.htaccess + Redirect (or) RewriteRule...

Using Redirect or RewriteRule for "other" purposes...

[decdim]

Tired of link rot, script abuse, etc. and know that it is possible to "forward" a banned UA/Referal/IP/etc. through Redirect or RewriteRule.

However, wouldn't it be possible to "access" a users system through that too. Since most browsers are setup to view your own computer?

Thus, if you used:

Redirect permanent /link.html C:\Windows\filename.exe

You could do "harmful" things to that user. Especially if you caused the file that was accessed to run "silently" or without authorization by the user.

For instance, you could force the user to go into DOS and "del *.*" with the flag to run without confirmation; or Ctrl-Alt-Del their system...

I know for simple use you can always redirect to say a known "malicious site" that would attack the visitor (java, applets, etc.) or one that is deemed "inapporpriate" by most people...

...or even loop them into their own computer/IP over and over (reverse DoS)?!

>:-)

Two cents anyone?!

[Birdman]

That won't work because the rewrite causes the server to look for C:\.. on it's own system, not the users.

[jdMorgan]

I'd like to offer some advice generally:

Don't be tricky with unwelcome and malicious visitors to your site. It's usually a waste of time, since you are often dealing with automated scripts that will never see your clever response to their unwelcome probing of your server.

Most of these user-agents will not follow an external redirect returned by your server, so you can't really "send" them anywhere; all you can do is serve alternate content in response to their request.

So, just serve them a short and simple 403-Forbidden response and move on. Spend your time developing content for your users or doing something to make your site work better, however you define that. Just squash the insect and move on, as it were... No need to impress it with fancy pre-squash footwork.

There are a few exceptions: If you are in the business of selling on-line images, then of course it's a good idea to serve hotlinkers alternate images with a watermark reading "Visit our site at ... to view this image". That is advertising. Otherwise, a plain and simple 403 will usually do.

Offered in utmost sincerity,
Jim

[decdim]

That would explain some of the worms that look for specific files and directories. :P Oops...

Well there is still the option of redirect to another site right?

Could be fun with politics (send them to the contribution page of whomever you support) or site that you want to get more traffic (not necessarily your own).

I try and keep "good" with such things but hate that there are those out there who can't even update their site on a timely basis (once a year?!). The option for bandwidth theft is to load an image from another site (either very large or like I said political - Pres/VP in 2004)

Oh well!

Thanks!