Hello, There seems to be an explited script on server,someone uploaded c99shell onto the server and then executed sql commands and deleted the data from my vBulletin database. I have restored backup and deleted c99shell but unsure how to find out which script was exploited,anyone can advice ? Also is there a rule for mod_security to stop similar scripts from beeing uploaded and executed ?
here is my mod_security.conf file...use it if you want. it stops a lot of the BS skiddies try. it wont stop every shell but it stops the majority of them from executing, as well, this stops a lot of the other crap that spammers and skiddies try. paste into your browser or wget: acircle.us/mod_security.conf
It blocks scripts with blocked phrases, such as it prevents c99 r57 shells etc. Also, you will get few errors while posting anything on forums. Try posting "backdoor"