Security and Performance FAQs - Revision history

ZerpTiger at 20:41, 14 May 2013

2013-05-14T20:41:13Z

ZerpTiger at 20:39, 14 May 2013

2013-05-14T20:39:59Z

ZerpTiger at 20:35, 14 May 2013

2013-05-14T20:35:02Z

Hutchy68: removing reference, which included who page transclusion to Moving Files Outside of Root

2012-11-26T12:46:57Z

removing reference, which included who page transclusion to Moving Files Outside of Root

Phild: /* Where can I learn more about file permissions? */ added internal links replacing external links (same content)

2012-10-09T00:47:04Z

‎Where can I learn more about file permissions?: added internal links replacing external links (same content)

Phild: /* Where can I learn more about file permissions? */ added internal link replacing external link (same content)

2012-10-08T23:05:42Z

‎Where can I learn more about file permissions?: added internal link replacing external link (same content)

Phild: /* Where can I learn more about file permissions? */ removed external links in policy violation pending replacement

2012-10-08T23:01:22Z

‎Where can I learn more about file permissions?: removed external links in policy violation pending replacement

JoomlaWikiBot: clean up categories with tags

2012-09-01T21:15:25Z

clean up categories with <noinclude> tags

Show changes

Xamfap at 00:35, 19 November 2011

2011-11-19T00:35:26Z

Cadrlp: /* What are these strange (URL-Encoded) characters doing in my code? */ (class="wikitable")

2011-09-26T23:01:32Z

‎What are these strange (URL-Encoded) characters doing in my code?: (class="wikitable")

@@ Line 1,366: / Line 1,366: @@
 # '''Delete related database records:''' This step may only be possible if you have good backups. Simple script kiddies, who are only trying to mark your index page, may not attack your database, but professionals are usually very interested in confidential data, such as passwords. They may pose as script kiddies to avoid suspicion while repeatedly harvesting confidential information from your database.
 # '''Reinstall everything:''' Use pre-crack backups. If you don't have good backups, reinstall everything anyways.
-# '''Reset critical passwords again:''' You must reset your passwards again now that your server is finally cleaned of any possible, hidden trojan horses.
+# '''Reset critical passwords again:''' You must reset your passwords again now that your server is finally cleaned of any possible hidden trojan horses.
 # '''Rebuild site:''' If you are unable to rebuild from clean backups, rebuild your entire site using original, pre-crack installs. Use only the latest stable versions of all software, and check the List of Vulnerable Extensions
 # '''Review security processes:''' Follow standard security precautions for important settings in php.ini, globals.php, configuration.php, .htaccess, etc.

@@ Line 1,365: / Line 1,365: @@
 # '''Delete the entire public_html directory:''' This is the best way to guarantee that every potential vulnerability in that site is removed.
 # '''Delete related database records:''' This step may only be possible if you have good backups. Simple script kiddies, who are only trying to mark your index page, may not attack your database, but professionals are usually very interested in confidential data, such as passwords. They may pose as script kiddies to avoid suspicion while repeatedly harvesting confidential information from your database.
-# '''Reinstall everything:''' Use pre-crack backups. If you don't have good backups, go on to step 10.
+# '''Reinstall everything:''' Use pre-crack backups. If you don't have good backups, reinstall everything anyways.
 # '''Reset critical passwords again:''' You must reset your passwards again now that your server is finally cleaned of any possible, hidden trojan horses.
 # '''Rebuild site:''' If you are unable to rebuild from clean backups, rebuild your entire site using original, pre-crack installs. Use only the latest stable versions of all software, and check the List of Vulnerable Extensions

@@ Line 1,362: / Line 1,362: @@
 # '''Note suspicious recently-modified files:''' Check the modified files list for any files that were recently changed. Pay particular attention to the modification, and correlate them to the dates of attacks shown in your log files.
 # '''Check for bogus CRON Jobs:''' Hacked cron jobs can be setup to reinfect your site over and over again.
-# '''Coordinate with your host:''' If you have identified how you were cracked, report the method to your host. If you are on a shared server, you may habe been attacked through another vulnerable site on your server. Report this to your host. A reputable host will appreciate your efforts in this area.
+# '''Coordinate with your host:''' If you have identified how you were cracked, report the method to your host. If you are on a shared server, you may have been attacked through another vulnerable site on your server. Report this to your host. A reputable host will appreciate your efforts in this area.
 # '''Delete the entire public_html directory:''' This is the best way to guarantee that every potential vulnerability in that site is removed.
 # '''Delete related database records:''' This step may only be possible if you have good backups. Simple script kiddies, who are only trying to mark your index page, may not attack your database, but professionals are usually very interested in confidential data, such as passwords. They may pose as script kiddies to avoid suspicion while repeatedly harvesting confidential information from your database.

← Older revision		Revision as of 12:46, 26 November 2012
Line 513:		Line 513:

	.DS. = Directory Seperator		.DS. = Directory Seperator
−
−	~~==Moving sensitive files outside the web root==~~
−	~~{{:Moving sensitive files outside the web root}}~~
−
−	~~Moving sensitive files is now documented at: http://docs.joomla.org/Moving_sensitive_files_outside_the_web_root~~

	==How do I block direct access to critical files using .htaccess?==		==How do I block direct access to critical files using .htaccess?==

@@ Line 136: / Line 136: @@
 ==Where can I learn more about file permissions?==
 * [[How do UNIX file permissions work?|Unix Permissions Primer]]
-*  Windows Permissions Primer]
+* [[Using phpSuExec]]
-*  Using phpSuExec]
+* [[Windows Permissions Primer]]
 ==How do I setup a powerful password scheme?==

@@ Line 516: / Line 516: @@
 ==Moving sensitive files outside the web root==
 {{:Moving sensitive files outside the web root}}
 ==How do I block direct access to critical files using .htaccess?==

@@ Line 1,460: / Line 1,460: @@
 Here are some trivial, non-functioning examples of URL Encoded text:
-<table border="1">
+<table class="wikitable" border="1">
 <tr>
 <th>Original</th>