Help with security issues. Please see code

[bvrettski]

I have been experiencing a number of attacks and hacks on my joomla sites. I have been trying to follow security guidelines here and implement them as best I can. One thing I have done is to watch my logs to see who is visiting. I found a number (7) of the following yesterday all from different host numbers. They all happened seconds apart:

Host: [RussW: Removed, irrelevant to discussion or resolution]

//administrator/components/com_securityimages/lang.php?mosConfig_absolute_path=[RussW: Removed, irrelevant to discussion or resolution] ?
Http Code: 403 Date: Feb 17 06:49:44 Http Version: HTTP/1.1 Size in Bytes: 581
Referer: -
Agent: libwww-perl/5.803

When I went to http://[RussW: Removed, irrelevant to discussion or resolution] ? I found the following script.

[RussW: References to Exploit, Country, Names or Detail have been removed, these are irrelevant to the discussion and offer nothing to assist with issue resolution.]

Can someone tell me what this is trying to do?

[mandville]

its scanning your site for vulnerabilities

http://cyberphob1a.wordpress.com/2008/0 ... -networks/

[bvrettski]

Thanks..that was my suspicion. How do I report and fight against this sort of thing?

[mandville]

report it to the host or domain registrar, enable the htaccess and read the security faq

[Geoff]

Security FAQs: http://help.joomla.org/component/option ... temid,268/

[bvrettski]

I'm well aware of the security FAQ but thanks. Its a bit overwhelming trying to understand the ins and out of security so when I post its usually becasue I'm looking for something more specific, that i haven't been able to find.

In this case understanding the code I posted above and what sort of attack this might be, if it was an attack. So the security FAQ wasnt much help.

[RussW]

@bvrettski

I believe that if you spend time working through the Security FAQ's, Stickies and the many many posts with similar if not the same information you will find that your questions are answered in great detail, also as a learning experience you will start to develop a better understanding of the requirements of running a secure site and learn more regarding what the attempted exploit was doing. Some PHP experience will assist you greatly also.

We do understand the FAQ's are large and contain a lot of information, of which is very new to many folks, but working through the FAQ's one by one and point by point, rather than trying to attack the complete document in one session will ease the learning process and provide for a better overall understanding of security techniques and measures.