Sorted a bit + removed '.js' as this was to much and kicked out .json, too.

[ctracker.git] / libs / lib_detector.php

diff --git a/libs/lib_detector.php b/libs/lib_detector.php
index 633d7d30fcd8ebc338d818c20f6fe032940bd775..90459c9f184bda2a2a29fedfb91fb78d916ff19e 100644 (file)
--- a/libs/lib_detector.php
+++ b/libs/lib_detector.php
@@ -103,7 +103,7 @@ function initCrackerTrackerArrays () {
                'php_', 'class_', '_class.php', 'db_mysql.inc',
 
                // PHP arrays
-               '_PHPLIB',
+               '_phplib', '__callbackparam',
 
                // Generic remote inclusion
                '=http://', '=https://',
@@ -147,10 +147,9 @@ function initCrackerTrackerArrays () {
                // @TODO Misc/unsorted
                'cgi-', '.eml', '$_request', '$_get', '$request', '$get', '.system',
                '&aim', 'new_password', '&icq', '.conf', 'motd ', 'HTTP/1.',
-               'window.open', 'img src', 'img src', '.jsp', 'servlet',
-               'wwwacl', '.js', '.jsp', 'server-info', 'server-status',
-               'secure_site, ok', 'chunked', 'org.apache', '/servlet/con',
-               '<script', 'mod_gzip_status', '.system', 'http_',
+               'window.open', 'img src', 'img src', '.jsp', 'servlet', 'org.apache',
+               'wwwacl', 'server-info', 'server-status', '/servlet/con', 'http_',
+               'secure_site, ok', 'chunked''<script', 'mod_gzip_status', '.system',
                'uol.com', ',0x', '(0x'
        );
 
@@ -173,7 +172,7 @@ function initCrackerTrackerArrays () {
                'php_', 'class_', '_class.php', 'db_mysql.inc',
 
                // PHP arrays
-               '_PHPLIB',
+               '_phplib', '__callbackparam',
 
                // Request header being inserted
                'content-type',
@@ -191,6 +190,9 @@ function initCrackerTrackerArrays () {
                'starhack', 'DeLiMehmet', 'hisset', 'Hisset', 'delimert', 'MecTruy'
        );
 
+       // Also block these requests (mostly you don't want CONNECT to some SMTP sites)
+       $GLOBALS['ctracker_blocked_requests'] = array('CONNECT' => TRUE);
+
        // Init more elements
        $GLOBALS['ctracker_post_track']   = '';
        $GLOBALS['ctracker_checked_get']  = '';
@@ -213,6 +215,8 @@ function isCrackerTrackerWormDetected () {
                        $GLOBALS['ctracker_checked_get'] != crackerTrackerQueryString(TRUE) && (!in_array(crackerTrackerQueryString(TRUE), $GLOBALS['ctracker_whitelist']))
                ) || (
                        $GLOBALS['ctracker_checked_ua'] != crackerTrackerUserAgent(TRUE)
+               ) || (
+                       isset($GLOBALS['ctracker_blocked_requests'][crackerTrackerRequestMethod()])
                )
        );
        //* DEBUG-DIE: */ die('isWorm='.intval($isWorm).PHP_EOL.'get='.PHP_EOL.'"'.$GLOBALS['ctracker_checked_get'].'"'.PHP_EOL.'"'.crackerTrackerQueryString().'"'.PHP_EOL.'ua='.PHP_EOL.'"'.$GLOBALS['ctracker_checked_ua'].'"'.PHP_EOL.'"'.crackerTrackerUserAgent().'"'.PHP_EOL);