Block bad guys rule by .htaccess

[locutusweb]

Hi all,

I noticed in my access log that a lot of attacks look like this:
http://www.example.com/components/com_component/errors.php?error=http://www.reallybaddomain.com/l333tbi1t.txt?
So I found some nifty rules to block urls with "http:"

 RewriteCond %{QUERY_STRING} http\: [OR]
 RewriteCond %{QUERY_STRING} ftp\: [OR]
 RewriteCond %{QUERY_STRING} https\: [OR]
 RewriteRule ^(.*)$ index.php [F,L]

This works like a charm ;D

Now I noticed that a some bad guys replace ":" with "%3A".

So I created the rule

RewriteCond %{QUERY_STRING} http\%3A

Unfortunately I can't log in in Joomla 1.0.x (Joomla 1.5.x works fine though) because this url is blocked:

 http://www.example.com/index.php?option=cookiecheck&return=http%3A%2F%2Fwww.example.com%2F

So I need a line to block urls with http%3A in them, only not in case they are from your own domain. Can anybody help me in this?

[edited by: jdMorgan at 4:01 pm (utc) on Sep. 12, 2008]
[edit reason] Please use example.com [/edit]

[jdMorgan]

Your original code should not work at all: It has a spurious [OR] on the last RewriteCond, which usually causes mod_rewrite to fail.

Combining your original three RewriteConds, cleaning up a bit, and adding an exclusion for the query name/value pair return=(your own site) gives:

RewriteCond %{QUERY_STRING} (https?¦ftp)(\:¦\%3A) [NC]
RewriteCond %{QUERY_STRING} !return=http\%3A\%2F\%2Fwww\.example\.com(\%2F)?&? [NC]
RewriteRule \.php[45]?$ - [F]

I removed the [L] flag from [F] because [F] always implies [L]. I also made the RewriteRule pattern specific to php requests, since this exploit won't work on --say, for example-- a .jpg file, and there's no use wasting CPU time for those requests. And I used the "don't change the URL" RewriteRule token "-" just to save processing time.

Change all broken pipe "¦" characters above to solid pipe characters before use; Posting on this forum modifies the pipe characters.

Jim

[edited] Tweaked security aspects of exclusion pattern. [edited]

[edited by: jdMorgan at 4:03 pm (utc) on Sep. 12, 2008]

[locutusweb]

Hi Jim,

Thanks for your great help in this. I'll apply these new rules this evening.