Security question - php/mysql  - hack

debbieau1
debbieau1 used Ask the Experts™
on
A chinese company has been trying to hack our site.  I have recorded all activity and would appreciate advice to ensure our security integrity is maintained.

They are trying to run the following scripts (this is just a sample, there are lots more they are trying to run).  

They started off with

/muieblackcat

then tried lots of others including
//_myadmin/scripts/setup.php
//phpmya/scripts/setup.php
//admin/my/scripts/setup.php
//mysql2/scripts/setup.php
//phpmyadm/scripts/setup.php
//php1/scripts/setup.php
//webmail2/scripts/setup.php
//pma_mydb/scripts/setup.php

Any ideas exactly what they are after, and the best way to protect ourselves.

We just want to get on with business and it's really frustrating having to deal with idiots like this.

We don't have anything in there of value, it's just a nuisance and costs time.

I would appreciate advice from people who are really strong in security (ideally reformed hackers).  It seems they are after database and trying to setup

I am just wanting to make sure we are as best protected as possible.  We have non standard naming conventions for files and path, use form validation, etc.

I am particularly interested what motivates these people and what I can do to prevent them getting access.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Frontend developer
Commented:
It's a standard scan for well known administration programs and their usual names/urls, like phpMyAdmin.  Once they have a valid response for one of these requests (like something else than 404) they'll try to go for the specific thing and its weak spots.  Check all the file/directory rights and owners, make VERY sure that no one is able to write any important directory as www-data, watch out for scripts dealing with passwords (disable error messages that could possibly reveal passwords - redirect all error messages to a logfile outside the web document tree), etc.

95% of these attacks go for known open-source scripts security holes; maybe get some fresh updates for whatever you use.  AND!  If you have a chance, log all mysql queries containing comment signs, coded character strings or the UNION keyword.  Many attacks rely on these.  You can find lots of sites about "mysql injection", read them to know what's out there.

Nothing happened so far - at least I hope so -, don't panic.
Most Valuable Expert 2011
Top Expert 2016
Commented:
Probably script kiddies.  Do these attacks all come from the same IP address?  You might ask your hosting company to block that address.

Author

Commented:
Yes, they do.

Thanks to both of you for the feedback.  What is a script kiddie?  Are these just automated scripts.
Learn SQL Server Core 2016

This course will introduce you to SQL Server Core 2016, as well as teach you about SSMS, data tools, installation, server configuration, using Management Studio, and writing and executing queries.

Author

Commented:
Both feedback very useful thanks
Most Valuable Expert 2011
Top Expert 2016

Commented:

Author

Commented:
Thanks very much.  Interesting reading

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial