How do I tell if my website has a back door loaded to it?

rt5000 · #1 07-03-2008

drendeah · #2 07-03-2008

The best way is to do a visual scan of all the filenames, usually you will see a name that doesn't fit. A couple common ones are r57.php and c99.php

If you are running a piece of 3rd party software you may want to download a fresh copy and then compare the files names.

If you want to see if any of your files are setup to execute shell commands you can run:
grep -R shell *

awpoopy · #3 11-27-2008

Look for .txt and .pl files
Also do a search for .js links that don't belong inside your html and php source code. Right now one of the trends is to xss or sql inject a js link.
An example would look something like this:
"<script src=http://somewhereinchina.cn/5.js></script>"
The number toward the end may be random

Make a backup of your website directory every once in awhile and run a diff on the last backup. That will show the differences in all the files. You should (hopefully) only see the change you or you webmaster has made.