How to end the hacking!

[haveawoody]

Just for the perl programmer.

Create or add to the bad words list (script)
Alter to (scripts)

That's an end to the hacking.
They are entering with HTML as a java script entry.
Clipping the (script) word won't allow java script to be displayed as html on the site by anyone other than done in main code.

Hope that helps the Perlie

 

[TonyK]

I'm guessing that this attack is not a person but a BOT of some sort that is doing a session id pull like you can do with metasploit or blackhole. Once the BOT pulls the session id it can inject the xss into the stream with an elevated privilege. If the mods could plug some IPS solution into the site server they could effectively shut the BOT out from doing the injection forever.

 

[zogger]

Good stuff guys!

Moderator, get this to the administrators please.

 

[Steve NW WI]

Good stuff guys!

Moderator, get this to the administrators please.

It's all over my head, but I'm gonna report this post so it shows in the Moderator forum. It'd be great if it's that easy. (Somehow I suspect it ain't, or it'd be fixed by now.)

 

[haveawoody]

TonyK,

Things are very limited on this perl based message board as to entering with elevated privileges.
A file exists with a set of codes so only the admin can alter what happens in general, no way other than very serious hacking to obtain that password and to alter that file even more difficult.

I suspect the person hacking is a 12 year old or someone having a bit of fun trying to use script to make things look serious.
Allowing HTML is the route problem, but if I remember this message board system it already has a bad word list as part of the admin options.
Very easy to add a few words to stop someone and allow all the cool functions of html.
(script) and (table) and (form) are the 3 best to add to the bad words list.
Allowing script to run allows for many many irritating java scripts, and killing the form and table words removes almost all the rest of irritating table entries and a bunch of other idiot things that could be done with a form entry.

 

[fa2]

TonyK,

Things are very limited on this perl based message board as to entering with elevated privileges.
A file exists with a set of codes so only the admin can alter what happens in general, no way other than very serious hacking to obtain that password and to alter that file even more difficult.

I suspect the person hacking is a 12 year old or someone having a bit of fun trying to use script to make things look serious.
Allowing HTML is the route problem, but if I remember this message board system it already has a bad word list as part of the admin options.
Very easy to add a few words to stop someone and allow all the cool functions of html.
(script) and (table) and (form) are the 3 best to add to the bad words list.
Allowing script to run allows for many many irritating java scripts, and killing the form and table words removes almost all the rest of irritating table entries and a bunch of other idiot things that could be done with a form entry.

Perl?, pretty sure vbulletin is php based.....


Sent from my iPad using Tapatalk HD

 

[Thompson20398]

So, I really have no idea what you are all talking about, but does it have anything to do with this "linkbucks" thing popping up every time I log on here? It tries to make me download some program. It seems fishy. I can't make it go away, although I seemed to thwart it when I had to disable my Java program while updating it.

 

[Thompson20398]

Ok I kept reading other threads and answered my own question.

 

[haveawoody]

fa2,

If it's a php message board system it's a little different programming.
Same rules apply though for permissions and clipping words in a bad word list.

Pretty sure if you use a swear word here it alters it auto into (****)
So it's just a bit of careful entries onto that list for things it wont allow html code to do from a user.

Anyway it's sad to see all us wood choppers have to deal with the hackers fun and sad to see the effect it's having on the place.
Hope the admin can crunch out the code and depart the hackers openings in record speed.

I would in about 5 minutes

 

[Whitespider]

How to end the hacking??
Seems simple enough to me... just make it a hangin' offence.
People do this crap for three main reasons...

1. Because they can
2. Because they won't likely get caught
3. Because they ain't afraid of the consequences if they do get caught

Now, there ain't much can be done about the first two...

It's basically the same with near any violation of "lower" law... I'm talkin' violations that don't usually result in profit for the violator. How many of us have been ticketed for speeding on the roadway, and even after paying the fine still speed on occasion?? What if the minimum penalty for speeding was 12 months in county lock-up?? Would you still play the odds on occasion??

People drive drunk because odds are they won't get caught.... and they ain't overly concerned about the consequences if they do get caught. Yeah, it would suck, cost a few bucks, lose their drivers licence... but none of that actually stops them from driving, or driving drunk again (how many times do you see repeat drunk drivers get charged for "no drivers licence" along with drunk driving?). But what if the minimum penalty for "open container" was 25 years jail time, and the minimum penalty for drunk driving was 50 years jail time?? Do ya' reckon the number of drunk drivers would be lower, much lower??

There was a time in this country when bad social behavior wasn't tolerated... was not tolerated by the law or the public.
But now-a-days we live in a time where it is almost celebrated... a time when our married president can get caught in a compromising position with another woman, lie about it, commit perjury, and still keep his job.
You reap what you sow.


Too be completely clear...
At one time in this country, if someone publicly acted in a rude manor they'd likely receive a good-ol'-fashion azz-whoopin'... and law enforcement and the public applauded the azz-whoopin'.
Now-a-days, if ya' whoop someones azz for being publicly rude, you go to jail, the guy who got whooped can sue and collect money from you (just ask me)... it flat ain't right.

 

[naturelover]

caught[/i] in a compromising position with another woman, lie about it, commit perjury, and still keep his job.
You reap what you sow.

Well, considering the undertakings of the President that followed.....




Sent from my iPhone 5 using Tapatalk

 

[Whitespider]

Well, considering the undertakings of the President that followed.....

You reap what you sow...

 

[D&B Mack]

Well, I'm not that great on all this computer stuff. (as I posted elsewhere) Firefox has an add-on to disable scripts called "No Script". Just allow scripts from arboristsite.com and you are good to go; stops the redirect.

 

[Kevin in Ohio]

If someone can pinpoint where this person is I'd appreciate an address. That way someone or a group totally obscure close by could personally "thank" them for their efforts. No harm right? Just all in the name of fun like they are doing.

 

[Photog95]

vbulletin is php based, but it still has word sensor and the admion can still set permissions.

 

[MrWhoopee]

Google Chrome with ScriptSafe is working nicely.

 

[iceman7668]

I too am having a links buck problem when I pull up the website here. How the Heck do I get rid of it????

 

[Stihl310]

For once I'm glad I'm running tapatalk, no issues here at all. No annoying ads.

 

[mainewoods]

download Noscript- works like a charm. Been using it for a week -zero issues since.

 

[WVwoodsman]

After doing a "whois" search, the following information was found:


Domain Name: ##############
Registrar: GODADDY.COM, LLC
Whois Server: whois.godaddy.com
Referral URL: Domain Names | The World's Largest Domain Name Registrar - GoDaddy
Name Server: NS1.PKDOMAINS.NET
Name Server: NS2.PKDOMAINS.NET
Name Server: NS3.PKDOMAINS.NET
Status: clientDeleteProhibited
Status: clientRenewProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 20-oct-2010
Creation Date: 02-dec-1999
Expiration Date: 02-dec-2014






############## registrar whois

Updated 1 second ago


Domain Name: ##############
Registrar URL: Domain Names | The World's Largest Domain Name Registrar - GoDaddy
Updated Date: 2010-10-19 23:23:04
Creation Date: 1999-12-02 07:46:44
Registrar Expiration Date: 2014-12-02 07:46:44
Registrar: GoDaddy.com, LLC
Registrant Name: Registration Private
Registrant Organization: Domains By Proxy, LLC
Registrant Street: DomainsByProxy.com
Registrant Street: 14747 N Northsight Blvd Suite 111, PMB 309
Registrant City: Scottsdale
Registrant State/Province: Arizona
Registrant Postal Code: 85260
Registrant Country: United States
Admin Name: Registration Private
Admin Organization: Domains By Proxy, LLC
Admin Street: DomainsByProxy.com
Admin Street: 14747 N Northsight Blvd Suite 111, PMB 309
Admin City: Scottsdale
Admin State/Province: Arizona
Admin Postal Code: 85260
Admin Country: United States
Admin Phone: (480) 624-2599
Admin Fax: (480) 624-2598
Admin Email: @domainsbyproxy.com
Tech Name: Registration Private
Tech Organization: Domains By Proxy, LLC
Tech Street: DomainsByProxy.com
Tech Street: 14747 N Northsight Blvd Suite 111, PMB 309
Tech City: Scottsdale
Tech State/Province: Arizona
Tech Postal Code: 85260
Tech Country: United States
Tech Phone: (480) 624-2599
Tech Fax: (480) 624-2598
Tech Email: @domainsbyproxy.com
Name Server: NS1.PKDOMAINS.NET
Name Server: NS2.PKDOMAINS.NET
Name Server: NS3.PKDOMAINS.NET