Admin Breach

[PPH]

Would .htaccess authentication for the admin folder cause problems with callbacks from merchant accounts and registrars?

[Chrisw]

None so far for me.

 

Although, the admin logins is starting to popup more and more folks. .htaccess protect that admin folder.

[bear]

I also had a thought. If you move your admin directory, you could make a spoof admin directory, so they would be mindlesly brute forcing a form.

 

Did that very thing for certain scripts that were being abused. Simply create a txt file and give it write perms (in this example: logthis.txt), then have this php file in the same dir (blue bits are optional, if you want to let them know they were caught):

Your IP address is: <?php echo $_SERVER['REMOTE_ADDR']; ?><br><br>

That resolves to this host: <?php echo strtoupper(gethostbyaddr($_SERVER['REMOTE_ADDR'])); ?><br><br>

 

It's been recorded that you've tried to submit spam via this form handler, and the above host will be notified about your activity.<br>

Have a nice day!

 

<?php $logfile = ("logthis.txt"); $fp = fopen($logfile,"a"); fputs ($fp, date('m-d-y@H:i:sT')." - ".($ip = $_SERVER['REMOTE_ADDR'])." - ".strtoupper(gethostbyaddr($ip))." - ".$_SERVER['HTTP_REFERER']."\n"); fclose($fp); ?>

 

Instead of letting them know they were caught, you might instead simply show the "failed login" text or push them to Google or something like that.

Enjoy!

[Daniel]

Good idea bear - Would it be possible to log the usernames and passwords that they've tried too?

[bear]

Good idea bear - Would it be possible to log the usernames and passwords that they've tried too?

 

For that you'd need to have a form there to fill out, and then write the POST vars to the file as well. The way I'd been using the one above was to set up an .htaccess redirect if they called the abused mail script directly. It was a PERL script that was being remotely submitted.

 

For this to work on the logins, simply make a copy of the WHMCS login form as the main page in your "foo" admin area, and have it submit to the script, and have it append the login details along with the IP and all that.

[Daniel]

I thought that might be the case - I'm working on one now

[Daniel]

Just finished setting up the false page and it works great

 

We'll see if I manage to catch anyone...

[bear]

Just finished setting up the false page and it works great

Will you be sharing the code here?

[Daniel]

Sure - I'll zip it all up and stick it in the contrib forum.

[BenHarris]

Link us when you do. Will save me having do do it myself

 

Might just do my own version too though. I also had another thought. What if you make the "foo" admin area just default to the WHMCS License invalid page LOL.

 

Ben

[Daniel]

http://forum.whmcs.com/showthread.php?p=55870#post55870

[Redundant]

Just wanted to throw yall my thanks for this Great community here.

[mountainhost]

Another alternative to security for your admin folder would be to allow only certain IP codes in your htaccess and block all others.

I have a website that can create allow only country codes http://www.countryipblocks.net, this for me stopped all the hackers from turkey.

They can still hop on the back of a US ip, but then I narrow the list down to just use my ISP address so I can access it and the IP of the Licensing Server.

 

Just a thought.