what does this link do/tell you?

New Member Joined: Jan 18, 2008 Posts: 20

hey i found someone trying to use this link:

http://www.MYSITE.com/modules.php?name=../../../../../../../../../../etc/passwd

i would imagine that they are trying to gain access to something???

im puzzeled, anyone know what it would do besides say "you are so cool..."

registered · Posted: Fri Aug 15, 2008 2:49 pm

They are making a pretty feeble attempt to get access to your hosts /etc/password file.

Did Sentinel block this?

Posted: Fri Aug 15, 2008 3:04 pm

no it did not, unless his ip changed and he made a second attempt.

registered · Posted: Fri Aug 15, 2008 3:17 pm

mm NukeSentinel's blockers should block this if you've enabled them (they should be enabled by default)

Posted: Fri Aug 15, 2008 4:05 pm

i never disalbed nuke sentinel, all i saw is were he was at ( i made a block for admins, i put a mysql update in the header and made a table so it tells were u are at all times Smile

)

i dont know why it didnt block it.

Posted: Fri Aug 15, 2008 6:26 pm

NS blocks this every time it happens on my site(s). The emailed block is labled as "Harvest".

Posted: Fri Aug 15, 2008 6:49 pm

Check you blocker confguration. Maybe it is just denying access, but not blocking it and writing to htaccess file.

Regular Joined: Aug 01, 2007 Posts: 66

I got the "you are so cool..." message as well. I haven't touched the Sentinel settings either.

UPDATE: I just tried blocking everything I could find and still get the same message. If I'm logged out and try it I get this message, "Sorry, this Module isn't active!"