}
// Whitelist some absolute query strings (see below)
- $GLOBALS['whitelist'] = array(
+ $GLOBALS['ctracker_whitelist'] = array(
'cmd=new', // LinPHA
'cmd=edit', // LinPHA
'cmd=lostpw' // LinPHA
);
// Attacks we should detect and blok
- $GLOBALS['wormprotector'] = array(
+ $GLOBALS['ctracker_wormprotector'] = array(
'chr(', 'chr=', 'chr%20', '%20chr', 'wget%20', '%20wget', 'wget(',
'cmd=', '%20cmd', 'cmd%20', 'rush=', '%20rush', 'rush%20',
'union%20', '%20union', 'union(', 'union=', 'echr(', '%20echr', 'echr%20', 'echr=',
);
// Block these words found in POST requests
- $GLOBALS['post_blacklist'] = array(
+ $GLOBALS['ctracker_post_blacklist'] = array(
// These two lines are for detecting hidden link spam in wikis, forums, guestbooks, etc.
'div style=', 'overflow:auto', 'height:1px', 'width:1px', 'display:hidden',
'overflow: auto', 'height: 1px', 'display: hidden',
// Checks for worms
function isCrackerTrackerWormDetected () {
// Check against the whole list
- $GLOBALS['checkworm'] = str_replace($GLOBALS['wormprotector'], '*', $_SERVER['QUERY_STRING']);
+ $GLOBALS['ctracker_checkworm'] = str_replace($GLOBALS['ctracker_wormprotector'], '*', $_SERVER['QUERY_STRING']);
// If it differs to original and the *whole* request string is not in whitelist
// then blog the attempt
- return ($GLOBALS['checkworm'] != $_SERVER['QUERY_STRING'] && (!in_array($_SERVER['QUERY_STRING'], $GLOBALS['whitelist'])));
+ return ($GLOBALS['ctracker_checkworm'] != $_SERVER['QUERY_STRING'] && (!in_array($_SERVER['QUERY_STRING'], $GLOBALS['ctracker_whitelist'])));
}
// Checks POST data
function isCrackerTrackerPostAttackDetected () {
// Implode recursive the whole $_POST array
- $GLOBALS['post_track'] = implode_r('', $_POST);
+ $GLOBALS['ctracker_post_track'] = implode_r('', $_POST);
// Check for suspicious POST data
- $GLOBALS['check_post'] = str_replace($GLOBALS['post_blacklist'], '*', $GLOBALS['post_track']);
+ $GLOBALS['ctracker_check_post'] = str_replace($GLOBALS['ctracker_post_blacklist'], '*', $GLOBALS['ctracker_post_track']);
// Is it detected?
- return ((isCrackerTrackerWormDetected()) || ($GLOBALS['check_post'] != $GLOBALS['post_track']));
+ return ((isCrackerTrackerWormDetected()) || ($GLOBALS['ctracker_check_post'] != $GLOBALS['ctracker_post_track']));
}
// Prepares a mail and send it out
// Mail content
$mail = "Attack detected:
-----------------------------------------------------
-Remote-IP : ".determineRealRemoteAddress()."
+Remote-IP : ".determineCrackerTrackerRealRemoteAddress()."
User-Agent : ".$_SERVER['HTTP_USER_AGENT']."
Request-string : ".$_SERVER['QUERY_STRING']."
-Filtered string : ".$GLOBALS['checkworm']."
+Filtered string : ".$GLOBALS['ctracker_checkworm']."
Server : ".$_SERVER['SERVER_NAME']."
Script : ".$_SERVER['SCRIPT_NAME']."
Referrer : ".$_SERVER['HTTP_REFERRER']."
function crackerTrackerSendMail ($mail) {
// Construct dummy array
$rowData = array(
- 'remote_addr' => determineRealRemoteAddress(),
- 'check_worm' => $GLOBALS['checkworm'],
+ 'remote_addr' => determineCrackerTrackerRealRemoteAddress(),
+ 'check_worm' => $GLOBALS['ctracker_checkworm'],
'server_name' => $_SERVER['SERVER_NAME']
);
// Mail text
$mail = "POST-Attack detected:
-----------------------------------------------------
-Remote-IP : ".determineRealRemoteAddress()."
+Remote-IP : ".determineCrackerTrackerRealRemoteAddress()."
User-Agent : ".$_SERVER['HTTP_USER_AGENT']."
Request-string : ".$_SERVER['QUERY_STRING']."
-Filtered string : ".$GLOBALS['checkworm']."
+Filtered string : ".$GLOBALS['ctracker_checkworm']."
Server : ".$_SERVER['SERVER_NAME']."
Script : ".$_SERVER['SCRIPT_NAME']."
Referrer : ".$_SERVER['HTTP_REFERRER']."
-----------------------------------------------------
-POST string : ".$GLOBALS['post_track']."
-Filtered POST string : ".$GLOBALS['check_post']."
+POST string : ".$GLOBALS['ctracker_post_track']."
+Filtered POST string : ".$GLOBALS['ctracker_check_post']."
-----------------------------------------------------
";
$proxyUsed = 'N';
// Did the attacker use a proxy?
- if (isProxyUsed()) {
+ if (isCrackerTrackerProxyUsed()) {
// Set it
$proxyUsed = 'Y';
} // END - if
// Prepare array for database insert
$rowData = array(
- 'remote_addr' => determineRealRemoteAddress(),
+ 'remote_addr' => determineCrackerTrackerRealRemoteAddress(),
'user_agent' => $_SERVER['HTTP_USER_AGENT'],
'get_data' => $_SERVER['QUERY_STRING'],
- 'post_data' => $GLOBALS['post_track'],
- 'check_worm' => $GLOBALS['checkworm'],
- 'check_post' => $GLOBALS['check_post'],
+ 'post_data' => $GLOBALS['ctracker_post_track'],
+ 'check_worm' => $GLOBALS['ctracker_checkworm'],
+ 'check_post' => $GLOBALS['ctracker_check_post'],
'server_name' => $_SERVER['SERVER_NAME'],
'script_name' => $_SERVER['SCRIPT_NAME'],
'referer' => $_SERVER['HTTP_REFERER'],