iEntry 10th Anniversary Forum Rules Search
WebProWorld
Register FAQ Calendar Mark Forums Read
Go Back   WebProWorld > Webmaster, IT and Security Discussion > Internet Security Discussion Forum
Latest Injection Attack: DECLARE, SET and CAST
Index Link To US Private Messages Archive FAQ RSS
Internet Security Discussion Forum This forum is for the discussion of security related issues. If you find a new Phishing scheme, spyware, virus or malicious site - let us know about it. If any of the above found you... here's where you ask for help.

Share Thread: & Tags

Share Thread:

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 08-27-2008, 12:12 PM
WebProWorld Pro
  
Join Date: Jan 2008
Posts: 290
Tech Manager RepRank 1
Exclamation Latest Injection Attack: DECLARE, SET and CAST
I have been monitoring one of the latest injection hack attempts since early July. The attack is pervasive and appears to be powered through one or several of the larger Botnets. The attack, whether successful or not is not hard to miss. It shows up as a rather lengthy piece of hexadecimal code in your server logs with the visible commands DECLARE, SET and CAST.

Watch your server logs for something like this: ;DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0×4445434 C415245204054207661726368617228323535292C404320766 17263686172

I've written a brief article about the subject with the decoded injection and the js from the originating site in China: douhunqn.cn. I also include .htaccess info for preventing the attack.

Read the article here
__________________
I use Country IP Blocks as added security for my networks and servers.
Reply With Quote
  #2 (permalink)  
Old 08-28-2008, 06:44 AM
caravan's Avatar
WebProWorld Pro
  
Join Date: May 2006
Location: Preston, Lancashire, UK
Posts: 101
caravan RepRank 1
Default Re: Latest Injection Attack: DECLARE, SET and CAST
Thanks for this. We have been plagued by these sort of hacks for the last few months. It has taken us a while to narrow down the problem and a lesson has been learnt. ALWAYS FILTER ANY PASSED URL PARAMETERS. We are using asp on a windows server so the htaccess solution isn't possible but by passing any numeric values through the CInt() function it seems to be blocking further attacks from executing successfully.
Reply With Quote
  #3 (permalink)  
Old 08-28-2008, 12:17 PM
WebProWorld Pro
  
Join Date: Jan 2008
Posts: 290
Tech Manager RepRank 1
Default Re: Latest Injection Attack: DECLARE, SET and CAST
I am always happy to help. Keep you software up to date, thoroughly validate all variables and keep a close eye on your web or server traffic, and you'll be fine.
__________________
I use Country IP Blocks as added security for my networks and servers.
Reply With Quote
  #4 (permalink)  
Old 08-29-2008, 10:50 AM
kgun's Avatar
WebProWorld 1,000+ Club
WebProWorld MVP
  
Join Date: May 2005
Location: Norway
Posts: 5,607
kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9
Default Re: Latest Injection Attack: DECLARE, SET and CAST
And here

Google Safe Browsing diagnostic page for douhunqn.cn/

is one way to test the site.
Reply With Quote
  #5 (permalink)  
Old 08-29-2008, 11:38 AM
WebProWorld Pro
  
Join Date: Jan 2008
Posts: 290
Tech Manager RepRank 1
Default Re: Latest Injection Attack: DECLARE, SET and CAST
Quote:
Originally Posted by kgun View Post
And here

Google Safe Browsing diagnostic page for douhunqn.cn/

is one way to test the site.
You're right kgun. Yesterday I wrote a follow up to the original article quoting from Google's Safe Browsing diagnostics.

Latest injection attacks from www0.douhunqn.cn

As you can see, this specific Chinese site has been quite prolific at spreading malware.
__________________
I use Country IP Blocks as added security for my networks and servers.
Reply With Quote
  #6 (permalink)  
Old 08-29-2008, 12:01 PM
kgun's Avatar
WebProWorld 1,000+ Club
WebProWorld MVP
  
Join Date: May 2005
Location: Norway
Posts: 5,607
kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9kgun RepRank 9
Default Re: Latest Injection Attack: DECLARE, SET and CAST
I thought of writing an open letter to Google. Here are the ideas:
  1. Using the above and more advanced tools to penalize sites and IP's. I know it can hurt my own sites, since I am on a shared Ip. May be it is already penalized.
  2. Search clusters and the ongoing Google suggest discussion.
  3. Personally I find the clusters on Clusty the clustering search engine very useful. Clusty is a Meta (who cares?) SE I use more and more.
  4. Google suggest combined with

    Searches related to:

    have a great potential. But it could be combined (with an option or tool) like Clusty's clusters that will make Google search even better.
  5. Visual search. How up to date are Google? I don't think of image or video search.
P.S.

