AWI Adult Webmaster Forum - Resources, News, Tips, Blogs, Tutorials Help Discussions...AdultWebmasterinfo.com!

boldy · 10-01-2002, 04:04 AM

OK, my server where under heavy attack again last night, so this morning i did some thinking...

i wrote this document, with a possible solution to stop the fuckers :

http://www.kimhollandcash.com/bforce.php

Let me know what you think ...

B.

ultra160 · 10-01-2002, 04:11 AM

Nice bit of creative thinking - I hope it works.

QuaShe · 10-01-2002, 05:39 AM

Hey Boldy, how is KHC doing?

Anyway hope this will help against those fucks.

Q.

Bunnyhop · 10-01-2002, 06:29 AM

Very interesting approach to solving brute force programs Boldy...heck you know I think it actually is crazy enough to really be able to fool the proggies without any real means of coding around it.

Freakster.net · 10-01-2002, 08:34 AM

Thats clever

Wont stop them from trying but I guess they'll realise pretty fast and stop

They will find a way to go around this but still..

(use stolen pass, check content.. set it to only log passes that had the right html in answer page etc.. ) but it'll be a pain so they'll probably go to the next site instead

Pretty smart

toker · 10-01-2002, 02:59 PM

hmm thats pretty slick im gonna give it a shot myself save me from having to watch the access logs.

redbomb · 10-01-2002, 04:30 PM

Quote:

Originally posted by boldy
OK, my server where under heavy attack again last night, so this morning i did some thinking...
B.

Good try, however I don't think it will work. There's a couple things wrong with what you're doing.

213.195.122.123 - - [01/Oct/2002:10:27:28 +0200] "GET /members HTTP/1.1" 401 13 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3705)"
213.195.122.123 - ruud1 [01/Oct/2002:10:27:32 +0200] "GET /members HTTP/1.1" 200 399 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.0.3705)"

This is a browser attempting to login, not a brute force agent. More specifically, it's how IE logs in. If you were to type http://user

ass@site/members/ in Opera, you would see that it logs straight in without generating an error (401) first.

My point is that a brute force attempt will do the same thing. Sending the u/p as part of the request will nullify your protection.

boldy · 10-01-2002, 04:40 PM

But it will generate 309248239048920 good usernames/password combinations on the hacker's side. Which is a useless list ..

b1ighty · 10-01-2002, 06:10 PM

dream on, with our 1 year party we posted a few hundred thousand sites passes today, enjoy the bandwidth bills

redbomb · 10-01-2002, 06:10 PM

boldy: My bad, yer right.. good shit

redbomb · 10-01-2002, 06:16 PM

Looks like someone already knows to update their scripts though

Freakster.net · 10-01-2002, 11:28 PM

Lol yes but doesnt mean I do it

10-01-2002, 04:04 AM	#1
boldy Registered User Join Date: Jun 2002 Location: Too Close To Amsterdam Posts: 66	Possible solution to stop brute force password hacking (code inside) OK, my server where under heavy attack again last night, so this morning i did some thinking... i wrote this document, with a possible solution to stop the fuckers : http://www.kimhollandcash.com/bforce.php Let me know what you think ... B. __________________ Are You Fuckinhorny??

10-01-2002, 04:11 AM	#2
ultra160 Sex Elf Join Date: Mar 2002 Location: Pirie's Chair Posts: 12,358	Nice bit of creative thinking - I hope it works. __________________ Porn Synonyms - clitoris added today

10-01-2002, 05:39 AM	#3
QuaShe VIJ Member Join Date: May 2001 Location: The Netherlands Posts: 5,798	Hey Boldy, how is KHC doing? Anyway hope this will help against those fucks. Q. __________________ Contact info: ICQ: 123891112 Email: roald \|A\|T\| freeones dot com Url: FreeOnes.com \| FreeOnes Reviews SnowGathering 2007

10-01-2002, 06:29 AM	#4
Bunnyhop Little Jerk Join Date: Sep 2002 Posts: 84	Very interesting approach to solving brute force programs Boldy...heck you know I think it actually is crazy enough to really be able to fool the proggies without any real means of coding around it. __________________ ----------- Free automated way to rotate sponsor gallery thumbnails on your sites Find out what TGPs are listing your galleries - 30 days free for 3 domains(use discount code: galmon30) TGP Autosubmission System

10-01-2002, 02:59 PM	#6
toker Pimp Jerk Join Date: Feb 2001 Location: Under your bed Posts: 10,710	hmm thats pretty slick im gonna give it a shot myself save me from having to watch the access logs. __________________ Varzi Network - 100% Committed To Serving Your Business! www.varzi.net

10-01-2002, 08:34 AM	#5
Freakster.net Resident Bitch Join Date: Aug 2001 Location: Montreal Posts: 7,426	Thats clever Wont stop them from trying but I guess they'll realise pretty fast and stop They will find a way to go around this but still.. (use stolen pass, check content.. set it to only log passes that had the right html in answer page etc.. ) but it'll be a pain so they'll probably go to the next site instead Pretty smart

10-01-2002, 04:40 PM	#8
boldy Registered User Join Date: Jun 2002 Location: Too Close To Amsterdam Posts: 66	But it will generate 309248239048920 good usernames/password combinations on the hacker's side. Which is a useless list .. __________________ Are You Fuckinhorny??

10-01-2002, 06:10 PM	#9
b1ighty Wee Jerk Join Date: May 2002 Posts: 20	dream on, with our 1 year party we posted a few hundred thousand sites passes today, enjoy the bandwidth bills

10-01-2002, 06:10 PM	#10
redbomb Big Jerk Join Date: Apr 2000 Location: Canada Posts: 203	boldy: My bad, yer right.. good shit

10-01-2002, 06:16 PM	#11
redbomb Big Jerk Join Date: Apr 2000 Location: Canada Posts: 203	Looks like someone already knows to update their scripts though

10-01-2002, 11:28 PM	#12
Freakster.net Resident Bitch Join Date: Aug 2001 Location: Montreal Posts: 7,426	Lol yes but doesnt mean I do it

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode