Forum Moderators: phranque
I think I have many SQL injections with strange url's like:
http://www.example.com/"http:/www.mysite.com/category/uncategorized/
http://www.example.com/page/2/?url=spammers.we.bs%252Ftest.txt%253F%253F%253F
http://www.example.com/2008/04/my content/\\
http://www.example.com/index.php?fee...gin,0x3a,user_pass,0x3a),2/**/from/**/w
http://www.example.com/index.php?exa...ION/**/SELECT/**/1,2,0x3a,user_login,0x
http://www.example.com/wp-content/pl...concat(0x3a,user_login,0x3a,user_pass,0
I've tried to use: Denies any request for a url containing characters other than “a-zA-Z0-9.+/-?=&
RewriteCond %{REQUEST_URI} !^/(wp-login.php¦wp-admin/¦wp-content/plugins/¦wp-includes/).* [NC]
RewriteCond %{THE_REQUEST} !^[A-Z]{3,9}\ [A-Z0-9\.\+_/\-\?\=\&\%\#]+\ HTTP/ [NC]
RewriteRule .* - [F,NS,L]
It seems to help forbidding strange url's, but I'm not sure about "may break your site depending on your links"
What does that mean? I used that code in my .htaccess file for about a week but took it off because I felt that my links and my site in Google SERP were slowly decreasing.
My question: Is that the effect or that code doesn't affect incoming links?
Also, I still can't fix an injection like:
http://www.example.com/?ref=www.spammers-www.spammers.com-www.spammers.com
I read some article advising the blocking of bad query strings like this:
<ifmodule mod_rewrite.c>
RewriteCond %{QUERY_STRING} ftp\: [NC,OR]
RewriteCond %{QUERY_STRING} http\: [NC,OR]
RewriteCond %{QUERY_STRING} https\: [NC]
RewriteRule .* - [F,L]
</ifmodule>
But the next morning, I found a lot more strange url's similiar to those above. What can I do about this? I'm newbie with .htaccess. I don't really know which one is the right one for my site.
Thanks.
[edited by: jdMorgan at 2:10 pm (utc) on Jan. 22, 2009]
[edit reason] Please use example.com only [/edit]
Also, I still can't fix an injection like:
It seems to help forbidding strange url's, but I'm not sure about "may break your site depending on your links" What does that mean?
It means that any request matching the patterns in your access-control rules will be denied. So you have to know what is and is not a "valid URL format" for your own site, and avoid using any pattern that would deny access to any request that is valid on your site. Since we do not know your site or what valid URLs exist on it, we cannot answer that question for you.
Because mod_rewrite is complicated, and because regular expressions can be cryptic and hard to interpret, I'd suggest starting off with very specific rules to deny specific 'bad' requests that you seen in your logs. As you become more familiar with mod_rewrite and regex, you can then combine rules and take a more-sophisticated approach. However, if blocking these exploits is important to you, then use that as a motivation to study-up on these subjects and learn them well, because using mod_rewrite without fully-understanding it is a recipe for disaster. There are links to useful resources in our Forum Charter, and some tutorials in our Forum Library that may prove useful to you (see links at the top left of this page).
In the meantime, let me throw this modified/cleaned-up code out there, and see if it helps:
RewriteCond %{THE_REQUEST} !^[A-Z]{3,9}\ [0-9A-Za-z#%&+\-./=?_]+\ HTTP/
RewriteRule !^wp-(login\.php¦admin/¦content/plugins/¦includes/) - [NC,F]
#
RewriteCond %{QUERY_STRING} https?:¦ftp:¦ref=¦url=¦0x[0-7a-f]{2} [NC,OR]
RewriteCond %{QUERY_STRING} [^a-z](declare¦char¦set¦cast¦convert¦delete¦drop¦exec¦insert¦meta¦script¦select¦truncate¦update)[^a-z] [NC]
RewriteRule .* - [F]
Also, be aware that the longer lines of code may wrap at your screen width setting.
If you use this code, then it is up to you to thoroughly test your site and make sure that you don't get denied access in normal surfing and posting. If you do get denied, then go through the rules above and modify them so that your valid requests don't trigger a 403 response.
You can do this either by making the pattern(s) more specific, by adding a RewriteCond exclusion, or by removing one of the (sub-)patterns that matches your valid request. But if you remove a pattern, then you accept that you will be allowing the exploit that that pattern was intended to block.
Jim
Please pardon my language, I'm not very good at English
It seems to have worked. My theme and plugins work fine too, and I haven't get any deny 403. I will see how it all goes over time.
Thankyou again.
