From: Roland Häder <roland@mxchange.org>
Date: Thu, 28 Jul 2016 10:57:49 +0000 (+0200)
Subject: Checking against GET parameters is for the user-agent string not possible as
X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=560119d213559db9af8d43bcceafdcc1473c7b67;p=ctracker.git

Checking against GET parameters is for the user-agent string not possible as
ordinary UAs may get blocked.

Signed-off-by: Roland Häder <rhaeder@cho-time.de>
---

diff --git a/libs/lib_detector.php b/libs/lib_detector.php
index 02e4683..633d7d3 100644
--- a/libs/lib_detector.php
+++ b/libs/lib_detector.php
@@ -87,8 +87,8 @@ function initCrackerTrackerArrays () {
 		'/chgrp', '/chown', '/chmod', 'chown ', 'chmod ', 'chgrp ',
 
 		// Compiler/interpreter
-		'g++ ', 'c++ ', 'cc ', 'bin/./python', 'bin/python', 'bin/tclsh',
-		'bin/./tclsh', 'bin/nasm', 'bin/./nasm', '/perl', 'perl ', 'cmd.exe',
+		'bin/g++ ', 'bin/c++ ', 'cc ', 'bin/python', 'bin/python', 'bin/tclsh',
+		'bin/tclsh', 'bin/nasm', '/perl', 'cmd.exe',
 		'nc.exe', 'ftp.exe',
 
 		// php.ini settings
@@ -154,6 +154,34 @@ function initCrackerTrackerArrays () {
 		'uol.com', ',0x', '(0x'
 	);
 
+	// BLock these words found in User-Agent
+	$GLOBALS['ctracker_ua_blacklist'] = array(
+		// Compiler/interpreter
+		'bin/g++ ', 'bin/c++ ', 'cc ', 'bin/python', 'bin/python', 'bin/tclsh',
+		'bin/tclsh', 'bin/nasm', '/perl', 'cmd.exe',
+		'nc.exe', 'ftp.exe', 'wget ', 'system(', 'curl ',
+
+		// php.ini settings
+		'allow_url_fopen', 'allow_url_include', 'auto_prepend_file', 'disable_functions', 'safe_mode',
+
+		// PHP commands/scripts
+		'fopen', 'fwrite', 'phpinfo()', '\<?', '?\>', 'base64_decode', 'file_put_contents',
+		'set_magic_quotes_runtime', 'set_magic_quotes_runtime', 'display_errors', 'passthru',
+
+		// Typical PHP script remote-inclusions and typical include file names
+		'.inc.php', '.lib.php', '.class.php', 'config.php', '.inc', '_php',
+		'php_', 'class_', '_class.php', 'db_mysql.inc',
+
+		// PHP arrays
+		'_PHPLIB',
+
+		// Request header being inserted
+		'content-type',
+
+		// /proc/ and other forbidden paths
+		'proc/self/environ',
+	);
+
 	// Block these words found in POST requests
 	$GLOBALS['ctracker_post_blacklist'] = array(
 		// This line is for detecting hidden link spam in wikis, forums, guestbooks, etc.
@@ -174,7 +202,7 @@ function initCrackerTrackerArrays () {
 function isCrackerTrackerWormDetected () {
 	// Check against the whole list
 	$GLOBALS['ctracker_checked_get'] = urldecode(str_ireplace($GLOBALS['ctracker_get_blacklist'], '*', crackerTrackerQueryString(TRUE)));
-	$GLOBALS['ctracker_checked_ua']  = urldecode(str_ireplace($GLOBALS['ctracker_get_blacklist'], '*', crackerTrackerUserAgent(TRUE)));
+	$GLOBALS['ctracker_checked_ua']  = urldecode(str_ireplace($GLOBALS['ctracker_ua_blacklist'], '*', crackerTrackerUserAgent(TRUE)));
 
 	/*
 	 * If it differs to original and the *whole* request string is not in