My_eGallery Honeypot For The Lame Script Kiddies

Raven · Posted: Sun Oct 03, 2004 10:52 pm

This is only for those that do NOT use My_eGallery!

Just as I have done for the cgi hack attempts, I have now done for all these my_egallery exploit attempts. Make a honeypot as follows.

Create a folder called modules/My_eGallery
Create a sub-folder called public in My_eGallery
Create .htaccess file for the modules/My_eGallery/public folder as

Code:

RewriteEngine On
RewriteCond %{REQUEST_URI} "/modules/My_eGallery/public/.*$" [NC]
RewriteRule ^(.+) http://your_site.com/abuse/abuse.html

Now this assumes you are using Ganja's PC Killer templates. If not, direct them wherever you want Wink

You could also just add this to your main .htaccess file, but by layering it in the subfolders Apache does not have to process the directive everytime.

Nukeum66 · Posted: Mon Oct 04, 2004 12:55 am

I send them to know Browser Hijacking site.... Laughing

Give them a little dose of there own crap! Evil or Very Mad

blith · Posted: Mon Oct 04, 2004 8:12 am

Raven, I do not have an abuse.html file in there it is an abuse.php. Is that the one to use? Thanks.

Raven · Posted: Mon Oct 04, 2004 9:02 am

Yes. GT changes it on mine Smile

sixonetonoffun · Posted: Fri Oct 22, 2004 3:49 pm

I set this up right after this post on a domain that is not being used.
Interesting results were exactly to date 100 hits on that funny displayCategory.php
Of those hits the majority were from 200.* 201.* and 218*
99 of those were using linux/Mozilla sposedly
1 was a win98 user and ate many many pages of abuse.php/abuse.js

I'm going to work out something to ban these nix users though since they don't appear to be redirecting at all. I'm guessing they aren't even using a browser for the most part.

darksied · Posted: Wed Mar 02, 2005 1:00 am

would these changes below work for coppermine

Code:

RewriteEngine On
RewriteCond %{REQUEST_URI} "/modules/coppermine/.*$" [NC]
RewriteRule ^(.+) http://your site.com/abuse/abuse.html

plus can some one tell me when RewriteEngine Off is used