My wordpress website was hacked how I did solution from SQL injection on wordpress database?
6931 views

My wordpress site was hacked later today It was refreshing again and again it was very annoying and was landing on some domain which was changing subdomain and every 2 seconds it was showing alert allow or block to confirm you are a robot or not I was socked and was not know what to do. I tried so many solutions I tried Googling I tried stackoverflow I was almost helpless. Because no file was updated or added on my server. This leads me that it could be something inside database because wordpress stores so many things inside database so I started searching that how to check if my database is injected or infected with SQL injection here comes the most important part.

How to Scan WordPress Database for Malware or SQL injection?
Save as many evidence as possible because each and every single piece of line will matter to find out the solution.
Copy links, take screen shots if thats not possible then just before redirect pause browser execution by pressing 'X' button not close cross 'X'.

If your site is redirecting to spammy links, you should search your DB for these links as well. To search your DB, you would need to export it as text.

In my case Spammy Link and it was keep change subdomain because if I block one domain it will not prompt next time so it was changing subdomains not to stop execution with annoying pop up

https://3xr9e.kinonew.pro/bot-detect?h=waWQiOjEwMDI4OTIsInNpZCI6MTAwNTQyMywid2lkIjoxMjkxMSwic3JjIjoy...
https://c5oq3.kinonew.pro/bot-detect?h=waWQiOjEwMDI4OTIsInNpZCI6MTAwNTQyMywid2lkIjoxMjkxMSwic3JjIjoy...
etc
https://cdn.blackawardago.com/favorite.js?t=t&;

What Do You Search For?
You should search for the two main indicators of DB malware infection. These are 
1) PHP functions that are commonly used by hackers
2) unknown links, iframes, and code sections found in your site.
These are common functions used by hackers:
  • base64_decode(  or base64_decode ( – second one has a space before the opening bracket.
  • eval( or eval (
  • error_reporting(0) or error_reporting (0)
  • shell_exec( or shell_exec (
  • gzinflate
This is not an exhaustive list. You may research other PHP functions that are commonly used by hackers.

So how I remove infected data from database just go instantly to your server for PHPmyadmin Replace with your found function and press delete. 

SELECT * from wp_options where option_value like '%eval(%' 

Delete using query 
DELETE FROM `wp_options ` where option_value like '%eval(%'

Now your database is cleaned.
Final step is secure you wordpress site and database for that have a Look at this how to secure your website.


https://www.codeinwp.com/blog/secure-your-wordpress-website/
Thanks

Tags

Related