Security terms for site compromise response

When dealing with a compromised website, the documentation references a specific set of technical terms. This glossary defines the concepts you will encounter during the investigation and recovery process.

Accounts, access, and authentication

Administrator privileges are the highest permission level on a system, allowing actions such as deleting the entire site, resetting passwords, or uploading files. Two-factor authentication (2FA) protects account login by requiring at least two tokens of proof, such as a password and a security code sent via SMS.

Social engineering is a technique for gaining access to sensitive information by tricking people rather than attacking code directly. Phishing is a common form of this, where an attacker impersonates a trusted source, like a bank, to obtain usernames, passwords, or other sensitive data.

Site architecture and content

A static web page is a single, unchanging file that displays content. In contrast, a dynamic web page uses scripts and templates to generate content anew each time the page is requested. Sites built on dynamic pages often rely on a Content Management System (CMS) like WordPress, Drupal, or Joomla!, though custom-built systems exist as well.

Web scripting languages are coding languages used alongside HTML to add features such as form processing or comment moderation. In security documentation, scripting language refers to PHP or JavaScript. PHP is executed by the web server, while JavaScript is interpreted by the user's browser.

The server and its files

A web server is the machine and software that host and control web pages and related files. A web hosting service provides space for a site on such a server. Configuration files store information like database location and credentials for dynamic sites. File Transfer Protocol (FTP) is used to transfer files between machines.

Hidden files, such as .htaccess, do not appear in a directory by default. You must configure your file system to view and edit them. Log files record user requests and other server activities; they are essential for identifying hacking attempts or suspicious traffic. HTTP Status Codes are standardized server responses that help users understand how the website is responding or identify errors.

Common attack vectors and malicious code

A backdoor is a program installed on a system to bypass authentication and maintain a hacker's access. A web shell is a specific backdoor script designed for this purpose. Malware is any software intended to harm a computer, its software, or its users.

Cloaking presents different content or URLs to human users versus search engines. Hackers may use dynamic scripts or .htaccess rules to return 404 or 500 errors to certain IP addresses while serving spam to others. Hidden iframes are another common tactic used to redirect users to malicious sites.

Obfuscation makes code harder to read, confusing analysts. Common methods include character substitution, misleading variable names, and encodings like base64, rot13, gzip, and URL or hex encoding. These techniques can also compress large payloads, such as entire web shells.

The eval() function in PHP and JavaScript evaluates a string and returns a result. It is discouraged when handling user input because it creates a vulnerability that allows attackers to inject malicious code, such as harmful PHP commands.

Indicators and recovery tools

A traffic spike is a sudden, unexpected surge in website traffic. Digital forensic specialists can help clean a site and determine how it was compromised.

Search Console is a free Google service for monitoring a site's presence in search results and for communication about website issues. A sitemap is a file listing a site's web pages to inform search engines about content organization. Web spam refers to deceptive SEO tactics or content that attempts to manipulate search engines for ranking or popularity.