quote:

---

Please don't crash the browsers.

---

Indeed.. at worst, send them a redirect to Disney.com or something similarly saccharine sweet. Maybe find away to erase the history so they can't use the back button to find your site via the back button as well.. hmmm.. I wonder..

quote:

---

The best defense is to apply the patch HuwR was right. If you want to do some good go find an unhacked site that hasn't applied the patch and clue them in.

---

I sent a message to the person running the site that hooked me on Snitz in the first place.. she hadn't applied the mod yet.. and with several hundred users and several thousand messages, she was very happy that someone did clue her in...


----
http://HandAble.com


Edited by - HandAble.com on 10 May 2002 17:20:20

bannedip = "212.146.171.168|212.252.6.203|195.175.203.141|217.131.15.164|193.251.85.63|62.81.206.160|195.175.170.127|195.175.185.169"
if InStr(bannedip, Request.ServerVariables("REMOTE_ADDR")) > 0 then
	Response.Redirect("http://www.fbi.gov")
end if

quote:

---

We installed something similiar on this site, and then placed the following in the global.asa file in the Session_OnStart sub:

bannedip = "212.146.171.168|212.252.6.203|195.175.203.141|217.131.15.164|193.251.85.63|62.81.206.160|195.175.170.127|195.175.185.169"
if InStr(bannedip, Request.ServerVariables("REMOTE_ADDR")) > 0 then
	Response.Redirect("http://www.fbi.gov")
end if

The IP Addresses are e-mailed to me when someone attempts to hack the members page, I also have it sending me the entire Request.QueryString so I can see exactly what they were trying to do. The person who is attempting the hacking does not get any notice when they attempt it.

Then I just add IP Addresses to the bannedip list as I get new e-mails.

---

quote:

---

The ozroot.com Hack Mod has detected an attempt to hack your forum.

Hacker IP - 5/10/2002 4:06:14 PM Pacific Daylight Time

The recommended course of action is to find the owner of the IP address at

http://www.geektools.com/cgi-bin/proxy.cgi?query="Hacker IP"

and send them the following message:

Hello,

Our web server at http://Your website has recently experienced a large number of malicious attacks. A user with the IP address:

Hacker IP

tried to break into our server and steal private information at:

5/10/2002 4:06:14 PM Pacific Daylight Time

These attacks have already cost us many hours and caused the loss of valuable data.
It is our hope that you will take the appropriate action to ensure that these attacks
do not continue from addresses under your control. We look forward to hearing back from
you that this issue has been resolved.

Thank you,

Your Name
Your email address

---

Tim

quote:

---

We installed something similiar on this site, and then placed the following in the global.asa file in the Session_OnStart sub:

bannedip = "212.146.171.168|212.252.6.203|195.175.203.141|217.131.15.164|193.251.85.63|62.81.206.160|195.175.170.127|195.175.185.169"
if InStr(bannedip, Request.ServerVariables("REMOTE_ADDR")) > 0 then
	Response.Redirect("http://www.fbi.gov")
end if

The IP Addresses are e-mailed to me when someone attempts to hack the members page, I also have it sending me the entire Request.QueryString so I can see exactly what they were trying to do. The person who is attempting the hacking does not get any notice when they attempt it.

Then I just add IP Addresses to the bannedip list as I get new e-mails.

---

<OBJECT RUNAT=Server SCOPE=Session ID=MyInfo PROGID="MSWC.MyInfo">
</OBJECT>

<OBJECT RUNAT=Server SCOPE=Session ID=MyInfo PROGID="MSWC.MyInfo">
</OBJECT>
<SCRIPT LANGUAGE="VBScript" RUNAT="Server">
 
Sub Session_OnStart
	'## Ban IP Addresses
	bannedip = "212.146.171.168|212.252.6.203|195.175.203.141|217.131.15.164|" & _
		   "193.251.85.63|62.81.206.160|195.175.170.127|195.175.185.169"
	if InStr(bannedip, Request.ServerVariables("REMOTE_ADDR")) > 0 then
		Response.Redirect("http://www.fbi.gov")
	end if
End Sub
 
</SCRIPT>