bugtraq - Re: Code for ban IP adresses inmediately

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 11 Oct 2003 11:26:10 -0400
From: Valdis.Kletnieks@...edu
To: Lorenzo Hernandez Garcia-Hierro <lorenzohgh@...g-security.com>
Cc: Full-Disclosure <full-disclosure@...ts.netsys.com>,
   BUGTRAQ <bugtraq@...urityfocus.com>
Subject: Re: Code for ban IP adresses inmediately

On Sat, 11 Oct 2003 16:19:10 +0200, Lorenzo Hernandez Garcia-Hierro said:

>   if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
>     $clip = $_SERVER['HTTP_X_FORWARDED_FOR'];
>   }
>   elseif (isset($_SERVER['HTTP_VIA'])) {
>     $clip = $_SERVER['HTTP_VIA'];
>   }
(more code snipped).

Soooo... let's see... if I feed this thing something that has *both*
a legitimate X_FORWARDED_FOR and a malicious VIA, this code
will only check the FORWARDED.  I think you really wanted to do

for i in (FORWARDED VIA REMOTE_ADDR) do
	if (isset($_server($i)) banit($_server($i)....)
done

or however you do it in PHP.

Content of type "application/pgp-signature" skipped