Waraxe IT Security Portal

ravaneli · Regular user

Hey peeps, how's everyone doin'? I hope everyone's fine... I'm building a site and would like to make sure that it's as secure as possible. Aside from making it secure, I would like to write an algorithm to detect hackers/crackers activity.

So, I would like to propose this topic to anyone who might want to discuss things like what a hacker/cracker would do once they gain access of your site (be it through cracking techniques, social engineering or whatever). This will hopefully help me and others to create algorithms that would be useful in detecting this kind of thing.

I don't know if this topic is interesting to everyone, but I gave that idea a good amout of thought and hopefully I'd get good input from all the people here.

Thanks in advance to everyone that will contiribute.

waraxe · Site admin

Can you give me more of the background details - will you use a particular CMS or write your own custom code and which language will you use (php, perl, mysql,etc)? What operating system - linux or wind0ws? Will you be using your own server or will it be virtually hosted from a hosting server, etc...?

ravaneli · Regular user

Well, I kinda wanted to keep this a general topic so everyone can just dish out what they have... this way, there will be as much information as possible and it's just limited to one thing. So if someone knows something about hackers and CMS's, then they would talk about that for example.

But if you really want to be specific, I was looking more towards CMS.

Wink

If you think I should be more specific than that, let me know.

ravaneli · Regular user

Oh, and PHP is the language I'll be using, with custom code...

waraxe · Site admin

One thing is for sure - hackers will first attempt to get admin status at scripting level. They can steal cookies or inject sql queries to gather admins username and password hash. Next they will try to log in as admin/moderater or authenticate through faked cookies.
So here is my suggestion - you can write a script, which checks ip addresses of all admin/moderator login attempts and any administration/moderation operations. Of course, if admins/moderators have dynamical ip addresses, then it is not such an effective measure
because full ip ranges must be allowed, but anyway - you can
1. restrict admin/mode level access by unknown ip ranges
2. log it to intrusion detection system, you are talking about
3. ban ip addresses/ranges for those attempts automatically

b0ilz · Regular user

I think most hackers care more for shell access than admin access. Once they have this they might touch files which hold login, network, and command logs. They will probably also try to download exploits or echo/cat exploits into a file. then they will use an interpreter or compiler to get the exploit to work. And finally they will download and setup their rootkit/backdoor.

this is generic in no perticular order. You can find things like this on the honeynet page.