Google is my default SE on Opera and Clusty the default engine on the speed dial page (you have fairly good control of domains / Ip's with that configuration).

Configuration on Opera is very easy.

"Adding new searches

Opera comes with a useful set of default search engines, but you may want to add some of your own favorite searches to the mix.

Adding a new search is most conveniently done as follows: (My addition: CTRL + F12 gives you an overview)
  1. Go to the site that has the search you want.
  2. Right-click the search field.
  3. Select "Create search" from the context menu.
  4. Edit the name of the search engine to your liking.
  5. Add a short keyword to be able to use the search engine directly from the address field, as described above.
  6. Click "OK", and the new search is added and can be used anywhere within Opera.
If you want to make the new search your default search engine, expand the dialog by clicking the "Details" button, and check the "Use as default search engine" box. You can also make it your default search engine for Speed Dial by checking the "Use as Speed Dial search engine" box.
In the expanded dialog, you can also edit the search string directly and specify that the POST method should be used for this search".
Last edited by kgun; 08-29-2008 at 12:17 PM.
Reply With Quote
  #7 (permalink)  
Old 08-29-2008, 01:27 PM
Webnauts's Avatar
WebProWorld 1,000+ Club
WebProWorld MVP
  
Join Date: Aug 2003
Location: Worldwide
Posts: 8,131
Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8
Default Re: Latest Injection Attack: DECLARE, SET and CAST
Would you recommend adding in the .htaccess for example this too?

## DENY REQUEST BASED ON REQUEST METHOD ###
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS|HEAD)$ [NC]
RewriteRule ^.*$ - [F]
__________________
"Being an expert isn't telling other people what you know. It's understanding what questions to ask, and flexibly applying your knowledge to the specific situation at hand. Being an expert means providing sensible, highly contextual direction." Jeff Atwood
SEO Workers - Search Engine Optimization Consulting Company | SEO Analysis Tool | Webnauts Net SEO
Reply With Quote
  #8 (permalink)  
Old 08-29-2008, 01:32 PM
WebProWorld Pro
  
Join Date: Jan 2008
Posts: 290
Tech Manager RepRank 1
Default Re: Latest Injection Attack: DECLARE, SET and CAST
Quote:
Originally Posted by Webnauts View Post
Would you recommend adding in the .htaccess for example this too?

## DENY REQUEST BASED ON REQUEST METHOD ###
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS|HEAD)$ [NC]
RewriteRule ^.*$ - [F]
Webnauts:

I would suggest blocking those methods unless you have specific reasons for allowing them.

For those unfamiliar with the above choices check out Method Definitions.
__________________
I use Country IP Blocks as added security for my networks and servers.
Reply With Quote
  #9 (permalink)  
Old 08-29-2008, 03:23 PM
Webnauts's Avatar
WebProWorld 1,000+ Club
WebProWorld MVP
  
Join Date: Aug 2003
Location: Worldwide
Posts: 8,131
Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8
Default Re: Latest Injection Attack: DECLARE, SET and CAST
Tech Manager thanks for the heads up. I already added in my .htaccess this:

RewriteEngine On
Options +FollowSymLinks
ServerSignature Off
RewriteCond %{REQUEST_URI} ^/(,|;|<|>|”>|”<|/|\\\.\.\\).{0,9999}.* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(;|<|>|’|”|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|updat e|md5|benchmark).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(<|>|’|%0A|%0D|%27|%3C|%3E|%00).* [NC]
RewriteRule ^(.*)$ http://www.kissmyassyousonofabitch.com
__________________
"Being an expert isn't telling other people what you know. It's understanding what questions to ask, and flexibly applying your knowledge to the specific situation at hand. Being an expert means providing sensible, highly contextual direction." Jeff Atwood
SEO Workers - Search Engine Optimization Consulting Company | SEO Analysis Tool | Webnauts Net SEO
Reply With Quote
  #10 (permalink)  
Old 08-29-2008, 03:24 PM
WebProWorld Pro
  
Join Date: Jan 2008
Posts: 290
Tech Manager RepRank 1
Default Re: Latest Injection Attack: DECLARE, SET and CAST
I like your ending redirect.
__________________
I use Country IP Blocks as added security for my networks and servers.
Reply With Quote
  #11 (permalink)  
Old 08-29-2008, 03:25 PM
Webnauts's Avatar
WebProWorld 1,000+ Club
WebProWorld MVP
  
