Hackosis is an Open Blog. You Can Participate.

  • 25
  • Nov

IDS

What is .htaccess?

I have just joined the sla.ckers web application security forum and found something particularly interesting from a post by jungsonn.

This protects against common URL encoding attacks such as SQL injection, white space, javascript, etc and redirects the URL to log.php. Log.php will then alert you via email.

Add this to .htaccess of your web root directory:

[Show Plain Code]:
  1. Options +FollowSymLinks
  2. RewriteEngine On
  3. RewriteCond %{QUERY_STRING} (\"|%22).*(\>|%3E|<|%3C).* [NC]
  4. RewriteRule ^(.*)$ log.php [NC]
  5. RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC]
  6. RewriteRule ^(.*)$ log.php [NC]
  7. RewriteCond %{QUERY_STRING} (javascript:).*(\;).* [NC]
  8. RewriteRule ^(.*)$ log.php [NC]
  9. RewriteCond %{QUERY_STRING} (\;|\’|\"|\%22).*(union|select|insert|drop|update|md5|benchmark|or|and|if).* [NC]
  10. RewriteRule ^(.*)$ log.php [NC]
  11. RewriteRule (,|;|<|>|’|`) /log.php [NC]

Create log.php in the web root directory and add the following. Ajust your email accordingly (admin@site.com) and don’t forget PHP tags!:

PHP [Show Plain Code]:
  1. $r= $_SERVER[‘REQUEST_URI’];
  2. $q= $_SERVER[‘QUERY_STRING’];
  3. $i= $_SERVER[‘REMOTE_ADDR’];
  4. $u= $_SERVER[‘HTTP_USER_AGENT’];
  5. $mess = $r . ‘ | ‘ . $q . ‘ | ‘ . $i . ‘ | ‘ .$u;
  6. mail("admin@site.com","bad request",$mess,"from:bot@site.com");
  7. echo "Ugly!";

I hope you implement this and if you have any more .htacccess hacks, please leave them in the comments. I look forward to my future ventures at the sla.ckers forum. Don’t forget to check out the ha.ckers site as well.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

Related Posts


Tags: , ,

Like this post? Subscibe to the RSS feed.


3 Comments

  1. divine Says:
    November 27th, 2007 at 4:29 am

    Shouldn’t you sanitize the user agent, etc???

  2. Shane Says:
    November 27th, 2007 at 10:39 am

    I am open to suggestions. Feel free to add to it.

  3. Hacker Proof Your Web Application with PHPIDS | Hackosis Says:
    July 24th, 2008 at 2:51 pm

    [...] too complicated for you? Try the simple .htaccess intrusion detection system. Related PostsNikto 2 ReleasedAll In One Security Gateway – UntangleTop 10 Firefox [...]

Leave a Comment