X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=libs%2Flib_detector.php;h=21a15d8e5e54d808a7a15bf744ba403da5120e49;hb=5ba4cfd551ee9582b1d64605d92e3e4ee7b9de3b;hp=0ebdf4dcc7e5a681749f44a52690676ea41b67e5;hpb=c4d703772169c4d0de240db6aa94d05b18d49075;p=ctracker.git

diff --git a/libs/lib_detector.php b/libs/lib_detector.php
index 0ebdf4d..21a15d8 100644
--- a/libs/lib_detector.php
+++ b/libs/lib_detector.php
@@ -37,14 +37,17 @@ function initCrackerTrackerArrays () {
 	$GLOBALS['ctracker_base_path'] = dirname(dirname(__FILE__));
 
 	// Whitelist some absolute query strings (see below)
-	$GLOBALS['ctracker_whitelist'] = array(
+	$GLOBALS['ctracker_whitelist'] = [
 		'cmd=new',    // LinPHA
 		'cmd=edit',   // LinPHA
 		'cmd=lostpw', // LinPHA
-	);
+		'/css/status_config.php', // MantisBT
+		'/css/common_config.php', // MantisBT
+		'/javascript_config.php', // MantisBT
+	];
 
 	// Attacks we should detect and block
-	$GLOBALS['ctracker_get_blacklist'] = array(
+	$GLOBALS['ctracker_get_blacklist'] = [
 		// SQL injections
 		'union ', ' union', 'insert ',
 		'select ', ' like', 'like ', 'drop ', 'update ',
@@ -93,6 +96,7 @@ function initCrackerTrackerArrays () {
 
 		// php.ini settings
 		'allow_url_fopen', 'allow_url_include', 'auto_prepend_file', 'disable_functions', 'safe_mode',
+		'open_basedir',
 
 		// PHP commands/scripts
 		'fopen', 'fwrite', 'phpinfo()', '\<?', '?\>', 'base64_decode', 'file_put_contents',
@@ -106,7 +110,7 @@ function initCrackerTrackerArrays () {
 		'_phplib', '__callbackparam',
 
 		// Generic remote inclusion
-		'=http://', '=https://',
+		'=http://', '=https://', '=php://',
 		'path=', 'sql=',
 		'=%7BQUOT%7D', '=%5C', '=%22http','=%22ftp','=%22file','=%27http','=%27ftp',
 		'=%27file',
@@ -147,15 +151,14 @@ function initCrackerTrackerArrays () {
 		// @TODO Misc/unsorted
 		'cgi-', '.eml', '$_request', '$_get', '$request', '$get', '.system',
 		'&aim', 'new_password', '&icq', '.conf', 'motd ', 'HTTP/1.',
-		'window.open', 'img src', 'img src', '.jsp', 'servlet',
-		'wwwacl', '.js', '.jsp', 'server-info', 'server-status',
-		'secure_site, ok', 'chunked', 'org.apache', '/servlet/con',
-		'<script', 'mod_gzip_status', '.system', 'http_',
-		'uol.com', ',0x', '(0x'
-	);
+		'window.open', 'img src', 'img src', '.jsp', 'servlet', 'org.apache',
+		'wwwacl', 'server-info', 'server-status', '/servlet/con', 'http_',
+		'secure_site, ok', 'chunked', '<script', 'mod_gzip_status', '.system',
+		'uol.com', ',0x', '(0x', 'INSERT_RANDOM_NUMBER_HERE',
+	];
 
 	// BLock these words found in User-Agent
-	$GLOBALS['ctracker_ua_blacklist'] = array(
+	$GLOBALS['ctracker_ua_blacklist'] = [
 		// Compiler/interpreter
 		'bin/g++ ', 'bin/c++ ', 'cc ', 'bin/python', 'bin/python', 'bin/tclsh',
 		'bin/tclsh', 'bin/nasm', '/perl', 'cmd.exe',
@@ -180,19 +183,21 @@ function initCrackerTrackerArrays () {
 
 		// /proc/ and other forbidden paths
 		'proc/self/environ',
-	);
+	];
 
 	// Block these words found in POST requests
-	$GLOBALS['ctracker_post_blacklist'] = array(
+	$GLOBALS['ctracker_post_blacklist'] = [
 		// This line is for detecting hidden link spam in wikis, forums, guestbooks, etc.
 		' style=', 'overflow:auto', 'height:1px', 'width:1px', 'display:hidden', 'style.display',
 
 		// "Common" login names from VHCS exploiters ;-)
 		'starhack', 'DeLiMehmet', 'hisset', 'Hisset', 'delimert', 'MecTruy'
-	);
+	];
 
 	// Also block these requests (mostly you don't want CONNECT to some SMTP sites)
-	$GLOBALS['ctracker_blocked_requests'] = array('CONNECT' => TRUE);
+	$GLOBALS['ctracker_blocked_methods'] = [
+		'CONNECT' => TRUE,
+	];
 
 	// Init more elements
 	$GLOBALS['ctracker_post_track']   = '';
@@ -217,7 +222,7 @@ function isCrackerTrackerWormDetected () {
 		) || (
 			$GLOBALS['ctracker_checked_ua'] != crackerTrackerUserAgent(TRUE)
 		) || (
-			isset($GLOBALS['ctracker_blocked_requests'][crackerTrackerRequestMethod()])
+			isset($GLOBALS['ctracker_blocked_methods'][crackerTrackerRequestMethod()])
 		)
 	);
 	//* DEBUG-DIE: */ die('isWorm='.intval($isWorm).PHP_EOL.'get='.PHP_EOL.'"'.$GLOBALS['ctracker_checked_get'].'"'.PHP_EOL.'"'.crackerTrackerQueryString().'"'.PHP_EOL.'ua='.PHP_EOL.'"'.$GLOBALS['ctracker_checked_ua'].'"'.PHP_EOL.'"'.crackerTrackerUserAgent().'"'.PHP_EOL);
@@ -281,12 +286,12 @@ function sendCrackerTrackerTicketMails () {
 // Sends a mail out
 function crackerTrackerSendMail ($mail, $recipient = NULL, $subject = NULL) {
 	// Construct dummy array
-	$rowData = array(
+	$rowData = [
 		'remote_addr' => determineCrackerTrackerRealRemoteAddress(),
 		'proxy_addr'  => getenv('REMOTE_ADDR'),
 		'check_get'   => $GLOBALS['ctracker_checked_get'],
 		'server_name' => crackerTrackerServerName()
-	);
+	];
 
 	// Only send email if not yet found
 	if (!isCrackerTrackerEntryFound($rowData)) {
@@ -382,7 +387,7 @@ function crackerTrackerLogAttack () {
 	} // END - if
 
 	// Prepare array for database insert
-	$rowData = array(
+	$rowData = [
 		'remote_addr'    => determineCrackerTrackerRealRemoteAddress(),
 		'proxy_addr'     => getenv('REMOTE_ADDR'),
 		'user_agent'     => crackerTrackerUserAgent(),
@@ -397,7 +402,7 @@ function crackerTrackerLogAttack () {
 		'request_method' => crackerTrackerRequestMethod(),
 		'proxy_used'     => $proxyUsed,
 		'first_attempt'  => 'NOW()'
-	);
+	];
 
 	// Insert the array in database
 	crackerTrackerInsertArray('ctracker_data', $rowData);