Snitz Forums 2000
Snitz Forums 2000
Home | Profile | Register | Active Topics | Members | Search | FAQ
Username:
 Password:
Save Password
Forgot your Password?

 All Forums
 Help Groups for Snitz Forums 2000 Users
 Help: General / Classic ASP versions(v3.4.XX)
 same name, same country, IP of 0's - barry		  New Topic  Topic Locked
 Printer Friendly
Previous Page | Next Page
Author Previous Topic Topic Next Topic
Page: of 4

barrynet
Starting Member

36 Posts
Posted - 20 January 2009 :  00:06:13  Show Profile
quote:
Originally posted by ruirib

Barry,

You need to check your web server logs, to find out how they got in there. Seeing the M_DATE would allow you to know the precise time of their registration, so it's easy to use server logs to find out what's happening.


ruirib and Shaggy

I got the logs but I can not even begin to read whats in there, its just line after line of data. What am I looking for??

cheers

Barry

<
Go to Top of Page

Carefree
Advanced Member

Philippines
4212 Posts
Posted - 20 January 2009 :  01:04:51  Show Profile
If you're still up, post a link to your "topic.asp" in .txt format and I'll try and solve it for you.<
Go to Top of Page

Shaggy
Support Moderator

Ireland
6780 Posts
Posted - 20 January 2009 :  04:28:33  Show Profile
If you want to zip up a couple relevant to the dates of "registration" and e-mail them to one or both of us with the values in the M_DATE field of a couple of the members, we can have a look for you.

One other thing nobody else seems to have mentioned is that you may have been hacked through an unpatched exploit in your forums and someone may have assigned themselves admin privelges which would allow them to approve pending members. You should check that you don't have any extra admins.

And the reason you see a different members list when you're logged in as administrator is that normal users won't see deleted members.

<
Search is your friend
“I was having a mildly paranoid day, mostly due to the
fact that the mad priest lady from over the river had
taken to nailing weasels to my front door again.”
Go to Top of Page

barrynet
Starting Member

36 Posts
Posted - 20 January 2009 :  09:33:44  Show Profile
I have to go and get some blood work done and see a Doctor today,
will provide the logs and code later tonight.

Again thanks for your assistance and patience with me

cheers

Barry
Ottawa, Canada<
Go to Top of Page

barrynet
Starting Member

36 Posts
Posted - 20 January 2009 :  16:26:00  Show Profile
OK Here is the info you asked for Carefree

http://www.nwsca.com/snitz_docs/members.asp_with_admin.html
http://www.nwsca.com/snitz_docs/members.asp_no_admin.html
****Now understand that locked Members are not visible to a non admin user. Thanks Shaggy, missing that was one of my "seniors moments"

http://www.nwsca.com/snitz_docs/barry_b_details.html
registered as barry_d same first/last names
However did come through pending Members as expected

http://www.nwsca.com/snitz_docs/register.txt
register asp text file - with check for same first and last name

http://www.nwsca.com/snitz_docs/topic.txt

Shaggy and Rui I sent the link to my log files via your Email.<
Edited by - barrynet on 20 January 2009 17:02:53
Go to Top of Page

Carefree
Advanced Member

Philippines
4212 Posts
Posted - 20 January 2009 :  20:30:06  Show Profile
I must have had one of those "senior moments" myself. I don't need your "topic.asp" file, I need the "register.asp" in .txt format. Sorry.<
Go to Top of Page

barrynet
Starting Member

36 Posts
Posted - 20 January 2009 :  21:03:47  Show Profile
quote:
Originally posted by Carefree

I must have had one of those "senior moments" myself. I don't need your "topic.asp" file, I need the "register.asp" in .txt format. Sorry.

Now you have had 2

Its in the post above. I thought you wanted the topic one as well so I included both

<
Edited by - barrynet on 20 January 2009 21:05:47
Go to Top of Page

Carefree
Advanced Member

Philippines
4212 Posts
Posted - 20 January 2009 :  22:58:17  Show Profile
OK - no more blonde/senior moments. This works:
' ##################################  following added to check names
' ##################################  change from carefree v3
	if trim(Request.Form("LASTNAME"))>"" then LName=trim(Request.Form("LASTNAME"))
	if trim(Request.Form("FIRSTNAME"))>"" then FName=trim(Request.Form("FIRSTNAME"))
	if LName<>"" or FName<>"" then
		if LName=FName then
			'duplicate names in registration
			Response.Redirect "default.asp"
		end if
	end if
' ################################## end of add
<
Go to Top of Page

Shaggy
Support Moderator

Ireland
6780 Posts
Posted - 21 January 2009 :  04:30:32  Show Profile
quote:
Originally posted by barrynet
Shaggy and Rui I sent the link to my log files via your Email.
Sorry, Barry, can you resend it? I accidentally junked it

<
Search is your friend
“I was having a mildly paranoid day, mostly due to the
fact that the mad priest lady from over the river had
taken to nailing weasels to my front door again.”
Go to Top of Page

barrynet
Starting Member

36 Posts
Posted - 21 January 2009 :  16:59:09  Show Profile
quote:
Originally posted by Shaggy

quote:
Originally posted by barrynet
Shaggy and Rui I sent the link to my log files via your Email.
Sorry, Barry, can you resend it? I accidentally junked it




Done

thanks

Barry<
Go to Top of Page

barrynet
Starting Member

36 Posts
Posted - 21 January 2009 :  20:26:56  Show Profile
quote:
Originally posted by Carefree

OK - no more blonde/senior moments. This works:
' ##################################  following added to check names
' ##################################  change from carefree v3
	if trim(Request.Form("LASTNAME"))>"" then LName=trim(Request.Form("LASTNAME"))
	if trim(Request.Form("FIRSTNAME"))>"" then FName=trim(Request.Form("FIRSTNAME"))
	if LName<>"" or FName<>"" then
		if LName=FName then
			'duplicate names in registration
			Response.Redirect "default.asp"
		end if
	end if
' ################################## end of add




Hooray that works great, thanks Carefree.

It may be a bit rude to just dump them back to the logon page without an explanation. I am really going to stretch my welcome here and ask two things

1. Could the send to default.asp be changed to something named badnames.asp in which there would be an explanation and the option of returning to the registration page page. That might not work without a timer that would fall through to default.asp if the option is not chosen by a robot.

Might be easier for me to just add a warning "First and Last name must be different" under the "you need to have a valid e-mail address." on the registeration page.

2. Would it be hard to provide the code now that you know what works to check the country(s). It would be a separate if statement in front of the name check one you provided. I do not care if they are informed of the problem.

Thanks very much, can't say it enough.

Now I need to wait and see what happens.

cheers


Barry






<
Edited by - barrynet on 21 January 2009 20:27:51
Go to Top of Page

Carefree
Advanced Member

Philippines
4212 Posts
Posted - 21 January 2009 :  21:36:11  Show Profile
You realize that if you tell the spammers why you are rejecting their bot scripts, they'll simply modify the scripts and spam you again?

That said, here's the routine included for the country.
' ##################################  following added to check names
' ##################################  change from carefree v3
	if trim(Request.Form("LASTNAME"))>"" then LName=trim(Request.Form("LASTNAME"))
	if trim(Request.Form("FIRSTNAME"))>"" then FName=trim(Request.Form("FIRSTNAME"))
	if LName<>"" or FName<>"" then
		if LName=FName then
			'duplicate names in registration
			Response.Redirect "default.asp"
		end if
	end if
	if trim(Request.Form("COUNTRY"))="ALBANIA" then
		'Don't want your business
		Response.Redirect	"default.asp"
	end if
' ################################## end of add
<
Go to Top of Page

barrynet
Starting Member

36 Posts
Posted - 21 January 2009 :  23:05:23  Show Profile
Oh so its not just a case some some dumb code wandering around, someone actually looks.

In that case it makes no sense to tell them. Hope they do not monitor this forum.

cheers

Barry<
Go to Top of Page

Shaggy
Support Moderator

Ireland
6780 Posts
Posted - 22 January 2009 :  04:12:52  Show Profile
quote:
Originally posted by barrynet
quote:
Originally posted by Shaggy
Sorry, Barry, can you resend it? I accidentally junked it
Done

thanks

Barry
Got it Can you post a few values from the M_DATE field for a few suspect accounts so we can pinpoint exactly where in the logs we should be looking?

<
Search is your friend
“I was having a mildly paranoid day, mostly due to the
fact that the mad priest lady from over the river had
taken to nailing weasels to my front door again.”
Edited by - Shaggy on 22 January 2009 04:13:10
Go to Top of Page

barrynet
Starting Member

36 Posts
Posted - 22 January 2009 :  22:34:49  Show Profile

Here is the database info

http://www.nwsca.com/snitz_docs/db_details_bad.jpg
http://www.nwsca.com/snitz_docs/db_details_bad2.jpg

The following is the server time setup.
http://www.nwsca.com/snitz_docs/time_adj.jpg

Its still happening
http://www.nwsca.com/snitz_docs/Albania_jan22_2009.jpg

cheers

Barry<
Go to Top of Page
Page: of 4 Previous Topic Topic Next Topic  
Previous Page | Next Page
 New Topic  Topic Locked
 Printer Friendly
Jump To:
Snitz Forums 2000 © 2000-2021 Snitz™ Communications Go To Top Of Page
This page was generated in 0.31 seconds. Powered By: Snitz Forums 2000 Version 3.4.07