Page 1 of 2 12 LastLast
Results 1 to 10 of 14

Thread: New to forum, need help with hacker to website

  1. #1
    Junior Member
    Join Date
    May 2004
    Posts
    5

    Unhappy New to forum, need help with hacker to website

    Hello,

    I have a website that was hosted on another server that someone is hacking into and getting copies of submitted forms from the site. The web server company claims that the security hasn't been breached yet there is no other way he could have gotten these files.

    My hacker claims he used a "spider?" that he put on the website. Does this make sense to anyone? Your help or comments are greatly appreciated.
    If you are being run out of town....get in front of the crowd and make it look like a parade.

  2. #2
    Senior Member
    Join Date
    Mar 2004
    Location
    Colorado
    Posts
    421
    If your site contains content that can be indexed by common site spiders, then the claim might be correct.

    Can you be more specific and offer up and example?

  3. #3
    First off, let me say for the benefit of senior members that yes, I am being one of those annoying people giving advice and not knowing what he's talking about. I'm going to try anyway though!

    Don't spiders rely on metatags to find information? That being the case, will our answer lie somewhere in there?

  4. #4
    Ninja Code Monkey
    Join Date
    Nov 2001
    Location
    Washington State
    Posts
    1,027
    Spidering applications are apps that go and collect all content they can find on a website and index it or save it locally. Alot of search engines use this type of software to crawl through websites and collect their info.

    Generally you can stop most spiders or bots from accessing certain content via a robots.txt file in your root web directory with the appropriate settings. This is more of a guideline however and people are open to ignoring it in their apps. robots.txt tutorial - http://www.searchengineworld.com/rob...s_tutorial.htm

    If you have content that a web spider should not access ever (nice or not) then you will probably want to add a better authentication/access control system to your website for those files. Simply hiding them in a directory on your website doesn't always stop people from accessing the files.

    You might also look into a better way to keep your form submissions such as sending them to yourself via email for later processing. Here is a decent enough example - http://www.htmlgoodies.com/tutors/forms.html

    If you really feel spunky you can do some database work to hold your form submissions. I would really recommend reading up before you take this route however.


    Angelic > while spiders may use meta tags to find info or for grabbing specific bits of info for indexing....not all do. Many will try for a directory listing from the web server (turning off directory browsing helps), they also munge through the html of the page itself and can determine the basic structure of your directory heirarchy, links to other pages, etc. Some are even built to look for specific information such as emails, phone #'s, etc for later use.
    "When I get a little money I buy books; and if any is left I buy food and clothes." - Erasmus
    "There is no programming language, no matter how structured, that will prevent programmers from writing bad programs." - L. Flon
    "Mischief my ass, you are an unethical moron." - chsh
    Blog of X

  5. #5
    Senior Member
    Join Date
    Mar 2004
    Location
    Colorado
    Posts
    421
    Yea, robots.txt may be your way to go.
    If you have questions on that, post the contents of your robots.txt
    I'll be we can help you.

  6. #6
    Junior Member
    Join Date
    May 2004
    Posts
    5
    Thank you all so much for your responses :-)
    I unfortunately don't have alot of information about this would be hacker in that he is a customer of one of my clients and she doesn't want to give me any more information other then he accessed these files.

    I do have the form set up to submit to an email address only, not to a database. Could you tell me if these completed forms continue to reside on the server after they have been mailed? The website is now temporarily down, however, I did in fact embed metatags for the search engines to find it. Now I wonder if the completed forms will be visible...ugh

    Thanks again for your help :-)
    If you are being run out of town....get in front of the crowd and make it look like a parade.

  7. #7
    Another way of describing a spider is to think of it as a specific piece of software designed to find exactly this kind of vulnerability in your site. In other words, a spider can be a multi-threaded URL fetcher that would automatically traverse every document on your website in order to retrieve locations of documents which you may not intend others to view, but which are not restricted by permissions. If your form submissions are stashed in the open in your web directory then there is, in essence, no security breach of your site. At least not as far as your hosting company is concerned.

  8. #8
    Senior Member
    Join Date
    Mar 2004
    Location
    Colorado
    Posts
    421
    Originally posted here by Island Time
    Thank you all so much for your responses :-)
    I unfortunately don't have alot of information about this would be hacker in that he is a customer of one of my clients and she doesn't want to give me any more information other then he accessed these files.

    I do have the form set up to submit to an email address only, not to a database. Could you tell me if these completed forms continue to reside on the server after they have been mailed? The website is now temporarily down, however, I did in fact embed metatags for the search engines to find it. Now I wonder if the completed forms will be visible...ugh

    Thanks again for your help :-)
    Some form handlers do infact email submission material and write info to a text file.

  9. #9
    Senior Member
    Join Date
    Aug 2003
    Posts
    1,018
    What I am not understanding in all this is, How did you get in contact with the hacker? Did he just email you out of the blue? Is he/she telling you that you have a security problem out of the goodness of their heart?

    What I see so far is something like this "Hi, I'm a burglar that just stole your jewlery, and here are the polaroids to prove it"


  10. #10
    Junior Member
    Join Date
    May 2004
    Posts
    5
    Yes groovicus you are absolutely correct.
    I develope websites and one of my clients is a builder that deals with hundreds of Realtors in the Orlando area. There is a bidding war going on over property in the Disney area of which my builder has lots for sale.

    The person that hacked into my website (claiming to want to prove to the builder the lack of security and help her out) was actually wanting the contact forms (leads). My builder, doesn't want to anger this Realtor and lose business but she wants a secure website. I'm rather stuck in the middle not being given any information accept what I've mentioned above.

    I do think, however, it souds as if these forms are in fact being saved to a text file and I'm going to be changing that.
    Thank you all again for your help, this site is a wonderful resource....
    If you are being run out of town....get in front of the crowd and make it look like a parade.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •