Daniel Posted March 31, 2008 Share Posted March 31, 2008 Firstly - This was built quickly so the code isn't pretty and there's probably faster ways of doing this.. but it works For those that have changed their admin directory in WHMCS (should be all of you) this is a fake login page for you to upload to /admin/ If someone tries to login to this fake area, their details, including IP address and the attempted username and details are forwarded to your email address. To use, simply upload the contents of the zip below to the [fake] /admin/ folder of your WHMCS install and edit the details at the top of "dologin.php" Disclaimer - I accept no responsibility of you breaking your install or loss of data by using this script! Download - Here Dan 0 Quote Link to comment Share on other sites More sharing options...
BenHarris Posted March 31, 2008 Share Posted March 31, 2008 Im also working on one which will save the details to file aswell as email it. I will post it in this post later. Cheers for that Dan, Ben original link edited 0 Quote Link to comment Share on other sites More sharing options...
BAJI26 Posted March 31, 2008 Share Posted March 31, 2008 Awaiting release! 0 Quote Link to comment Share on other sites More sharing options...
Daniel Posted March 31, 2008 Author Share Posted March 31, 2008 Its released - in the first post.. 0 Quote Link to comment Share on other sites More sharing options...
BAJI26 Posted March 31, 2008 Share Posted March 31, 2008 How can I get their ip addy to show under: We have been notified of your hacking attempt!Thank you And also would love the feature Ben mentioned where its also saved to a file. 0 Quote Link to comment Share on other sites More sharing options...
Daniel Posted March 31, 2008 Author Share Posted March 31, 2008 in dologin.php find <p style=\"font:11pt arial\" align=center>We have been notified of your hacking attempt!<i>Thank you</i></p><br> </body></html>"); exit(0); Replace with.. <p style=\"font:11pt arial\" align=center>We have been notified of your hacking attempt!<i>Thank you</i><br> Your IP Address has been logged as $ip </p> </body></html>"); exit(0); 0 Quote Link to comment Share on other sites More sharing options...
bear Posted March 31, 2008 Share Posted March 31, 2008 I'd suggest instead of "We have been notified of your hacking attempt!" you give them a "Sorry, service unavailable. Try again later." sort of message. Why clue them up that they've been caught and cause them to look deeper at your site? 0 Quote Link to comment Share on other sites More sharing options...
BenHarris Posted March 31, 2008 Share Posted March 31, 2008 Im working on a second mod which will just show the license invalid page LOL. They will be like, ok, their whmcs is blocked, cant login Ben EDIT: Just converted the download link to direct download, so you lot dont have to wait 0 Quote Link to comment Share on other sites More sharing options...
Daniel Posted March 31, 2008 Author Share Posted March 31, 2008 I'd suggest instead of "We have been notified of your hacking attempt!" you give them a "Sorry, service unavailable. Try again later." sort of message. Why clue them up that they've been caught and cause them to look deeper at your site? If it could output their IP to a text file, we could use a htaccess to just ban them so they can't go looking anymore anyway. 0 Quote Link to comment Share on other sites More sharing options...
BenHarris Posted March 31, 2008 Share Posted March 31, 2008 Hmm, I will integrate that into my version. Ben 0 Quote Link to comment Share on other sites More sharing options...
apollo1 Posted March 31, 2008 Share Posted March 31, 2008 Thanks very much guys, great work and ideas. 0 Quote Link to comment Share on other sites More sharing options...
indtg Posted March 31, 2008 Share Posted March 31, 2008 Looks great. I had to make one small change in login.php: Changed: print date("g.ia"); to: print date("g:ia"); This made the date format on the fake admin page match that of the real thing. (It could just be the way I'm displaying dates returned by PHP.) 0 Quote Link to comment Share on other sites More sharing options...
indtg Posted March 31, 2008 Share Posted March 31, 2008 I'm impressed Dan. A minor change in dologin.php in the "display mail sent message" section and it can look like a convincing "error" message. It's all in the details. 0 Quote Link to comment Share on other sites More sharing options...
