full-disclosure - Code for ban IP adresses inmediately

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200310111526.h9BFQA6s023589@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Code for ban IP adresses inmediately 

On Sat, 11 Oct 2003 16:19:10 +0200, Lorenzo Hernandez Garcia-Hierro said:

>   if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
>     $clip = $_SERVER['HTTP_X_FORWARDED_FOR'];
>   }
>   elseif (isset($_SERVER['HTTP_VIA'])) {
>     $clip = $_SERVER['HTTP_VIA'];
>   }
(more code snipped).

Soooo... let's see... if I feed this thing something that has *both*
a legitimate X_FORWARDED_FOR and a malicious VIA, this code
will only check the FORWARDED.  I think you really wanted to do

for i in (FORWARDED VIA REMOTE_ADDR) do
	if (isset($_server($i)) banit($_server($i)....)
done

or however you do it in PHP.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031011/318e03dd/attachment.bin