Join Date: Aug 2003
Location: Worldwide
Posts: 8,131
Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8
Default Re: Latest Injection Attack: DECLARE, SET and CAST
Quote:
Originally Posted by Tech Manager View Post
I like your ending redirect.
Really?
__________________
"Being an expert isn't telling other people what you know. It's understanding what questions to ask, and flexibly applying your knowledge to the specific situation at hand. Being an expert means providing sensible, highly contextual direction." Jeff Atwood
SEO Workers - Search Engine Optimization Consulting Company | SEO Analysis Tool | Webnauts Net SEO
Reply With Quote
  #12 (permalink)  
Old 08-29-2008, 03:26 PM
WebProWorld Pro
  
Join Date: Jan 2008
Posts: 290
Tech Manager RepRank 1
Default Re: Latest Injection Attack: DECLARE, SET and CAST
Quote:
Originally Posted by Webnauts View Post
Really?
Yes, it is subtle but somehow unmistakenly clear.
__________________
I use Country IP Blocks as added security for my networks and servers.
Reply With Quote
  #13 (permalink)  
Old 08-29-2008, 03:29 PM
Webnauts's Avatar
WebProWorld 1,000+ Club
WebProWorld MVP
  
Join Date: Aug 2003
Location: Worldwide
Posts: 8,131
Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8
Default Re: Latest Injection Attack: DECLARE, SET and CAST
We recently prevented an attack with one of the rules we use in our .htaccess file, in addition to our firewall settings and just thought of sharing. We have absolutely no bad bots on our site since we use all this:

Code:
##################################################
########## Created by John. S. Britsios ##########
########## SEO Workers Search Engine Optimization Consulting Company    ########## 
##################################################   

##### Security settings #####

## LIMIT UPLOAD FILE SIZE TO PROTECT AGAINST DOS ATTACK by limiting file size to 0-2147483647 bytes, (2GB)###
LimitRequestBody 10240000 

### Prevent .htaccess, .htpasswd and other files from being viewed by web clients ###                     
<FilesMatch "\.(htaccess|htpasswd|ini|phps|fla|psd|log|sh)$">
  Order Allow,Deny
  Deny from all
</FilesMatch>

RewriteEngine On
Options +FollowSymLinks
ServerSignature Off
RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|”>|”<|/|\\\.\.\\).{0,9999}.* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(;|<|>|’|”|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(<|>|’|%0A|%0D|%27|%3C|%3E|%00).* [NC]
RewriteRule ^(.*)$ http://www.kissmyassyousonofabitch.com

## DENY REQUEST BASED ON REQUEST METHOD ###
# Check here before using HTTP/1.1: Method Definitions #
#RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS|HEAD)$ [NC]
#RewriteRule ^.*$ - [F] 

### Deny Fake Bots ###
BrowserMatch "^Java/?[1-9_\.]*" bad_bot
BrowserMatch "^MJ12bot/?[1-9_\.]*" bad_bot
SetEnvIfNoCase User-Agent "^8484 Boston Project/?[1-9_\.]*" bad_bot
SetEnvIfNoCase User-Agent "charlotte/" bad_bot
SetEnvIfNoCase User-Agent "curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5" bad_bot
SetEnvifNoCase User-Agent "^Heritrix/" bad_bot
SetEnvIfNoCase User-Agent "ia_archiver" bad_bot
SetEnvIfNoCase User-Agent "larbin/" bad-bot
SetEnvIfNoCase User-Agent "libwww-perl"" bad_bot
SetEnvIfNoCase User-Agent "^libcurl-agent/" bad_bot
SetEnvifNoCase User-Agent "IRC-Bbot" bad_bot
SetEnvifNoCase User-Agent "ISC Systems iRc Search 2.1" bad_bot
SetEnvIfNoCase User-Agent "^Jakarta\ Commons-HttpClient/" bad_bot
SetEnvIfNoCase User-Agent "^Java/" bad_bot
SetEnvIfNoCase User-Agent "^Microsoft\ URL\ Control.*$" bad_bot
SetEnvIfNoCase User-Agent "^MJ12bot/" bad_bot
SetEnvIfNoCase User-Agent "MJ12bot/v1.0.8" bad_bot
SetEnvIfNoCase User-Agent "^Missigua Locator" bad_bot
SetEnvIfNoCase User-Agent "^Mozilla/4\.0\ .*Win\ 9x\ 4\.90.*$" bad_bot
SetEnvIfNoCase User-Agent "Nutch" bad_bot
SetEnvIfNoCase User-Agent "^PEAR HTTP_Request class" bad_bot
SetEnvIfNoCase User-Agent "phpversion" bad_bot
SetEnvIfNoCase User-Agent "^psycheclone" bad_bot
SetEnvIfNoCase User-Agent "^TencentTraveler" bad_bot
SetEnvIfNoCase User-Agent "^Web Downloader" bad_bot
SetEnvIfNoCase User-Agent "^Wells Search II" bad_bot
SetEnvIfNoCase User-Agent "^WEP Search 00" bad_bot
<FilesMatch "(.*)">
Order Allow,Deny
Allow from all
Deny from env=bad_bot
</FilesMatch>  

