Curious what all these cross-sight scripts do

New Member Joined: Dec 29, 2007 Posts: 2

I switched to Raven about a month ago and immediately started seeing the blocked IPs coming in. I clipped the link sent to me in the abuse email and took a look at the scripts that were being used but can't make heads or tails as to what they are for or do?

I'm not a php guru by any means anyway but I was just curious what they did.

JB

registered · Site Admin Joined: Jun 04, 2004 Posts: 6437

Some do nothing, but most are designed to either collect information about your site or add and alter files on your site. An approach is to try to run PHP code as if it were local, which gives the script more access than scripts running on other sites.

Posted: Sat Jan 19, 2008 8:40 am

Wow, I've got over 550 blocked IPs since I've switched.

That's alot of attempts AFTER I switched. Wonder what they were doing BEFORE I switched?

JB

registered · Posted: Sat Jan 19, 2008 9:41 pm

Probably wasn't hitting anything as long as your site was properly patched. But good that Sentinel sends an alert anyway

Worker Joined: Aug 26, 2007 Posts: 236

I avoid that all hacking robots activates Sentinel by stopping them by the .htaccess file:

RewriteEngine On

RewriteCond %{HTTP_USER_AGENT} ^libwww(-FM|-perl) [OR]
RewriteCond %{HTTP_USER_AGENT} Indy\ Library
RewriteRule ^.* - [F,L]

RewriteCond %{QUERY_STRING} .*http:\/\/.* [OR]
RewriteCond %{QUERY_STRING} .*http%3A%2F%2F.*
Rewriterule ^.* - [F]

Posted: Sun Jan 20, 2008 7:10 am

jbroth
Check this:

http://secunia.com/search/?search=nuke

New Member Joined: Apr 14, 2004 Posts: 7

Susann,

That's depressing to see all those.

JB

ps, I have no idea how I ended up with two memberships on this forum Blonde Moment

Sorry about that, I'll stick with my new one though Smile

Promise. . .