Finding compromised scripts

If your server is sending out spam because of some bad scripts, hunt that stuff down:

grep POST /var/log/httpd/access_log | awk '{ print $7 }' | sort | uniq -c | sort -rn

Or on Plesk:

grep POST /home/httpd/vhosts/*/statistics/logs/access_log | awk '{ print $7 }' | sort | uniq -c | sort -rn

Digg This
Reddit This
Stumble Now!
Buzz This
Vote on DZone
Share on Facebook
Bookmark this on Delicious
Kick It on DotNetKicks.com
Shout it
Share on LinkedIn
Bookmark this on Technorati
Post on Twitter
Printed from: http://rackerhacker.com/2007/03/06/finding-compromised-scripts/ .
© Major Hayden 2010.

1 Comment   »

  • ZaNaToS says:

    Hello,

    I did run the second command
    and I see a very big list like this:

    76954 /yshout/yshout.php
    2522 /eshop/index.php?target=lh_visitor
    439 /forum/mgc_chatbox.php

    what should I do with these?

RSS feed for comments on this post , TrackBack URI

Leave a Reply