I've Been Hacked, Now What
summary
Investigation focuses on concrete signs not topic fluff: find injected code in .htaccess or uploads, identify obfuscated eval/base64/url_decode strings, and discover that one line can drop a full admin panel backdoor that lets attackers FTP create users and run brute force. Use stat/ls -lc to get ctime, find and grep for the encoded snippets, run wp-scan or WordPress exploit scanners, and note ~80% automated versus ~20% manual attacks. Clean by overwriting core, restore from offsite backup, and change all passwords and SSH keys.
AI-written summary · about
chapters (12)
- 0:00Start
- 7:06Commonly Injected Files
- 8:21htaccess file
- 11:40What Does the Bad Stuff Do?
- 15:18WordPress Scanning Help
- 16:55Get Cleaning - WordPress
- 18:21After Everything is Clean
- 19:11Set Up Monitoring
- 20:12Common Entry Points
- 21:34Backup Files
- 22:20Check Your Code
- 25:11Resources
related talks
43mI Had WordPress, but It Got Hacked
33mThe Anatomy of a Hack 24 Hours in the DevSecOps ER
39mHow to think like a hacker
38mHackers Gonna Hack: Identifying and Fixing Vulnerabilities Proactively
01h 01mHow hacking works - Web edition
40mHow to hack a node app?
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
47mLive Hacking: Breaking into Your Web App