tamarian
Tue 31st Oct '00, 6:04pm
I just installed 1.1.3 2 days ago (upgraded to 1.1.4 few minutes ago)
Last night my 404 scrpt was fired by a broken link, second later by a viewthread with %%% signs, etc, so I checked the logs to see what's going on, and found more 404s that were pending in the email.
started a tail -f to see what this user was doing, she/he was a guest since we're only 3 members testing, and none of their ips were in asia.
As a guest (just allowed to view) s/he was able to start the moderator script with user ids view, ips etc. I maybe mistaken since I don't know yet what the logs are supposed to look like, but the command were starting with moderator.php?......
That was starnge by itself, but in addition, this seemed scripted by the user/attacker, since all ids used were incrementing until it got out of bound and all in a second or two. Simultaniously they were sucking up all my other none vb pages and graphics, which is no big deal since many software packages can do that. But the logs show he scanned everything in vb's database in seconds.
I can post the logs here if neccesery, but maybe some of you can tell me without them if this is normal and my observation of the logs were misunderstood?
Last night my 404 scrpt was fired by a broken link, second later by a viewthread with %%% signs, etc, so I checked the logs to see what's going on, and found more 404s that were pending in the email.
started a tail -f to see what this user was doing, she/he was a guest since we're only 3 members testing, and none of their ips were in asia.
As a guest (just allowed to view) s/he was able to start the moderator script with user ids view, ips etc. I maybe mistaken since I don't know yet what the logs are supposed to look like, but the command were starting with moderator.php?......
That was starnge by itself, but in addition, this seemed scripted by the user/attacker, since all ids used were incrementing until it got out of bound and all in a second or two. Simultaniously they were sucking up all my other none vb pages and graphics, which is no big deal since many software packages can do that. But the logs show he scanned everything in vb's database in seconds.
I can post the logs here if neccesery, but maybe some of you can tell me without them if this is normal and my observation of the logs were misunderstood?