Spam - Revision history

Admin: /* Spam from Scripts */

2017-10-25T03:35:23Z

Spam from Scripts

← Older revision		Revision as of 03:35, 25 October 2017
Line 1:		Line 1:
	How to find and stop spam.		How to find and stop spam.

	== ~~Spam from~~ Scripts ==		== Find Scripts that are spamming ==

	Find files that have a starting or ending line with a ~~rediculous~~ amount of characters: (probably a hacked page)<br />		Find files that have a starting or ending line with a ridiculous amount of characters: (probably a hacked page)<br />
	<pre>		<pre>
	find `pwd` -type f -name '*.php' ! -perm 000 \| while read FILE; do FIRST_LINE_BYTES=$(head -n1 $FILE \| wc -c); LAST_LINE_BYTES=$(tail -n1 $FILE \| wc -c); echo -e "$FIRST_LINE_BYTES $FILE\n$LAST_LINE_BYTES $FILE" ;done \| sort -n \| uniq		find `pwd` -type f -name '*.php' ! -perm 000 \| while read FILE; do FIRST_LINE_BYTES=$(head -n1 $FILE \| wc -c); LAST_LINE_BYTES=$(tail -n1 $FILE \| wc -c); echo -e "$FIRST_LINE_BYTES $FILE\n$LAST_LINE_BYTES $FILE" ;done \| sort -n \| uniq
	</pre>		</pre>


			Find mail in the mail queue that's sent from a php script:<br />
			<code>find /var/spool/exim/input/0/ -name '*-H' \| xargs grep -i 'X-PHP-Originating-Script' \| awk '{print $2,$3}' \| cut -d\( -f1\| sort -u </code>

			== Find where the spamming script came from ==

	Use Filescout to find where the bad file came from:<br />		Use Filescout to find where the bad file came from:<br />
	https://mattjung.net/wiki/filescout/		https://mattjung.net/wiki/filescout/


	== Clean up ==		== Clean up ==
	Remove bouncebacks from the queue:<br />		Remove bouncebacks from the queue:<br />
	<code>exiqgrep -i -f '<>' \| xargs exim -Mrm</code>		<code>exiqgrep -i -f '<>' \| xargs exim -Mrm</code>

Admin at 20:54, 23 October 2017

2017-10-23T20:54:07Z

← Older revision		Revision as of 20:54, 23 October 2017
Line 9:		Line 9:


	Use Filescout:		Use Filescout to find where the bad file came from:<br />
	https://mattjung.net/wiki/filescout/		https://mattjung.net/wiki/filescout/


			== Clean up ==
			Remove bouncebacks from the queue:<br />
			<code>exiqgrep -i -f '<>' \| xargs exim -Mrm</code>

Admin: /* Spam from Scripts */

2017-10-12T02:00:54Z

Spam from Scripts

← Older revision		Revision as of 02:00, 12 October 2017
Line 7:		Line 7:
	find `pwd` -type f -name '*.php' ! -perm 000 \| while read FILE; do FIRST_LINE_BYTES=$(head -n1 $FILE \| wc -c); LAST_LINE_BYTES=$(tail -n1 $FILE \| wc -c); echo -e "$FIRST_LINE_BYTES $FILE\n$LAST_LINE_BYTES $FILE" ;done \| sort -n \| uniq		find `pwd` -type f -name '*.php' ! -perm 000 \| while read FILE; do FIRST_LINE_BYTES=$(head -n1 $FILE \| wc -c); LAST_LINE_BYTES=$(tail -n1 $FILE \| wc -c); echo -e "$FIRST_LINE_BYTES $FILE\n$LAST_LINE_BYTES $FILE" ;done \| sort -n \| uniq
	</pre>		</pre>


			Use Filescout:
			https://mattjung.net/wiki/filescout/

Admin: Created page with "How to find and stop spam. == Spam from Scripts == Find files that have a starting or ending line with a rediculous amount of characters: (probably a hacked page)

2017-02-07T01:17:55Z

Created page with "How to find and stop spam. == Spam from Scripts == Find files that have a starting or ending line with a rediculous amount of characters: (probably a hacked page)<br /> <pre..."

New page
How to find and stop spam.

== Spam from Scripts ==

Find files that have a starting or ending line with a rediculous amount of characters: (probably a hacked page)<br />
<pre>
find `pwd` -type f -name '*.php' ! -perm 000 | while read FILE; do FIRST_LINE_BYTES=$(head -n1 $FILE | wc -c); LAST_LINE_BYTES=$(tail -n1 $FILE | wc -c); echo -e "$FIRST_LINE_BYTES $FILE\n$LAST_LINE_BYTES $FILE" ;done | sort -n | uniq
</pre>