Hello,
I need a way to find how hackers sometime get into a website and change files, what would you suggest me ?

Thank you

I never used tools like Snort for intrusion detection, i hope this will be helpful to you.
https://www.snort.org/
go ahead and understand it.

if the "cracker" ( not hacker ) dose there job right, you will almost NEVER know they are there .

now "script kiddies" on the other hand , they do leave evidence all over the place .

and Snort WILL show them .

For what purpose if I may ask? If files changed then getting the hashes from the original software and running them against 'md5deep -r -x' could be a quick start. But if this is thought to be part of "regular maintenance" then I suggest you change your strategy to a more active one and guard against having old or vulnerable installed software versions first. As in combating the cause, not just symptoms.

2 members found this post helpful.

Absolutely agree with unSpawn. The best suggestion would be for you to properly secure your server/network. Snort is a good tool, but you have to use it as part of a larger strategy. Firewalls, DMZ's, etc., all need to play a part, along with proper systems security.

Think of it as a house; if you leave the doors unlocked and the windows wide open, it's VERY hard to see how someone got in. Lock things up, and put an alarm on, you can EASILY see a broken window, know which door was opened, etc. This is no different...the more layers between your server and the Internet, the harder it is..and each layer will get you traces on how things were broken.

I think the problem relies on the web application code. There must be some bug and checking all parameters would be difficult due it is a large application

This is an absolutely HORRIBLE approach to this problem...you're essentially saying:

• You don't know what the problem(s) are
• You don't know WHERE the problem(s) are
• Since it's a 'large application', it's alot of effort to check, and you don't seem to plan on checking it.

Please, don't wonder why your site has problems. If you are serious about securing it, then you have one option: work hard, find the holes, bugs, and vulnerabilities, and FIX THEM. That's the job of a systems administrator...if you're also the web programmer, then you have to fix THAT too.

1 members found this post helpful.