I think this directory has been hacked

Discussion in 'Site & Server Administration' started by kentuckyslone, Jul 18, 2007.

  1. #1
    Hello everyone,

    I am getting an error when I try to go to this directory.

    I checked the error log and found this:

    "Options FollowSymLinks or SymLinksIfOwnerMatch is off which implies that RewriteRule directive is forbidden"

    Any ideas on how someone was able to do this and what I need to do to get it corrected?

    THANKS!
     
    kentuckyslone, Jul 18, 2007 IP
  2. Will.Spencer

    Will.Spencer NetBuilder

    Messages:
    14,789
    Likes Received:
    1,040
    Best Answers:
    0
    Trophy Points:
    375
    #2
    Check the Options settings in your httpd.conf, httpd-vhosts, and .htaccess files.
     
    Will.Spencer, Jul 18, 2007 IP
    kentuckyslone likes this.
  3. DavidAusman

    DavidAusman Peon

    Messages:
    399
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Maybe you can use .htaccess to switch ON your Options FollowSymLinks and others to see how things work. If it still shows error, then you might want to check it at httpd.conf
     
    DavidAusman, Jul 19, 2007 IP
    kentuckyslone likes this.
  4. kentuckyslone

    kentuckyslone Notable Member

    Messages:
    4,371
    Likes Received:
    367
    Best Answers:
    0
    Trophy Points:
    205
    #4
    There is no mention of FollowSymLinks in my htaccess

    I havent been able to locate an httpd.conf
     
    kentuckyslone, Jul 19, 2007 IP
  5. Will.Spencer

    Will.Spencer NetBuilder

    Messages:
    14,789
    Likes Received:
    1,040
    Best Answers:
    0
    Trophy Points:
    375
    #5
    Maye there should be. :)

    If you have shell access, just use this command:
    find / -name httpd.conf -print
    Code (markup):
     
    Will.Spencer, Jul 19, 2007 IP
  6. kentuckyslone

    kentuckyslone Notable Member

    Messages:
    4,371
    Likes Received:
    367
    Best Answers:
    0
    Trophy Points:
    205
    #6
    YES! I found the problem with your help. I compared the original htaccess file with the one on my server - and guess what they were very different. I changed it back to the way it was and now the directory is working normally.

    How did someone alter my htaccess file?
     
    kentuckyslone, Jul 19, 2007 IP
  7. DavidAusman

    DavidAusman Peon

    Messages:
    399
    Likes Received:
    6
    Best Answers:
    0
    Trophy Points:
    0
    #7
    I don't think anyone could alter you .htaccess, maybe you had forgotten to change it back when you do some testing ;)
     
    DavidAusman, Jul 20, 2007 IP
  8. kentuckyslone

    kentuckyslone Notable Member

    Messages:
    4,371
    Likes Received:
    367
    Best Answers:
    0
    Trophy Points:
    205
    #8
    Someone did change it. The directory in question has been up and running for quite some time. Only the day before this happened it was working fine.

    How could I change the htaccess and then forget that i had done it :D
     
    kentuckyslone, Jul 20, 2007 IP