|
|
|
Phosky
|
|
|
Enviado: 05/02/2005 a las 12:02 |
|
Forero
Karma: 7 (3 Votos)
Registrado: 10/09/04
Mensajes: 144
Estado: Desconectado
Ultima visita: 09/07/07 |
Hola. He abierto hoy el correo de mi web y para mi sorpresa he recibido 120 alertas del pnSecurity. Qué es lo que ha pasado?? Las 20 primeras alertas vienen del usuario "jjjjjj", pero las restantes de alguien no logeado. Os copio el texto del usuario jjjjjj:
=====================================
Information about this user:
=====================================
Postnuke username: jjjjjj
Registered email of this Postnuke user:
***********@hotmail.com
Registered real name of this Postnuke user:
IP numbers: [note: when you are dealing with a
real cracker these IP numbers might not be from
the actual computer he is working on]
IP according to HTTP_CLIENT_IP: 83.44.85.37
IP according to REMOTE_ADDR: 80.58.52.170
IP according to
GetHostByName($_SERVER['REMOTE_ADDR']):
80.58.52.170
=====================================
Information in the $_REQUEST array
=====================================
REQUEST * op : modload
REQUEST * name : News
REQUEST * file : article
REQUEST * sid : 58
REQUEST * mode : thread(\"der=0
REQUEST * thold : 0
REQUEST * POSTNUKESID :
4a8768874cf31f0080baccc2a2b11da0
REQUEST * visitado : sip
=====================================
Information in the $_GET array
This is about variables that may have been in the
URL string or in a 'GET' type form.
=====================================
GET * op : modload
GET * name : News
GET * file : article
GET * sid : 58
GET * mode : thread(\"der=0
GET * thold : 0
=====================================
Information in the $_POST array
This is about visible and invisible form elements.
=====================================
=====================================
Browser information
=====================================
HTTP_USER_AGENT: Mozilla/4.0 (compatible; MSIE
6.0; Windows NT 5.1; SV1)
BROWSER * 0 :
=====================================
Information in the $_SERVER array
=====================================
SERVER * DOCUMENT_ROOT :
/home/*******/public_html
SERVER * HTTP________ :
----:----------------------
SERVER * HTTP________________ : ----- -------
SERVER * HTTP_ACCEPT : image/gif, image/x-xbitmap,
image/jpeg, image/pjpeg,
application/x-shockwave-flash,
application/x-gsarcade-launch, */*
SERVER * HTTP_ACCEPT_LANGUAGE : es
SERVER * HTTP_CLIENT_IP : 83.44.85.37
SERVER * HTTP_COOKIE :
POSTNUKESID=4a8768874cf31f0080baccc2a2b11da0;
visitado=sip
SERVER * HTTP_HOST : www.*********.com
SERVER * HTTP_USER_AGENT : Mozilla/4.0
(compatible; MSIE 6.0; Windows NT 5.1; SV1)
SERVER * HTTP_VIA : HTTP/1.1 proxy[AC1EE445]
(Traffic-Server/5.5.1-59274 [uScM])
SERVER * HTTP_X_FORWARDED_FOR : 83.44.85.37
SERVER * PATH :
/bin:/usr/bin:/usr/ucb:/usr/bsd:/usr/local/bin
SERVER * REDIRECT_QUERY_STRING :
op=modload&name=News&file=article&sid=58&mode=thread(\"der=0&thold=0
SERVER * REDIRECT_STATUS : 200
SERVER * REDIRECT_URL : /displayarticle58.html
SERVER * REMOTE_ADDR : 80.58.52.***
SERVER * REMOTE_PORT : 47453
SERVER * SCRIPT_FILENAME :
/home/*****/public_html/modules.php
SERVER * SERVER_ADDR : 69.72.226.***
SERVER * SERVER_ADMIN : webmaster@*******.com
SERVER * SERVER_NAME : www.*******.com
SERVER * SERVER_PORT : 80
SERVER * SERVER_SIGNATURE : <ADDRESS>Apache/1.3.33
Server at www.*******.com Port 80</ADDRESS>
SERVER * SERVER_SOFTWARE :
SERVER * GATEWAY_INTERFACE : CGI/1.1
SERVER * SERVER_PROTOCOL : HTTP/1.1
SERVER * REQUEST_METHOD : GET
SERVER * QUERY_STRING :
op=modload&name=News&file=article&sid=58&mode=thread(\"der=0&thold=0
SERVER * REQUEST_URI : /displayarticle58.html
SERVER * SCRIPT_NAME : /modules.php
SERVER * PATH_TRANSLATED :
/home/nucleoga/public_html/modules.php
SERVER * PHP_SELF : /modules.php
SERVER * argv : Array
SERVER * argc : 1
=====================================
Information in the $_ENV array
=====================================
ENV * PWD : /
ENV * LANG :
ENV * SHLVL : 1
ENV * _ : /usr/local/apache/bin/httpd
=====================================
Information in the $_COOKIE array
=====================================
COOKIE * POSTNUKESID :
*****************************
COOKIE * visitado : sip
=====================================
Information in the $_FILES array
=====================================
=====================================
Information in the $_SESSION array
This is session info. The variables
starting with PNSV are PostNukeSessionVariables.
=====================================
SESSION * PNSVrand : 728955802
SESSION * PNSVlang : spa
SESSION * PNSVuid : 17089
SESSION * PNSVrememberme : 1
Eso es todo. Qué siginifica que ha estado haciendo? Porque que me leguen tantos emails... Ah, esto NO me ha ocurrido en la web de mi firma de estos foros, sino en otra. Espero me ayudéis. Saludos 
|
|
|
|
|
|
|
|
|
Phosky
|
|
|
Enviado: 05/02/2005 a las 21:02 |
|
Forero
Karma: 7 (3 Votos)
Registrado: 10/09/04
Mensajes: 144
Estado: Desconectado
Ultima visita: 09/07/07 |
He recibido otras 40!! De diferentes usuarios. Estoy siendo atacado realmente? Que alguien conteste por favor
|
|
|
|
|
|
|
AnyKiller
|
|
|
Enviado: 05/02/2005 a las 23:02 |
|
Moderador
Karma: 7 (188 Votos)
Registrado: 12/10/04
Mensajes: 5145
Estado: Desconectado
Ultima visita: 11/06/08 |
Eso salta muchas veces por tonterias o por ejecutar alguna instruccion javascript, no se. A ver si responde akí la gente.
De todas formas, no te preocupes mientras no le ocurra nada a tu web
No atiendo mensajes privados para dudas |
|
|
|
|
|
|
Phosky
|
|
|
Enviado: 06/02/2005 a las 16:02 |
|
Forero
Karma: 7 (3 Votos)
Registrado: 10/09/04
Mensajes: 144
Estado: Desconectado
Ultima visita: 09/07/07 |
Ya... lo único ke siempre ha ido bien, y de repente un día, sin hacer absolutamente nada, me aparecen un mntón de alertas. Ahora me han llegado 110 más... Ya son 270 en total...
|
|
|
|
|
|
|
Navegación
120 alertas de PnSecurity
