Recently my client's Magento store was hacked and I want to know more information about this Magento hacking.

So where should I ask questions about Magento hacking, Information Security or Magento?


It really depends on the details of your question. And sometimes, a question is applicable to more than one Stack Exchange site - in which case you should just choose one and post there. (Don't cross-post it please! Just pick one SE site).

I'm not active on Magento Stack Ecxhange, but I can give you a partial answer with respect to Information Security Stack Exchange.

If the question is "what should I do after being hacked", or "how do I harden my server", then Information Security has canonical questions for these.
You'll want to check these canonical questions first, to make sure your question won't be closed as a duplicate of them. And they contain some good advice that you'll want to apply.

Here is the canonical question for dealing with a compromised server.
Hardening your system is a bit more varied, it depends on what OS, database, web server etc you have. You'll want to check their hardening tag and find the canonical questions that apply to your case. There doesn't seem to be one for Magento, but there are a few about PHP, which may be the next best thing.

If your client was the target of a specific exploit, and you want to know more, then try to find out which exploit it was. See if you can find it in the online vulnerability databases.
Don't just ask "I found this file after a system compromise, what does it do?" Those questions quickly get closed as a duplicate of the canonical questions.
However, if you can find the specific vulnerability exploited, and you still have a question after consulting the existing online vulnerability databases - by all means ask on Information Security Stack Exchange! A question about a specific vulnerability is definitely on-topic there.

| improve this answer | |
  • Thanks, SL Barth one more question I have it's off topic for meta but I can see you have knowledge about security so I am asking you. what is entry door for the hacker to do something to our system ? – Vaibhav Ahalpara Oct 21 '16 at 11:52
  • @vaibhavahalpara There can be a great many ways for a hacker to enter your system. I'd have to know your system to assess its vulnerabilities - and there are others who can probaly do that a lot better than I can. The posts I linked should give you a good start for securing your system. After that, you could also hire a "penetration tester" - a security professional who will try to break into your system, to see where it is vulnerable. Good penetration testers cost money, though - they are highly skilled professionals and much in demand. – S.L. Barth - Reinstate Monica Oct 21 '16 at 12:02
  • Also - there is the "Top 10 web vulnerabilities" published by owasp.org. – S.L. Barth - Reinstate Monica Oct 21 '16 at 12:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .