Q:

Helpful linux command for do some forensic on compromised linux web server

What are helpful linux command for do some forensic on compromised linux web server for giving out sort of information/evidence/backtrace? for example checking log, checking last file edit, suspicious open port, and others usefull automatic command for forensic?

A:

dd. Take an image of your compromised machine, then wipe it and start over. You cannot trust anything your host is telling you any more. 
Once you have said disk image though, the question is very much 'what do you want to accomplish'? If it's evidence/legal, then you're going to have to be incredibly careful, and probably want to consult with a legal professional before you even start. 
If it's just to figure out what's happened to compromise it, then I'd start with:

find (look for 'odd' permissions, especially setuid). 
look through binaries in common locations (e.g. search path). md5sum and verify the signature against the source. 
log files - look for 'odd' entries in logs, and especially things like process crashes. Segmentation Faults are a big alarm bell for a buffer overflow exploit. 

But at the end of the day, a really good compromise of a system is really hard to exhaustively backtrace. Logs will have been 'tidied up', timestamps corrected. The only reliable sources are off host monitoring, such as  a remote syslog server, a firewall or an intrusion detection system... but these are things that if you don't have in advance, you're too late. 

