Continued:

[ctracker.git] / libs / lib_detector.php

diff --git a/libs/lib_detector.php b/libs/lib_detector.php
index c008a2faa1a80c36bd96a8bf3800deeb945a43d5..21a15d8e5e54d808a7a15bf744ba403da5120e49 100644 (file)
--- a/libs/lib_detector.php
+++ b/libs/lib_detector.php
@@ -37,17 +37,17 @@ function initCrackerTrackerArrays () {
        $GLOBALS['ctracker_base_path'] = dirname(dirname(__FILE__));
 
        // Whitelist some absolute query strings (see below)
-       $GLOBALS['ctracker_whitelist'] = array(
+       $GLOBALS['ctracker_whitelist'] = [
                'cmd=new',    // LinPHA
                'cmd=edit',   // LinPHA
                'cmd=lostpw', // LinPHA
                '/css/status_config.php', // MantisBT
                '/css/common_config.php', // MantisBT
                '/javascript_config.php', // MantisBT
-       );
+       ];
 
        // Attacks we should detect and block
-       $GLOBALS['ctracker_get_blacklist'] = array(
+       $GLOBALS['ctracker_get_blacklist'] = [
                // SQL injections
                'union ', ' union', 'insert ',
                'select ', ' like', 'like ', 'drop ', 'update ',
@@ -154,11 +154,11 @@ function initCrackerTrackerArrays () {
                'window.open', 'img src', 'img src', '.jsp', 'servlet', 'org.apache',
                'wwwacl', 'server-info', 'server-status', '/servlet/con', 'http_',
                'secure_site, ok', 'chunked', '<script', 'mod_gzip_status', '.system',
-               'uol.com', ',0x', '(0x',
-       );
+               'uol.com', ',0x', '(0x', 'INSERT_RANDOM_NUMBER_HERE',
+       ];
 
        // BLock these words found in User-Agent
-       $GLOBALS['ctracker_ua_blacklist'] = array(
+       $GLOBALS['ctracker_ua_blacklist'] = [
                // Compiler/interpreter
                'bin/g++ ', 'bin/c++ ', 'cc ', 'bin/python', 'bin/python', 'bin/tclsh',
                'bin/tclsh', 'bin/nasm', '/perl', 'cmd.exe',
@@ -183,19 +183,21 @@ function initCrackerTrackerArrays () {
 
                // /proc/ and other forbidden paths
                'proc/self/environ',
-       );
+       ];
 
        // Block these words found in POST requests
-       $GLOBALS['ctracker_post_blacklist'] = array(
+       $GLOBALS['ctracker_post_blacklist'] = [
                // This line is for detecting hidden link spam in wikis, forums, guestbooks, etc.
                ' style=', 'overflow:auto', 'height:1px', 'width:1px', 'display:hidden', 'style.display',
 
                // "Common" login names from VHCS exploiters ;-)
                'starhack', 'DeLiMehmet', 'hisset', 'Hisset', 'delimert', 'MecTruy'
-       );
+       ];
 
        // Also block these requests (mostly you don't want CONNECT to some SMTP sites)
-       $GLOBALS['ctracker_blocked_requests'] = array('CONNECT' => TRUE);
+       $GLOBALS['ctracker_blocked_methods'] = [
+               'CONNECT' => TRUE,
+       ];
 
        // Init more elements
        $GLOBALS['ctracker_post_track']   = '';
@@ -220,7 +222,7 @@ function isCrackerTrackerWormDetected () {
                ) || (
                        $GLOBALS['ctracker_checked_ua'] != crackerTrackerUserAgent(TRUE)
                ) || (
-                       isset($GLOBALS['ctracker_blocked_requests'][crackerTrackerRequestMethod()])
+                       isset($GLOBALS['ctracker_blocked_methods'][crackerTrackerRequestMethod()])
                )
        );
        //* DEBUG-DIE: */ die('isWorm='.intval($isWorm).PHP_EOL.'get='.PHP_EOL.'"'.$GLOBALS['ctracker_checked_get'].'"'.PHP_EOL.'"'.crackerTrackerQueryString().'"'.PHP_EOL.'ua='.PHP_EOL.'"'.$GLOBALS['ctracker_checked_ua'].'"'.PHP_EOL.'"'.crackerTrackerUserAgent().'"'.PHP_EOL);
@@ -284,12 +286,12 @@ function sendCrackerTrackerTicketMails () {
 // Sends a mail out
 function crackerTrackerSendMail ($mail, $recipient = NULL, $subject = NULL) {
        // Construct dummy array
-       $rowData = array(
+       $rowData = [
                'remote_addr' => determineCrackerTrackerRealRemoteAddress(),
                'proxy_addr'  => getenv('REMOTE_ADDR'),
                'check_get'   => $GLOBALS['ctracker_checked_get'],
                'server_name' => crackerTrackerServerName()
-       );
+       ];
 
        // Only send email if not yet found
        if (!isCrackerTrackerEntryFound($rowData)) {
@@ -385,7 +387,7 @@ function crackerTrackerLogAttack () {
        } // END - if
 
        // Prepare array for database insert
-       $rowData = array(
+       $rowData = [
                'remote_addr'    => determineCrackerTrackerRealRemoteAddress(),
                'proxy_addr'     => getenv('REMOTE_ADDR'),
                'user_agent'     => crackerTrackerUserAgent(),
@@ -400,7 +402,7 @@ function crackerTrackerLogAttack () {
                'request_method' => crackerTrackerRequestMethod(),
                'proxy_used'     => $proxyUsed,
                'first_attempt'  => 'NOW()'
-       );
+       ];
 
        // Insert the array in database
        crackerTrackerInsertArray('ctracker_data', $rowData);