- Joined
- Feb 27, 2004
- Messages
- 1,378
- Reaction score
- 50
Here is some Easy Ways To protecting Your website .. from Different Type of Security Holes.
A. SQL INJECTIONS
B. STOPING OFF DOMAIN TRANSACTIONS
C. Adding a Simple Auto File Logger To your Website
This is to catch those hacking attempts on a FILE! The anti Sql Injector already has it's Own Logging system.. but this is for those other stuff u want to log. like for example. The Referral Check.
here is the main function for the logger (u need to put this somewer on ur php file a global insert file)
How to Use is like Simple Like this
filename = just to separate from one kind of logs to another
$additionalinfo = this is some info u wanna include in the logs like queries or the current referrer's address
$theusername = if u have cookies.. u can put them here.. so ull know who to ban for this acts.
A sample script.. this is combined with the the Referral Filter on B
Ill do more later.. Just ask here if u wanna me to do any kind of protection.
A. SQL INJECTIONS
How to Use.
1. download the file , put in the same folder as the php file
2. Below are the how to use.. Put these on the top of the page just after <?
3. THis is the Sql Injection CheckerPHP:require_once "sql_inject.php"; $bDestroy_session = TRUE; $url_redirect = 'index.php'; $sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect);
Explaination:PHP:$sqlinject->test($your_sql_data);
require_once "sql_inject.php"; < calls the file protector file
$bDestroy_session = TRUE; < this stops any session they on
$url_redirect = 'index.php'; < if they do a sql injection they are moved to this page
$sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect); < this to start the sql injection protection ( also ./log_file_sql.log is the file wer all the attempt are put in.. for u to ban later on ... hehehehhe)
$sql_inject->test($your_sql_data); < this is the implementation of the anti sql injector. where $your_sql_data is the mssql query string.
Thats my best explaination.. im too lazy now.. if u made it work.. try to explain to the others.
Dont pm me about this please..
Additional Info:
PHP:<? require_once "sql_inject.php"; $bDestroy_session = TRUE; $url_redirect = 'index.php'; $sqlinject = new sql_inject('./log_file_sql.log',$bDestroy_session,$url_redirect); // some line here // more lines here.. blah blah blah //below is a little trick to do a post variable on this page.. as u can see the post variable [B]login[/B] is already been injected with a drop table on memb_info and clevel = 350 $_POST['login'] = "%%'; drop table memb_info ; update character set clevel = 350ere name = '%%"; // this type of sql injection is trying to execute more SQL data // then like any normal page.. u read the $login variable (we can even try to stripslashes it) $login = stripslashes($_POST['login']); //your sql query string [COLOR=DarkRed]$query[/COLOR] = "Select Name From Character where name = '$login'"; //normally you would check $something for sql injection, but in this case, due to the new anti sql injection the entire query string can be analysed.. // to analyse query string we do this $sqlinject->test([COLOR=DarkRed]$query[/COLOR]); //now that we checked it.. we can query it $result = mssql_query([COLOR=DarkRed]$query[/COLOR]); // more lines here.. blah blaah ?>
--- above would make a new file in ur folder called. log_file_sql.log make sure u make ur folder writable
--- now i test the sample php file above.. it works like a charm.
UPDATE FOR SOME TYPOS!
B. STOPING OFF DOMAIN TRANSACTIONS
C. Adding a Simple Auto File Logger To your Website
This is to catch those hacking attempts on a FILE! The anti Sql Injector already has it's Own Logging system.. but this is for those other stuff u want to log. like for example. The Referral Check.
here is the main function for the logger (u need to put this somewer on ur php file a global insert file)
PHP:
function filelogs($type, $info, $muser) {
$agent = $_SERVER['HTTP_USER_AGENT'];
$uri = $_SERVER['REQUEST_URI'];
$ip = $_SERVER['REMOTE_ADDR'];
$ref = $_SERVER['HTTP_REFERER'];
$dtime = date('r');
if($ref == ""){
$ref = "None";
**
if($user == ""){
$user = "None";
**
$location = "/";
$type = $location . $type . ".txt";
$entry_line = "$dtime - IP: $ip | Agent: $agent | URL: $uri | Referrer: $ref | Username: $muser | Query : $info \n";
$fp = fopen("$type", "a");
fputs($fp, $entry_line);
fclose($fp);
**How to Use is like Simple Like this
PHP:
filelogs('filename', $additionalinfo, $theusername);filename = just to separate from one kind of logs to another
$additionalinfo = this is some info u wanna include in the logs like queries or the current referrer's address
$theusername = if u have cookies.. u can put them here.. so ull know who to ban for this acts.
A sample script.. this is combined with the the Referral Filter on B
PHP:
if (stristr($_SERVER['HTTP_REFERER'], 'http://www.supamu.info') === FALSE ) {
filelogs('account-creat', $_SERVER['HTTP_REFERER'], $_POST['Member_ID']);
die ( 'Hacking attempt. Your are such a Nooby!.. ' );
**Ill do more later.. Just ask here if u wanna me to do any kind of protection.
Last edited:
