My site got hacked by some turkish hacking clan recently. After that I patched nuke (7. and installed sentinel. I still get a few hacking attempts each week, but this one particular hacking attempt is coming almost everyday. Initially I didnt even think it was a hacking attempt, thought maybe it was some query caught up in sentinel but last night, this attempt was made from 10 different ips in succession. Here are the details:
User Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.7.5)
Gecko/20041107 Firefox/1.0
Query String:
www.mobilejunkies.net/modules.php?name=Forums&file=posting&mode=newtopic&f=6+[PLM=0][R]+GET+ target=_blank href="http://www.mobilejunkies.net/modules.php?name=Your_Account&op=new_user+[0,16550,634]+-">http://www.mobilejunkies.net/modules.php?name=Your_Account&op=new_user+[0,16550,634]+->+[R]+POST+http://www.mobilejunkies.net/modules.php?name=Your_Account+[0,11961,20331]+->+[L]+POST+http://www.mobilejunkies.net/modules.php?name=Your_Account+[0,0,18666]+->+[L]+GET+http://www.mobilejunkies.net/modules.php?name=Your_Account+[R=302][0,0,184]+->+[L]+GET+http://www.mobilejunkies.net/modules.php?name=Your_Account&op=userinfo&username=Gromeron+[0,0,30320]+->+[N]+GET+http://www.mobilejunkies.net/modules.php?name=Forums&file=posting&mode=newtopic&f=6+[0,35264,45487]+->+[N]+POST+http://www.mobilejunkies.net/modules.php?name=Forums&file=posting+[19919,0,22834]
Get String: www.mobilejunkies.net/modules.php?name=Forums&file=posting
[19919,0,22834]&mode=newtopic&f=6 [0,35264,45487] -> [N] POST
http://www.mobilejunkies.net/modules.php?name=Forums&op=userinfo&username=Gromeron
[0,0,30320] -> [N] GET
http://www.mobilejunkies.net/modules.php?name=Forums
Post String: www.mobilejunkies.net/modules.php
Forwarded For: none
Client IP: none
Remote Address: 70.82.189.135
Remote Port: 2530
Request Method: GET
They always involve teh username=Gromeron
I am just wondering is there anything else I can do with this?, yes sentinel is blocking it but he could get in trying different techniques no?. Sorry I am a bit paranoid now.
Evaders99 Site Admin
Joined: Aug 17, 2003
Posts: 12482
Posted:
Sun May 27, 2007 5:19 pm
Never seen exactly this type, probably a forums spammer. It is just a very weird query string
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum
and installed sentinel. I still get a few hacking attempts each week, but this one particular hacking attempt is coming almost everyday. Initially I didnt even think it was a hacking attempt, thought maybe it was some query caught up in sentinel but last night, this attempt was made from 10 different ips in succession. Here are the details:
