Support

Mandatory information about my setup:

Have I read the related troubleshooter articles above before posting (which pages?)? Yes
Have I searched the forum before posting? Many times
Have I read the documentation before posting (which pages?)? Yes
Joomla! version: 1.5.23
PHP version: Latest
MySQL version: Latest
Host: Hostgator
Admin Tools version: svn364


Description of my issue:

I am very very very sorry for disturbing you again and again by asking foolish questions.

My last 2 hours security log is like this (of Autoblocking):

Reason: Bad Behaviour (Request contained a malicious JavaScript or SQL injection attack)
Reason: Bad Behaviour (User-Agent was found on blacklist)
Reason: Spammer (via HTTP:BL)
Reason: Bad Behaviour (User-Agent was found on blacklist)
Reason: Bad Behaviour (Prohibited header 'Range' present)
Reason: Bad Behaviour (Prohibited header 'Proxy-Connection' present)
Reason: Bad Behaviour (Referer did not point to a form on this site)
Reason: Bad Behaviour (Prohibited header 'Proxy-Connection' present)
etc.


I did bad behavior of honeypot to 10 and its age to 5. and everything as advanced as I can.

I have taken backup of whole website.

Emergency Offline will be too much costly for me.

1. What next I should do??
2. What more I can do??
3. How that hacker is taking and advancing??
4. Is there is some example guide available on internet which he is applying? Can I view that? Can you give some guide?
5. Is there is any way to find his actual IP address? Is there is anything by which we can block his actual IP rather then keep on blocking every time just blocking a proxy server?
6. Is this is common and happens with many websites including yours? and I should not give attention to such activities? What is your experience?

Thankyou so much for your reply.

Now I can sleep. Do you know this is 2:36 AM at India? Also, more importantly, I am a M.S. student and my exams are from tomorrow. I cannot even study due to all these.

I was in a big tension due to these hacking attempts.

Main problem are notification emails ;-) I am going to turn them off so that I can sleep well and score well in my exams.

Again thanks a lot for always giving immediate and useful reply. Your reply always makes my life more comfortable.

Thanks, I turned them off. Now I will also keep my eye on Logs.

I would like to suggest you two things:

1. There should be a full and detailed log of hack attempt.
eg. Actual IP address should be logged, rather than proxy address (IF POSSIBLE to LOG that time and allowed by proxy)
if($HTTP_SERVER_VARS["HTTP_X_FORWARDED_FOR"] != ""){
$IP = HTTP_SERVER_VARS["HTTP_X_FORWARDED_FOR"];
$proxy = $HTTP_SERVER_VARS["REMOTE_ADDR"];
$host = gethostbyaddr($HTTP_SERVER_VARS["HTTP_X_FORWARDED_FOR"]);

2. It should not only like "Reason: Bad Behaviour (Request contained a malicious JavaScript or SQL injection attack)", it should log each and every information. What was exact query etc.
or
"Reason: Bad Behaviour (User-Agent was found on blacklist)" rather it should log what was the exact attempt and by which agent

etc.

3. Similar to "Emergency Offline Mode" there should be also a mode in which to block all proxy access to website. This will be useful in case of acute emergency, and most often, hackers will not hack without proxy access. eg

RewriteEngine on
RewriteCond %{HTTP:VIA} !^$ [OR]
RewriteCond %{HTTP:FORWARDED} !^$ [OR]
RewriteCond %{HTTP:USERAGENT_VIA} !^$ [OR]
RewriteCond %{HTTP:X_FORWARDED_FOR} !^$ [OR]
RewriteCond %{HTTP:PROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:XPROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:HTTP_PC_REMOTE_ADDR} !^$ [OR]
RewriteCond %{HTTP:HTTP_CLIENT_IP} !^$
RewriteRule ^(.*)$ - [F]


Points 1 and 2 will also help in detailed and formal complaint to ISP and IC3.

Sorry to give you codes, these are just to express my view and codes I found from Google search. I know you are very expert in writing such great codes.

I am sorry if these are just foolish suggestions actually I am just a newbie. These might look like childish talks.

But Sir problem is that sever cpanel raw log did not given me information that i required. It also dont try to record actual IP address.

3. It can be just like an add on I thought. Just like emergeny offline. I know it will block many many users who are good but there can be some condition when you directly log hackers ip after blocking all proxies. He will try to access site directly we can catch him.

Ohh I am sorry I was unaware admintools_beaches file. Sorry again.

Here we give things a snowball's chance in hell.

I guess you don't get much snow in the Mediterranean.