Look for any outbound port 80 connections with:
lsof -i :80
You will see your own apache server in that list too, but keep an eye for other stuff.
usually, attacks like this are very obvious in the output of:
ps faux
| # Run this in the project repo from the command-line | |
| # http://stackoverflow.com/a/4593065/99923 | |
| git log --shortstat --author "Xeoncross" --since "2 weeks ago" --until "1 week ago" | grep "files changed" | awk '{files+=$1; inserted+=$4; deleted+=$6} END {print "files changed", files, "lines inserted:", inserted, "lines deleted:", deleted}' |
| Find all devices | |
| ---------------- | |
| for ip in $(seq 1 254); do ping -c 1 192.168.1.$ip>/dev/null; | |
| [ $? -eq 0 ] && echo "192.168.1.$ip UP" || : ; | |
| done | |
| Using nmap | |
| ---------- |
Look for any outbound port 80 connections with:
lsof -i :80
You will see your own apache server in that list too, but keep an eye for other stuff.
usually, attacks like this are very obvious in the output of:
ps faux