RewriteEngine on
RewriteBase /

# Known Bad Bots
RewriteCond %{HTTP_USER_AGENT} ADSARobot|ah-ha|almaden|aktuelles|Anarchie|amzn_assoc|Arachmo|ASPSeek|ASSORT|ATHENS|Atomz|attach|attache|autoemailspider|BackWeb|Bandit|BatchFTP|bdfetch|Bbot|BecomeBot|big.brother|Bitacle|BlackWidow|bmclient|boitho.com-dc|Boston\ Project|bot/1.0|BravoBrian\ SpiderEngine\ MarcoPolo|Bot\ mailto:craftbot@yahoo.com|Buddy|Bullseye|bumblebee|capture|CherryPicker|ChinaClaw|CICC|clipping|Clushbot|Collector|Copier|Crescent|Crescent\ Internet\ ToolPak|Custo|cyberalert|Deweb|diagem|Digger|Digimarc|DIIbot|DISCo|DISCo\ Pump|DISCoFinder|Download\ Demon|Download\ Wonder|Downloader|Drip|DSurf15a|DTS.Agent|EasyDL|eCatch|ecollector|efp@gmx\.net|Email\ Extractor|EirGrabber|email|EmailCollector|EmailSiphon|EmailWolf|Express\ WebPictures|ExtractorPro|EyeNetIE|FavOrg|fastlwspider|Favorites\ Sweeper|Fetch|FEZhead|FileHound|FlashGet\ WebWasher|FlickBot|fluffy|FrontPage|GalaxyBot|Generic|Getleft|GetRight|GetSmart|GetWeb!|GetWebPage|gigabaz|Girafabot|Go\!Zilla|Go!Zilla|Go-Ahead-Got-It|GornKer|gotit|Grabber|GrabNet|Grafula|Green\ Research|grub-client|Harvest|heritrix|hhjhj@yahoo|hloader|HMView|HomePageSearch|http\ generic|HTTrack|httpdown|httrack|ia_archiver|IBM_Planetwide|Image\ Stripper|Image\ Sucker|imagefetch|IncyWincy|Indy*Library|Indy\ Library|informant|Ingelin|InterGET|Internet\ Ninja|InternetLinkagent|Internet\ Ninja|InternetSeer\.com|Iria|Irvine|JBH*agent|JetCar|JOC|JOC\ Web\ Spider|JustView|kalooga|KWebGet|Lachesis|larbin|Leacher|LeechFTP|LexiBot|lftp|likse|Link|Link*Sleuth|LINKS\ ARoMATIZED|LinkWalker|LWP|lwp-trivial|Mag-Net|Magnet|Mac\ Finder|Mag-Net|Mass\ Downloader|MCspider|MJ12bot/v1\.0\.8|Memo|Microsoft.URL|MIDown\ tool|Mirror|Missigua\ Locator|Mister\ PiX|MMMtoCrawl\/UrlDispatcherLLL|monit|^Mozilla$|Mozilla.*Indy|Mozilla.*NEWT|Mozilla*MSIECrawler|MS\ FrontPage*|MSFrontPage|MSIECrawler|MSProxy|MSR-ISRCCrawler|multithreaddb|my-heritrix-crawler|nationaldirectory|Navroad|NearSite|NetAnts|NetCarta|NetMechanic|netprospector|NetResearchServer|NetSpider|Net\ Vampire|NetZIP|NetZip\ Downloader|NetZippy|NEWT|NICErsPRO|Ninja|NPBot|NicheBot|noxtrumbot|Octopus|Offline\ Explorer|Offline\ Navigator|OmniExplorer|OpaL|Openfind|OpenTextSiteCrawler|OrangeBot|PageGrabber|Papa\ Foto|PackRat|pavuk|pcBrowser|PersonaPilot|Ping|PingALink|Pingdom|Pockey|POE-Component-Client-HTTP|Powermarks|Proxy|psbot|PSurf|psycheclone|puf|Pump|PushSite|QRVA|RealDownload|Reaper|Recorder|ReGet|replacer|RepoMonkey|Robozilla|Rover|RPT-HTTPClient|Rsync|Scooter|SearchExpress|searchhippo|searchterms\.it|Second\ Street\ Research|Seeker|Shai|Siphon|sitecheck|sitecheck.internetseer.com|SiteSnagger|SlySearch|SmartDownload|snagger|Snake|SpaceBison|Spegla|SpiderBot|sproose|SqWorm|Stripper|Sucker|SuperBot|SuperHTTP|Surfbot|SurfWalker|Szukacz|tAkeOut|tarspider|Teleport\ Pro|Templeton|TencentTraveler|TrueRobot|TV33_Mercator|UIowaCrawler|UtilMind|URLSpiderPro|URL_Spider_Pro|Vacuum|vagabondo|vayala|visibilitygap|VoidEYE|vspider|Web\ Downloader|w3mir|Web\ Data\ Extractor|Web\ Image\ Collector|Web\ Sucker|Wweb|WebAuto|WebBandit|web\.by\.mail|Webclipping|webcollage|webcollector|WebCopier|webcraft@bea|webdevil|webdownloader|Webdup|WebEMailExtrac|WebFetch|WebGo\ IS|WebHook|Webinator|WebLeacher|WEBMASTERS|WebMiner|WebMirror|webmole|WebReaper|WebSauger|Website|Website\ eXtractor|Website\ Quester|WebSnake|Webster|WebStripper|websucker|webvac|webwalk|webweasel|WebWhacker|WebZIP|Wget|Whacker|whizbang|WhosTalking|Widow|WinHTTP|WISEbot|WWWOFFLE|x-Tractor|^Xaldon\ WebSpider|WUMPUS|Xenu|XGET|Yeti|zermelo|Zeus.*Webster|Zeus [NC]
RewriteRule ^.* - [F,L]

