X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=libs%2Flib_detector.php;h=c8e44636adcbb5e60a53d190e15973737e6eb175;hb=936f7c5dbdcf89e15d507fc947c9921d46b13a77;hp=b8116e3246a74964236a909ff076d8646ca2fda1;hpb=d3bf22bb2cb65b83ae8b6b326977dbb18b2fcbb2;p=ctracker.git

diff --git a/libs/lib_detector.php b/libs/lib_detector.php
index b8116e3..c8e4463 100644
--- a/libs/lib_detector.php
+++ b/libs/lib_detector.php
@@ -40,10 +40,10 @@ function initCrackerTrackerArrays () {
 		'cmd=lostpw' // LinPHA
 	);
 
-	// Attacks we should detect and blok
+	// Attacks we should detect and block
 	$GLOBALS['ctracker_get_blacklist'] = array(
 		'chr(', 'chr=', 'chr%20', '%20chr', 'wget%20', '%20wget', 'wget(',
-		'cmd=', '%20cmd', 'cmd%20', 'rush=', '%20rush', 'rush%20',
+		'cmd.exe', '%20cmd', 'cmd%20', 'rush=', '%20rush', 'rush%20',
 		'union%20', '%20union', 'union(', 'union=', 'echr(', '%20echr', 'echr%20', 'echr=',
 		'esystem(', 'esystem%20', 'cp%20', '%20cp', 'cp(', 'mdir%20', '%20mdir', 'mdir(',
 		'mcd%20', 'mrd%20', 'rm%20', '%20mcd', '%20mrd', '%20rm',
@@ -56,7 +56,7 @@ function initCrackerTrackerArrays () {
 		'new_password', '&icq','/etc/passwd','/etc/shadow', '/etc/groups', '/etc/gshadow',
 		'HTTP_USER_AGENT', 'HTTP_HOST', 'wget%20', 'uname\x20-', 'uname%20-', 'bin/id', '/bin/', '/chgrp',
 		'/chown', '/usr/bin', 'g\+\+', 'bin/python', 'bin/tclsh', 'bin/nasm', 'perl%20', 'traceroute%20',
-		'ping%20', '.pl', 'bin/xterm', 'lsof%20', '.conf', 'motd%20', 'HTTP/1.', '.inc.php', '.lib.php',
+		'ping%20', 'bin/xterm', 'lsof%20', '.conf', 'motd%20', 'HTTP/1.', '.inc.php', '.lib.php', '.class.php',
 		'config.php', 'file\://', 'window.open', '<SCRIPT>', 'javascript\://', 'img src', 'img%20src', '.jsp',
 		'ftp.exe', 'xp_enumdsn', 'xp_availablemedia', 'xp_filelist', 'xp_cmdshell', 'nc.exe', '.htpasswd',
 		'servlet', '/etc/passwd', 'wwwacl', '~root', '~ftp', '.js', '.jsp', '.history', 'bash_history',
@@ -67,14 +67,14 @@ function initCrackerTrackerArrays () {
 		'div style=', 'overflow: auto', 'height: 1px', 'cc%20', 'admin_action=', 'path=', 'action=http',
 		'page=http', 'module=http', 'op=http', 'id=http', 'id%3Dhttp', 'action%3Dhttp', 'page%3Dhttp',
 		'module%3Dhttp', 'op%3Dhttp', 'starhack', '../../','..//', 'directory=http', 'dir=http', 'busca',
-		'uol.com', '=http://', '=https://','=ftp://','=file://','_SESSION','CFG_ROOT','/proc/'
+		'uol.com', '=http://', '=https://','=ftp://','=file://','_SESSION','CFG_ROOT','/proc/', ',0x', '(0x',
+		'=%7BQUOT%7D', '=%5C', 'DOCUMENT_ROOT', '_SERVER'
 	);
 
 	// Block these words found in POST requests
 	$GLOBALS['ctracker_post_blacklist'] = array(
-		// These two lines are for detecting hidden link spam in wikis, forums, guestbooks, etc.
+		// This line is for detecting hidden link spam in wikis, forums, guestbooks, etc.
 		'div style=', 'overflow:auto', 'height:1px', 'width:1px', 'display:hidden',
-		'overflow: auto', 'height: 1px', 'display: hidden',
 		// "Common" login name from VHCS exploiters ;-)
 		'starhack', 'DeLiMehmet', 'hisset', 'Hisset', 'delimert', 'MecTruy',
 		'busca'
@@ -82,6 +82,11 @@ function initCrackerTrackerArrays () {
 
 	// Load email header
 	$GLOBALS['ctracker_header'] = crackerTrackerLoadEmailTemplate('header');
+
+	// Init more elements
+	$GLOBALS['ctracker_post_track'] = '';
+	$GLOBALS['ctracker_checkworm']  = '';
+	$GLOBALS['ctracker_check_post'] = '';
 }
 
 // Checks for worms