Detection and response methods of Domain name hijacking

Coping methods

Through the analysis of the causes, the main reason is that the website server Web website files and folders are read and written. In view of the main causes and ways of the problems, it is possible to prevent and put an end to the problem of domain name hijacking by making use of the security settings of the server and improving the security of the website program.

IIS7 website monitoring

Test whether the website is hijacked, whether the domain name is walled, DNS pollution detection and other information.

(1) strengthen the anti-SQL injection function of the website.

SQL annotation is a method of using the characteristics of SQL statements to write content to the database so as to obtain permissions. When accessing the MS SQL Server database, do not use the sa default user with larger privileges, you need to establish a dedicated user who only accesses the database of the system, and configure it as the minimum permissions required by the system.

(2) configure Web site folder and file operation permissions

In Windows network operating system, Super Admin permission is used to configure permissions for Web site files and folders. Most of them are set to read permission, and write permission is carefully used. If Super Admin permission cannot be obtained, the * program cannot take root, and the possibility of website domain name hijacking can be greatly reduced.

(3) check the event manager to clean up the suspicious files in the Web network.

There is an event manager in the Windows network operating system. No matter how you get the operation permission, you can see the exception in the event manager. Through the event and date of the exception, you can find the changes of the files within that date in the Web site. You need to check whether the files that can execute the code have been annotated or changed, and clean up the new executable code files.