# Bots starting with Web
RewriteCond %{HTTP_USER_AGENT} ^web(zip|emaile|enhancer|fetch|go.?is|auto|bandit|clip|copier|master|reaper|sauger|site.?quester|whack) [NC,OR]
 
# Anywhere in UA -- Greedy REGEX
RewriteCond %{HTTP_USER_AGENT} ^.*(craftbot|download|extract|stripper|sucker|ninja|clshttp|webspider|leacher|collector|grabber|webpictures).*$ [NC]
RewriteRule ^.* - [F,L]
__________________
"Being an expert isn't telling other people what you know. It's understanding what questions to ask, and flexibly applying your knowledge to the specific situation at hand. Being an expert means providing sensible, highly contextual direction." Jeff Atwood
SEO Workers - Search Engine Optimization Consulting Company | SEO Analysis Tool | Webnauts Net SEO
Last edited by Webnauts; 08-29-2008 at 03:45 PM.
Reply With Quote
  #14 (permalink)  
Old 08-29-2008, 03:30 PM
WebProWorld Pro
  
Join Date: Jan 2008
Posts: 290
Tech Manager RepRank 1
Default Re: Latest Injection Attack: DECLARE, SET and CAST
Good info. Thanks for sharing.
__________________
I use Country IP Blocks as added security for my networks and servers.
Reply With Quote
  #15 (permalink)  
Old 08-29-2008, 03:31 PM
Webnauts's Avatar
WebProWorld 1,000+ Club
WebProWorld MVP
  
Join Date: Aug 2003
Location: Worldwide
Posts: 8,131
Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8
Default Re: Latest Injection Attack: DECLARE, SET and CAST
Quote:
Originally Posted by Tech Manager View Post
Yes, it is subtle but somehow unmistakenly clear.
I just stumbled your sig by the way.
__________________
"Being an expert isn't telling other people what you know. It's understanding what questions to ask, and flexibly applying your knowledge to the specific situation at hand. Being an expert means providing sensible, highly contextual direction." Jeff Atwood
SEO Workers - Search Engine Optimization Consulting Company | SEO Analysis Tool | Webnauts Net SEO
Reply With Quote
  #16 (permalink)  
Old 08-29-2008, 03:32 PM
WebProWorld Pro
  
Join Date: Jan 2008
Posts: 290
Tech Manager RepRank 1
Default Re: Latest Injection Attack: DECLARE, SET and CAST
Thanks. I will return the favor.
__________________
I use Country IP Blocks as added security for my networks and servers.
Reply With Quote
  #17 (permalink)  
Old 09-02-2008, 02:07 PM
WebProWorld New Member
  
Join Date: Sep 2008
Posts: 1
airthin RepRank 0
Default Re: Latest Injection Attack: DECLARE, SET and CAST
We have been affected by this issue as well and are doing our best to try and fix the problem. We are running Windows servers so we do not have Apache or the ability to use .htaccess files.

Can you give us some direction on a solution that might work for us?

If we were going to have to load Apache and use the .htaccess fix would we then have to run all of our web traffic through Apache then? What exactly does the .htaccess file do?

Thanks in advance for any help.
Reply With Quote
  #18 (permalink)  
Old 09-03-2008, 05:43 PM
Webnauts's Avatar
WebProWorld 1,000+ Club
WebProWorld MVP
  
Join Date: Aug 2003
Location: Worldwide
Posts: 8,131
Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8Webnauts RepRank 8
Default Re: Latest Injection Attack: DECLARE, SET and CAST
Quote:
Originally Posted by Webnauts View Post
We recently prevented an attack with one of the rules we use in our .htaccess file, in addition to our firewall settings and just thought of sharing. We have absolutely no bad bots on our site since we use all this:

Code:
##################################################
########## Created by John. S. Britsios ##########
########## SEO Workers Search Engine Optimization Consulting Company    ########## 
##################################################   

##### Security settings #####

## LIMIT UPLOAD FILE SIZE TO PROTECT AGAINST DOS ATTACK by limiting file size to 0-2147483647 bytes, (2GB)###
LimitRequestBody 10240000 

### Prevent .htaccess, .htpasswd and other files from being viewed by web clients ###                     
<FilesMatch "\.(htaccess|htpasswd|ini|phps|fla|psd|log|sh)$">
  Order Allow,Deny
  Deny from all
</FilesMatch>

RewriteEngine On
Options +FollowSymLinks
ServerSignature Off
RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|”>|”<|/|\\\.\.\\).{0,9999}.* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(;|<|>|’|”|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark).* [NC,OR]
RewriteCond %{QUERY_STRING} ^.*(<|>|’|%0A|%0D|%27|%3C|%3E|%00).* [NC]
RewriteRule ^(.*)$ http://www.kissmyassyousonofabitch.com

## DENY REQUEST BASED ON REQUEST METHOD ###
# Check here before using HTTP/1.1: Method Definitions #
#RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS|HEAD)$ [NC]
#RewriteRule ^.*$ - [F] 

### Deny Fake Bots ###
BrowserMatch "^Java/?[1-9_\.]*" bad_bot
BrowserMatch "^MJ12bot/?[1-9_\.]*" bad_bot
SetEnvIfNoCase User-Agent "^8484 Boston Project/?[1-9_\.]*" bad_bot
SetEnvIfNoCase User-Agent "charlotte/" bad_bot
SetEnvIfNoCase User-Agent "curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5 OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5" bad_bot
SetEnvifNoCase User-Agent "^Heritrix/" bad_bot
SetEnvIfNoCase User-Agent "ia_archiver" bad_bot
SetEnvIfNoCase User-Agent "larbin/" bad-bot
SetEnvIfNoCase User-Agent "libwww-perl"" bad_bot
SetEnvIfNoCase User-Agent "^libcurl-agent/" bad_bot
SetEnvifNoCase User-Agent "IRC-Bbot" bad_bot
SetEnvifNoCase User-Agent "ISC Systems iRc Search 2.1" bad_bot
SetEnvIfNoCase User-Agent "^Jakarta\ Commons-HttpClient/" bad_bot
SetEnvIfNoCase User-Agent "^Java/" bad_bot
SetEnvIfNoCase User-Agent "^Microsoft\ URL\ Control.*$" bad_bot
SetEnvIfNoCase User-Agent "^MJ12bot/" bad_bot
SetEnvIfNoCase User-Agent "MJ12bot/v1.0.8" bad_bot
SetEnvIfNoCase User-Agent "^Missigua Locator" bad_bot
SetEnvIfNoCase User-Agent "^Mozilla/4\.0\ .*Win\ 9x\ 4\.90.*$" bad_bot
SetEnvIfNoCase User-Agent "Nutch" bad_bot
SetEnvIfNoCase User-Agent "^PEAR HTTP_Request class" bad_bot
SetEnvIfNoCase User-Agent "phpversion" bad_bot
SetEnvIfNoCase User-Agent "^psycheclone" bad_bot
SetEnvIfNoCase User-Agent "^TencentTraveler" bad_bot
SetEnvIfNoCase User-Agent "^Web Downloader" bad_bot
SetEnvIfNoCase User-Agent "^Wells Search II" bad_bot
SetEnvIfNoCase User-Agent "^WEP Search 00" bad_bot
<FilesMatch "(.*)">
Order Allow,Deny
Allow from all
Deny from env=bad_bot
</FilesMatch>  

