PHP:
// Create files in main folder : log.txt and .htaccess
// If you want you can add and $antii In Order : $scc = str_replace($antiinject, '*', $secure);
// $scc = str_replace($antiinject, $antii , '*', $secure);
// This Script have logs and autoban attackers IP's
//
<?
$secure = urldecode($_SERVER['QUERY_STRING']);
$antiinject = array('%', ';', "'", '..', '../', '+', '!', '@', '<', '>', '(', ')',
'drop', 'update', 'insert', 'insert%20into', 'select', 'xp_cmdshell');
$antii = array('(?:(?:\/|\\)?\.\.(\/|\\)(?:\.\.)?)|(?:\w+\.exe\??\s)|(?:;\s*\w+\s*\/[\w*-]+\/)|(?:\d\.\dx\|)|(?:%(?:c0\.|af\.|5c\.))|(?:\/(?:%2e){2})
' , '(?:\\u00[a-f0-9]{2})|(?:\\x0*[a-f0-9]{2})|(?:\\\d{2,3})' ,
'(?:\w+script:|@import[^\w]|;base64|base64,)|(?:\w+\s*\([\w\s]+,[\w\s]+,[\w\s]+,[\w\s]+,[\w\s]+,[\w\s]+\))' ,
'(?:%u(?:ff|00|e\d)\w\w)|(?:(?:%(?:e\w|c[^3\W]|))(?:%\w\w)(?:%\w\w)?)' ,
'([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@>-])(\s*return\s*)?(?:join|pop|push|reverse|shift|sp?lice|sort|unshift)(?(1)[^\w%"]|(?:\s*[^@\s\w%",.+-]))
' ,
'([^*:\s\w,.\/?+-]\s*)?(?<![a-z]\s)(?<![a-z\/_@>-])(\s*return\s*)?(?:atob|btoa|charat|charcodeat|charset|concat|crypto|frames|fromcharcode|indexof|lastindexof|match|navigator|toolbar|menubar|replace|regexp|slice|split|substr|substring|escape|\w+codeuri\w*)(?(1)[^\w%"]|(?:\s*[^@\s\w%",.+-]))
' ,
'(?:(?:do|for|while)\s*\([^;]+;+\))|(?:(?:^|\W)on\w+\s*=[\w\W]*(?:on\w+|alert|eval|print|confirm|prompt))|(?:groups=\d+\(\w+\))|(?:(.)\1{128,})
' ,
);
$scc = str_replace($antiinject, '*', $secure);
if ($secure != $scc)
{
$ip = $_SERVER['REMOTE_ADDR'];
$agent = $_SERVER['HTTP_USER_AGENT'];
$fp = fopen ('./.htaccess', 'a');
fwrite ($fp, 'Deny From ' . $_SERVER['REMOTE_ADDR'] . '
');
fclose ($fp);
$fp = fopen ('./log.txt', 'a');
fwrite ($fp, 'Blocked attack from: IP - ' . $_SERVER['REMOTE_ADDR'] . ' User Agent - ' . $_SERVER['HTTP_USER_AGENT'] . '
');
fclose ($fp);
die( "Attack detected! <br /><br /><b>You are banned from this WebSite:</b><br />$ip - $agent" );
}
?>
PHP:
Allow from all,
Deny from 123.123.123.123
PHP:
Allow from all,
Deny from 123.123.123.123
Last edited:
