Web site was hung after a horse fright 1 hours experience

Intermediary transaction http://www.aliyun.com/zixun/aggregation/6858.html ">seo diagnose Taobao guest cloud host technology Hall

Some time ago took over a picture site, found that there are many places worth improving, so the program added a lot of features, easy to use. However, the competitor's supercilious look, because our site is set outside the chain and browse together, set free and collection of albums.

Tuesday to get up, according to the Convention to open the site, but found that the site suddenly pop-up a window, and antivirus software also jumped out. I found a horror that I do not want to accept the reality: The site is dead! Immediately called to the programmer, said the site was Hung horse, to immediately clear, consider to browse the site users to bring a lot of inconvenience, so a silent battle began immediately.

I first opened the FTP, found that the file inside has not been modified, in general, most of the horse is a hacker intrusion into the modified program files, placed in the code. But this time it is strange, the file inside the modification time is not changed before. At this point the programmer feeds the message, most likely the SQL injection. So I immediately opened the SQL database, found inside, many fields are densely packed.

Code, this is the legendary SQL injection, hehe, finally found the reason, and then use the SQL statements in bulk to replace the code.

Note that the underscore section is a database table name and a field name, and you should replace it flexibly.

Although said to be injected more, but with the bulk of the deletion still does not cost much time. The site is back to normal, but I can't relax because I can't find the root cause. Does anyone know my background password? Does anyone know my SQL password? Or did someone upload a trojan program or upload a malicious code?

After a careful investigation, and finally ruled out the first three possible, and finally found our web site procedures, a lot of posts inside the letter, BBS, as well as modify the photo album data can be sent this kind of script statement. What a careless thing to do. So the programmer put all this text document (hackers can use this upload malicious code) have been patched, blocked the loophole, quote a very classic line: safety first. The method is simply to filter out the script. Looking up at the busy traffic outside the window, finally can comfortably breathe a morning air.

Thanks to CCTV, thanks to the black hackers, thank you for watching the stickers, not the experience of the hanging, nor my growth. Thank you.

Finally summed up a few sites are commonly used after the black steps, hoping to bring help to everyone:

First, found that the site is abnormal, immediately shut down the site, so as not to browse the site's users are affected;

Second, look at the file in the FTP modified time to see if there has been changed, there is no injection of malicious code. If so, please delete it;

Third, look at the database file, see if there is no field injected malicious code, and some words are deleted in batches with SQL statements;

After deleting malicious code, it is important to check where the problem is. Is the server has a loophole, or the program has problems, to find the problem must be patched, so as not to have similar accidents occurred. If you do not understand the program code, here to introduce a master programmer's qq:850268891;

Keep a good mentality, sum up experience and lessons, and then try again.

This article for the original, welcome to reprint, but must be accompanied by Web site: 126 free Album network: www.126tu.com