printable View
Hello,
I have a website that was hosted on another server that someone is hacking into and getting copies of submitted forms from the site. The web server company claims that the security hasn't been breached yet there is no other way he could have gotten these files.
My hacker claims he used a "spider?" that he put on the website. Does this make sense to anyone? Your help or comments are greatly appreciated.
If your site contains content that can be indexed by common site spiders, then the claim might be correct.
Can you be more specific and offer up and example?
First off, let me say for the benefit of senior members that yes, I am being one of those annoying people giving advice and not knowing what he's talking about. ;) I'm going to try anyway though!
Don't spiders rely on metatags to find information? That being the case, will our answer lie somewhere in there?
Spidering applications are apps that go and collect all content they can find on a website and index it or save it locally. Alot of search engines use this type of software to crawl through websites and collect their info.
Generally you can stop most spiders or bots from accessing certain content via a robots.txt file in your root web directory with the appropriate settings. This is more of a guideline however and people are open to ignoring it in their apps. robots.txt tutorial - http://www.searchengineworld.com/rob...s_tutorial.htm
If you have content that a web spider should not access ever (nice or not) then you will probably want to add a better authentication/access control system to your website for those files. Simply hiding them in a directory on your website doesn't always stop people from accessing the files.
You might also look into a better way to keep your form submissions such as sending them to yourself via email for later processing. Here is a decent enough example - http://www.htmlgoodies.com/tutors/forms.html
If you really feel spunky you can do some database work to hold your form submissions. I would really recommend reading up before you take this route however.
Angelic > while spiders may use meta tags to find info or for grabbing specific bits of info for indexing....not all do. Many will try for a directory listing from the web server (turning off directory browsing helps), they also munge through the html of the page itself and can determine the basic structure of your directory heirarchy, links to other pages, etc. Some are even built to look for specific information such as emails, phone #'s, etc for later use.
Yea, robots.txt may be your way to go.
If you have questions on that, post the contents of your robots.txt
I'll be we can help you.
Thank you all so much for your responses :-)
I unfortunately don't have alot of information about this would be hacker in that he is a customer of one of my clients and she doesn't want to give me any more information other then he accessed these files.
I do have the form set up to submit to an email address only, not to a database. Could you tell me if these completed forms continue to reside on the server after they have been mailed? The website is now temporarily down, however, I did in fact embed metatags for the search engines to find it. Now I wonder if the completed forms will be visible...ugh
Thanks again for your help :-)
Another way of describing a spider is to think of it as a specific piece of software designed to find exactly this kind of vulnerability in your site. In other words, a spider can be a multi-threaded URL fetcher that would automatically traverse every document on your website in order to retrieve locations of documents which you may not intend others to view, but which are not restricted by permissions. If your form submissions are stashed in the open in your web directory then there is, in essence, no security breach of your site. At least not as far as your hosting company is concerned.
Some form handlers do infact email submission material and write info to a text file.Quote:
Originally posted here by Island Time
Thank you all so much for your responses :-)
I unfortunately don't have alot of information about this would be hacker in that he is a customer of one of my clients and she doesn't want to give me any more information other then he accessed these files.
I do have the form set up to submit to an email address only, not to a database. Could you tell me if these completed forms continue to reside on the server after they have been mailed? The website is now temporarily down, however, I did in fact embed metatags for the search engines to find it. Now I wonder if the completed forms will be visible...ugh
Thanks again for your help :-)
What I am not understanding in all this is, How did you get in contact with the hacker? Did he just email you out of the blue? Is he/she telling you that you have a security problem out of the goodness of their heart?
What I see so far is something like this "Hi, I'm a burglar that just stole your jewlery, and here are the polaroids to prove it"
:confused:
Yes groovicus you are absolutely correct.
I develope websites and one of my clients is a builder that deals with hundreds of Realtors in the Orlando area. There is a bidding war going on over property in the Disney area of which my builder has lots for sale.
The person that hacked into my website (claiming to want to prove to the builder the lack of security and help her out) was actually wanting the contact forms (leads). My builder, doesn't want to anger this Realtor and lose business but she wants a secure website. I'm rather stuck in the middle not being given any information accept what I've mentioned above.
I do think, however, it souds as if these forms are in fact being saved to a text file and I'm going to be changing that.
Thank you all again for your help, this site is a wonderful resource....
I was just reading about spiders this morning. I found a really good article that tells what they are used for and ways for you to get around them. Juridian gave some good info with links but you might find this article usefull as well.
This is not my area, but I can give advice I know nothing about along with the best of them. :p
Call any Web-Hosting service in your area. Tell them about your problem. Ask what they can do to help.
Call your current Web-Hosting service . Inform them that confidential data has indeed been accessed on a website they are hosting, that it has been sufficiently proven, and that since they apparently don't have the capabilities to monitor access to the content, you will no longer require their services?
I don't know what kind of service agreement you have with them, but it would be a good idea to review it. IMHO, they should be responsible for security on their server. They should also be responsible for making sure your site has been programmed in such a manner that it won't make their company look bad by being hacked.
I was so friendly to go out and capture that spider for you ... :D
Enjoy,
Thank you all for the advise and web sources!
And a special thanks to .: Shrekkie :. for capturing my spider :-)
It's a sunny day in northwest Florida I hope you all enjoy the same ............