Daniel Posted March 31, 2008 Author Share Posted March 31, 2008 Very nice indtg! Care to share? 0 Quote Link to comment Share on other sites More sharing options...
indtg Posted March 31, 2008 Share Posted March 31, 2008 you have a pm.... 0 Quote Link to comment Share on other sites More sharing options...
columbusgeek Posted March 31, 2008 Share Posted March 31, 2008 This is really a awsome tip. For the record this is how you change your admin folder name. I copied this from the security thread. Change your WHMCS Admin Folder nameMalicious users who visit your site and recognise a WHMCS install will know that they can try logging into your admin area via the admin folder. To protect against this, you can rename the admin folder name to any name you like. You cannot move the folder - only rename it. You can then tell WHMCS what the name of that folder is for the links in admin notification emails by adding the following line to your configuration.php file: $customadminpath = "myadminname"; 0 Quote Link to comment Share on other sites More sharing options...
ChrisGooding Posted March 31, 2008 Share Posted March 31, 2008 Some really nice work to all those involve so far... If anyone is willing to share, I would be really grateful. Cheers 0 Quote Link to comment Share on other sites More sharing options...
BAJI26 Posted March 31, 2008 Share Posted March 31, 2008 indtg can you share with me your code for that error page? Thanks! 0 Quote Link to comment Share on other sites More sharing options...
sTag-Dan Posted March 31, 2008 Share Posted March 31, 2008 I'm impressed Dan. A minor change in dologin.php in the "display mail sent message" section and it can look like a convincing "error" message. It's all in the details. Me too please 0 Quote Link to comment Share on other sites More sharing options...
indtg Posted March 31, 2008 Share Posted March 31, 2008 no worries. Dan, I don't mean to take over your thread. You did the majority of the work on this so the credit goes to you. Attached is a modified version of Dan's code. The quick and dirty modifications are: Changed the time to HH:MM (see previous post in this thread) Created a templates folder with style.css from admin/templates Modified the "display mail sent message" section in dologin.php so the output mimics the login page with an error message (and yes, the time updates on the error page too.) You can change the error message by searching for Database Connection Error in dologin.php and replacing it with your own error. Examples: Database Connection Error. The database YOURFAKEDB cannot be found. Web Service Error Admin Web Service is not available. Or you can use the default invalid login error message in WHMCS: Login Failed. Please Try Again. Your IP has been logged and Admins notified of this failed attempt. Ideally (IMHO) you want the fake admin website to mimic the real one. The devil is in the details and if someone is google hacking for WHMCS admin websites (inurl:admin intitle:WHMCompleteSolution), you want the html output of the fake admin page to be the same as the output from the real one. Dan has my code so I'll let him handle the "official" release. Thanks! This seems like an awful lot of work but I'd rather have someone or something pointlessly spend their time and get nowhere in the end. admin_modified.zip 0 Quote Link to comment Share on other sites More sharing options...
Daniel Posted March 31, 2008 Author Share Posted March 31, 2008 You're free to take-over the thread, its a good improvement! 0 Quote Link to comment Share on other sites More sharing options...
BAJI26 Posted March 31, 2008 Share Posted March 31, 2008 Can I use $today = date("F j, Y, g:i a"); or $date=date("F j, Y, g:i a"); 0 Quote Link to comment Share on other sites More sharing options...
Daniel Posted March 31, 2008 Author Share Posted March 31, 2008 You could - but it wouldn't look like the default WHMCS page. Why change it? 0 Quote Link to comment Share on other sites More sharing options...
BAJI26 Posted March 31, 2008 Share Posted March 31, 2008 In the admin can't the time format be changed? 0 Quote Link to comment Share on other sites More sharing options...
indtg Posted March 31, 2008 Share Posted March 31, 2008 Yes it can be changed under Config | General Settings | Localisation however I don't believe that change affects the date and time at the top of the admin pages. Edit: Changing that setting does not affect the format of the date and time on the admin pages of my whmcs website however, I can't vouch for anyone else's installation. 0 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.