Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My website is hacked and now my .htaccess is being modify to redirect my traffic to their website I been struggling for 24 hours to resolve this problem, but still I can't find any suspect file on my server.

In my Mac Xserver we have 5 website and all of them is affected by this problem.

So I thought if I can use any command in terminal to find the URL of the site in .htaccess to find the file that is actually doing that modification.

I remember when I took UNIX/Linux course we have command grep but I don't know I tried to find but no result.

Please if anyone can help me find the way.

I've changed my FTP user password. Also I have changed the server login password and still no luck.....

share|improve this question
up vote 2 down vote accepted

You may likely have to look in several locations. The top directory of the web servers installation directory (could be /var/www/htdocs); if you are using Apache HTTPD, then you can look at the DocumentRoot value in the httpd.conf file.

If you know that it is the .htaccess file, then you can use find to look for all of them:

nice find / -name .htaccess -print

This will start at the root directory (/), looking for files named .htaccess and display the filename to standard output (stdout).

If you know the domain name that the your site is redirecting to, then you can search the contents with xargs and grep.

sudo nice find / -name .htaccess -print0 | xargs -r0 fgrep -H badwolf

The output from find is change to terminate by null characters (ASCII value of zero) between each filename found. This is sent to xarg -r -0 takes the null-terminated list of files as input and builds up arguments to be given to grep -FH badwolf (or whatever the errant domain name is. The -FH argument to grep says to search for a fixed string (not a pattern) and to always include the filename in the output. Since some of these may not be in areas accessible to you, it's better to run this through sudo.

This will search your entire system, so it may take some time.

share|improve this answer
xargs: illegal option -- r I'm getting this – Ali Jun 10 '12 at 17:19
You can try just the -0 argument. If that doesn't work, then try: sudo nice find / -name .htaccess -print | while read filename; do fgrep -H badwolf "$filename"; done, which is functionally equivalent. – Arcege Jun 10 '12 at 21:23


fs "file.*" | file content | filter "content inside"

When you do:

npm install nixar

Source / Docs:

share|improve this answer
Your link is broken (it returns a blank page). – DavidPostill Oct 19 '15 at 11:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .