|
|
|
|
Joined: Oct 2007
Posts: 531 Likes: 13
Addict
|
|
Addict
Joined: Oct 2007
Posts: 531 Likes: 13 |
fI've been looking at Google's 404 returns and found these in many of the urls. The string found in the url is listed first:
what=style most of them Exact value only, or can what= have a suffix?
value=11 most of them Style ID? Any integer legal?
curl= return URL Intended values: relative path only, same-host URL only, or any URL?
curl=https://… encoded junk Should an absolute URL be accepted?
https3A2F2F / http3A2F2F fake encoding of :// Used anywhere in UBB?
strnum= some curl= targets UBB parameter, or only on the spam sites?
showflat, showprofile, newuser, login, etc I believe these are all legit strings.
I'm considering writing some rewrite rules that would return 410. What I need to know is, are any of these strings used in the software. If so, how? That will help me write the rules so I don't reject legitimate traffic.
|
|
|
|
|
Joined: Jun 2006
Posts: 16,532 Likes: 150
|
|
Joined: Jun 2006
Posts: 16,532 Likes: 150 |
I encourage you to utilize a tool such as grepwin to search through the code for references for your 3rd party tools as this is the same method we'd use to look this all up.
I can tell you that: what=
is in: /scripts/showflat.inc.php & /templates/default/rss.tmpl
and values should be showthreaded/showflat and maybe showgallery
and that curl is not in v8.
|
|
|
|
|
Joined: Oct 2007
Posts: 531 Likes: 13
Addict
|
|
Addict
Joined: Oct 2007
Posts: 531 Likes: 13 |
Thank you Gizmo. I implemented these rules in the .htaccess file. RewriteEngine On
# A. changeprefs with a what= that is not style or lang
RewriteCond %{REQUEST_URI} ^/ubbthreads/ubbthreads\.php$ [NC]
RewriteCond %{QUERY_STRING} (^|&)ubb=changeprefs(&|$) [NC]
RewriteCond %{QUERY_STRING} (^|&)what= [NC]
RewriteCond %{QUERY_STRING} !(&|^)what=(style|lang)(&|$) [NC]
RewriteRule ^ - [G,L]
# B. curl= with fake https:// or http:// encoding
RewriteCond %{REQUEST_URI} ^/ubbthreads/ubbthreads\.php$ [NC]
RewriteCond %{QUERY_STRING} curl=https?3A2F2F [NC]
RewriteRule ^ - [G,L]
# C. curl= is an absolute http(s) URL that is not stovebolt.com
RewriteCond %{REQUEST_URI} ^/ubbthreads/ubbthreads\.php$ [NC]
RewriteCond %{QUERY_STRING} curl=https?:// [NC]
RewriteCond %{QUERY_STRING} !curl=https?://(www\.)?stovebolt\.com [NC]
RewriteRule ^ - [G,L]
# D. curl= starts with a hostname and no scheme
RewriteCond %{REQUEST_URI} ^/ubbthreads/ubbthreads\.php$ [NC]
RewriteCond %{QUERY_STRING} (^|&)curl=([a-z0-9-]+\.)+[a-z]{2,} [NC]
RewriteCond %{QUERY_STRING} !curl=(https?://)?(www\.)?stovebolt\.com [NC]
RewriteRule ^ - [G,L]
# E. curl=// not pointing at this host
RewriteCond %{REQUEST_URI} ^/ubbthreads/ubbthreads\.php$ [NC]
RewriteCond %{QUERY_STRING} (^|&)curl=// [NC]
RewriteCond %{QUERY_STRING} !curl=//(www\.)?stovebolt\.com(/|&|$) [NC]
RewriteRule ^ - [G,L]Hopefully, this will stop some of the attacks. At a minimum it will remove these urls from Google.
|
|
|
|
1 members (1 invisible),
304
guests, and
96
robots. |
|
Key:
Admin,
Global Mod,
Mod
|
|
|
|
|
|
