Something awful happened to me.

[Capricorn]

I know we have great web developers and those that have been developing websites for years.
I woke up this morning to login to my website and after the admin credentials, hit login and get "500 server error". I tried several times without luck.
I decided to enable debug from cpanel and try again and the information I found was that there was no "databasename.users" in database.
So i login to phpmyadmin and check the tables everything was OK but without the row of users.
The website was still loading well and only have issues when I to login.
Have anyone else ever experienced this problem?
Should I contact my website host or what.
I have other websites hosted on that same panel and they are working no issues.

Just before I go I forget to say the only thing I did on that website yesterday was that I login on through RDP to AWS.

 

[SpiderWeb]

so here comes backups in picture...else...bit hard

 

[tbb]

Which cms you are using?

 

[whitebee]

If you forget to backup yourself, Your webhost should at least have a weekly backup or monthly backup. If they don't even have this, then I think you're in trouble.

 

[MrNoLimits]

I know we great web developers and those that have been developing websites for years.
I woke up this morning to login to my website and after the admin credentials, hit login and get "500 server error". I tried several times without luck.
I decided to enable debug from cpanel and try again and the information I found was that there was no "databasename.users" in database.
So i login to phpmyadmin and check the tables everything was OK but without the row of users.
The website was still loading well and only have issues when I to login.
Have anyone else ever experienced this problem?
Should I contact my website host or what.
I have other websites hosted on that same panel and they are working no issues.

Just before I go I forget to say the only thing I did on that website yesterday was that I login on through RDP to AWS.

Where did you buy the VPS from?

 

[Capricorn]

Which cms you are using?

PHP. So funny it is foodomaa

 

[Capricorn]

Where did you buy the VPS from?

AWS Amazon

 

[MrNoLimits]

AWS Amazon

Oh, i thought you got it from somebody else.
Well, in that case it's weird.

My educated guess it that your server was hacked and somebody hurt you on purpose, what happened to you is not random.
Get in touch with Amazon and ask them to check the incoming login attempts to your server and change your login credentials.

 

[slvrsteele]

everything was OK but without the row of users

It doesn't seem like a hosting issue. For cross reference check your access log and compare it with error log for the period of time since last working till now.

It sounds more like a protection mechanism than a hack.

 

[Capricorn]

It doesn't seem like a hosting issue. For cross reference check your access log and compare it with error log for the period of time since last working till now.

It sounds more like a protection mechanism than a hack.

Alright. I will check that.

 

[slvrsteele]

Alright. I will check that.

I can bet you'll find nothing but that's for assuring you it wasn't a hack.
Eventually a remote call that triggered some hidden functions in the script.
Check all weird path requests with 200 response and see what those files contain (functions wise).

 

[Capricorn]

I can bet you'll find nothing but that's for assuring you it wasn't a hack.
Eventually a remote call that triggered some hidden functions in the script.
Check all weird path requests with 200 response and see what those files contain (functions wise).

You mean it's possible for the developer to remote access to the database.
"Foodomaa"

 

[Capricorn]

You mean it's possible for the developer to remote access to the database.
"Foodomaa"

If yes, then something is not right.

 

[slvrsteele]

Not remote access the database. Remote access a function that removes a table from the database.
Imagine an unofficial version is used in production and holder gets some serious income on behalf of it.
What's most painful? To lose some database. Think that removing the users tables all related conditions will crash.
No more vendors, no more clients. Even if you re-create the accounts they won't have the exact same identifier as you cannot remember exactly their order (on big databases) so other allocated queries based on user id will return bogus data

Or instead of remote access it might be an internal function that checks for something and if is not the result expected it removes the tables.

 

[phaze1G]

Might be a small misconfig error

 

[MrNoLimits]

Not remote access the database. Remote access a function that removes a table from the database.
Imagine an unofficial version is used in production and holder gets some serious income on behalf of it.
What's most painful? To lose some database. Think that removing the users tables all related conditions will crash.
No more vendors, no more clients. Even if you re-create the accounts they won't have the exact same identifier as you cannot remember exactly their order (on big databases) so other allocated queries based on user id will return bogus data

Or instead of remote access it might be an internal function that checks for something and if is not the result expected it removes the tables.

So the developer made a self-trigger function to screw their clients? Maybe it was triggered because we kinda nulled the script and the developer hide it there to make sure nobody uses nulled versions and survive

 

[slvrsteele]

So the developer made a self-trigger function to screw their clients? Maybe it was triggered because we kinda nulled the script and the developer hide it there to make sure nobody uses nulled versions and survive

I know a licensing script that deletes everything in the html root folder if nulled or some checks are not receiving the desired results.

 

[Capricorn]

Good answer is using a nulled script on a production website is a huge risk.

 

[Capricorn]

How to successfully backup database and restore it.?

 

[MrNoLimits]

I know a licensing script that deletes everything in the html root folder if nulled or some checks are not receiving the desired results.

Well, that might have given the developer the idea for this kind of thing.