RewriteEngine on
RewriteBase /

# Known Bad Bots
RewriteCond %{HTTP_USER_AGENT} ADSARobot|ah-ha|almaden|aktuelles|Anarchie|amzn_assoc|Arachmo|ASPSeek|ASSORT|ATHENS|Atomz|attach|attache|autoemailspider|BackWeb|Bandit|BatchFTP|bdfetch|Bbot|BecomeBot|big.brother|Bitacle|BlackWidow|bmclient|boitho.com-dc|Boston\ Project|bot/1.0|BravoBrian\ SpiderEngine\ MarcoPolo|Bot\ mailto:craftbot@yahoo.com|Buddy|Bullseye|bumblebee|capture|CherryPicker|ChinaClaw|CICC|clipping|Clushbot|Collector|Copier|Crescent|Crescent\ Internet\ ToolPak|Custo|cyberalert|Deweb|diagem|Digger|Digimarc|DIIbot|DISCo|DISCo\ Pump|DISCoFinder|Download\ Demon|Download\ Wonder|Downloader|Drip|DSurf15a|DTS.Agent|EasyDL|eCatch|ecollector|efp@gmx\.net|Email\ Extractor|EirGrabber|email|EmailCollector|EmailSiphon|EmailWolf|Express\ WebPictures|ExtractorPro|EyeNetIE|FavOrg|fastlwspider|Favorites\ Sweeper|Fetch|FEZhead|FileHound|FlashGet\ WebWasher|FlickBot|fluffy|FrontPage|GalaxyBot|Generic|Getleft|GetRight|GetSmart|GetWeb!|GetWebPage|gigabaz|Girafabot|Go\!Zilla|Go!Zilla|Go-Ahead-Got-It|GornKer|gotit|Grabber|GrabNet|Grafula|Green\ Research|grub-client|Harvest|heritrix|hhjhj@yahoo|hloader|HMView|HomePageSearch|http\ generic|HTTrack|httpdown|httrack|ia_archiver|IBM_Planetwide|Image\ Stripper|Image\ Sucker|imagefetch|IncyWincy|Indy*Library|Indy\ Library|informant|Ingelin|InterGET|Internet\ Ninja|InternetLinkagent|Internet\ Ninja|InternetSeer\.com|Iria|Irvine|JBH*agent|JetCar|JOC|JOC\ Web\ Spider|JustView|kalooga|KWebGet|Lachesis|larbin|Leacher|LeechFTP|LexiBot|lftp|likse|Link|Link*Sleuth|LINKS\ ARoMATIZED|LinkWalker|LWP|lwp-trivial|Mag-Net|Magnet|Mac\ Finder|Mag-Net|Mass\ Downloader|MCspider|MJ12bot/v1\.0\.8|Memo|Microsoft.URL|MIDown\ tool|Mirror|Missigua\ Locator|Mister\ PiX|MMMtoCrawl\/UrlDispatcherLLL|monit|^Mozilla$|Mozilla.*Indy|Mozilla.*NEWT|Mozilla*MSIECrawler|MS\ FrontPage*|MSFrontPage|MSIECrawler|MSProxy|MSR-ISRCCrawler|multithreaddb|my-heritrix-crawler|nationaldirectory|Navroad|NearSite|NetAnts|NetCarta|NetMechanic|netprospector|NetResearchServer|NetSpider|Net\ Vampire|NetZIP|NetZip\ Downloader|NetZippy|NEWT|NICErsPRO|Ninja|NPBot|NicheBot|noxtrumbot|Octopus|Offline\ Explorer|Offline\ Navigator|OmniExplorer|OpaL|Openfind|OpenTextSiteCrawler|OrangeBot|PageGrabber|Papa\ Foto|PackRat|pavuk|pcBrowser|PersonaPilot|Ping|PingALink|Pingdom|Pockey|POE-Component-Client-HTTP|Powermarks|Proxy|psbot|PSurf|psycheclone|puf|Pump|PushSite|QRVA|RealDownload|Reaper|Recorder|ReGet|replacer|RepoMonkey|Robozilla|Rover|RPT-HTTPClient|Rsync|Scooter|SearchExpress|searchhippo|searchterms\.it|Second\ Street\ Research|Seeker|Shai|Siphon|sitecheck|sitecheck.internetseer.com|SiteSnagger|SlySearch|SmartDownload|snagger|Snake|SpaceBison|Spegla|SpiderBot|sproose|SqWorm|Stripper|Sucker|SuperBot|SuperHTTP|Surfbot|SurfWalker|Szukacz|tAkeOut|tarspider|Teleport\ Pro|Templeton|TencentTraveler|TrueRobot|TV33_Mercator|UIowaCrawler|UtilMind|URLSpiderPro|URL_Spider_Pro|Vacuum|vagabondo|vayala|visibilitygap|VoidEYE|vspider|Web\ Downloader|w3mir|Web\ Data\ Extractor|Web\ Image\ Collector|Web\ Sucker|Wweb|WebAuto|WebBandit|web\.by\.mail|Webclipping|webcollage|webcollector|WebCopier|webcraft@bea|webdevil|webdownloader|Webdup|WebEMailExtrac|WebFetch|WebGo\ IS|WebHook|Webinator|WebLeacher|WEBMASTERS|WebMiner|WebMirror|webmole|WebReaper|WebSauger|Website|Website\ eXtractor|Website\ Quester|WebSnake|Webster|WebStripper|websucker|webvac|webwalk|webweasel|WebWhacker|WebZIP|Wget|Whacker|whizbang|WhosTalking|Widow|WinHTTP|WISEbot|WWWOFFLE|x-Tractor|^Xaldon\ WebSpider|WUMPUS|Xenu|XGET|Yeti|zermelo|Zeus.*Webster|Zeus [NC]
RewriteRule ^.* - [F,L]

# Bots starting with Web
RewriteCond %{HTTP_USER_AGENT} ^web(zip|emaile|enhancer|fetch|go.?is|auto|bandit|clip|copier|master|reaper|sauger|site.?quester|whack) [NC,OR]
 
# Anywhere in UA -- Greedy REGEX
RewriteCond %{HTTP_USER_AGENT} ^.*(craftbot|download|extract|stripper|sucker|ninja|clshttp|webspider|leacher|collector|grabber|webpictures).*$ [NC]
RewriteRule ^.* - [F,L]
Hello there everybody. This is an urgent and important update!!!
We had an error in the above code, which made the htaccess file visible to web browsers.

Replace this part:

Code:
<FilesMatch "(.*)">
Order Allow,Deny
Allow from all
Deny from env=bad_bot
</FilesMatch>


with this:

Code:
<Limit GET POST>
Order Allow,Deny
Allow from all
Deny from env=bad_bot
</Limit>
Sorry for that. But as you seem I came back to correct the issue to avoid any future problems!!!
__________________
"Being an expert isn't telling other people what you know. It's understanding what questions to ask, and flexibly applying your knowledge to the specific situation at hand. Being an expert means providing sensible, highly contextual direction." Jeff Atwood
SEO Workers - Search Engine Optimization Consulting Company | SEO Analysis Tool | Webnauts Net SEO
Last edited by Webnauts; 09-03-2008 at 06:00 PM. Reason: URGENT ISSUE!!!!
Reply With Quote
Reply

  WebProWorld > Webmaster, IT and Security Discussion > Internet Security Discussion Forum

« How we can protect our privacy on using internet | WordPress Security Review »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

Similar Threads
Thread Thread Starter Forum Replies Last Post
SQL injection Attack incrediblehelp Database Discussion Forum 4 05-30-2008 11:52 AM
JavaScript Injection Attack Infects 'Hundreds of Thousands' of Websites Tech Manager Internet Security Discussion Forum 0 04-24-2008 12:05 PM
Can We Declare Automated Comment & Link Posting To Be Bad? WPW_Feedbot Search Engine Optimization Forum 0 09-19-2005 12:30 PM
Cutting through Microsoft?s latest FUD attack WPW_Feedbot IT Discussion Forum 0 01-31-2005 01:03 PM
www.cast-lighting.com steve-parrott Submit Your Site For Review 4 08-11-2004 12:54 PM


All times are GMT -4. The time now is 10:45 PM.

WebProWorld - Archive - Top

WebProWorld | Advertise | Contact Us | About | Forum Rules | MVP's | Archive | Newsletter Archive | Top | WebProNews
WebProWorld is an iEntry, Inc. ® site - © 2009 All Rights Reserved Privacy Policy and Legal
iEntry, Inc. 2549 Richmond Rd. Lexington KY, 40509

Search Engine Optimization by vBSEO 3.3.0