+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TuT] Blocking Website Scanners and Banning People Scanning Your Website [TuT] (/showthread.php?tid=2825383)
Pages: Pages
1
2
[TuT] Blocking Website Scanners and Banning People Scanning Your Website [TuT] - Sheldon Lee Cooper - Aug 31, 2012
So in this tutorial, I will be teaching you how you can protect your website from being scanned by 3rd party people for vulnerabilities and how you can automatically ban them form doing it. This helps dramatically since there are chances that your website has some vulnerabilities which hackers might find and use to exploit your website. So hope you all enjoy this. If you find a mistake, please do write it down in the comments.
Please note that this will not work completely. This can still be bypassed. But more than 80% of the times, skids attempt to scan your site and they do not know how to bypass this restriction made by us.
Setup
1 - So first what you need is a directory to trap the scanner. So you must make a new directory named /trap/ or whatever you like in the root. So what we will do is when the scanner or the program scans your website and accesses this directory, they will be IP banned. So this will prevent further scanning of your website. Please keep in mind that even members, and not only guests will be banned by this method.
2 - Next thing we want to keep in mind is that we don't need to ban legit bots like the bots by search engines like google. So for that, we need to set access such that we do not allow these bots to enter the traps directory. For that, we add this piece of line to the robots.txt file.
Code
]User-agent: *Disallow: /trap/Now what you need to do is simple. Go and create a new index.php file in the new /trap/ directory and add this :
Code
<?php
$agent = $_SERVER['$HTTP_USER_AGENT'];
$datum = date("Y-m-d (D) H:i:s",$tmestamp);
$ipad = $_SERVER['REMOTE_ADDR'];
$ban = "Deny from $ipad # /trap/ $agent - on $datum \r\n";
$file = "../.htaccess";
$search = file_get_contents($file);
$check = strpos($search, $ipad);
if ($check === FALSE) {
$open = @fopen($file, "a+");
$write = @fputs($open, $ban);
echo "The IP <b>".$ipad."</b> has been blocked for an invalid access attempt to a file, directory, or a scanning atempt.;
@fclose($open);
} else {
echo "The IP <b>".$ipad."</b> has been blocked for an invalid access attempt to a file, directory, or a scanning atempt.";
}
exit;
?>$file - you need to edit this depending on where you place your trap.
So now we have the trap setup, now we need to place the bait to lure the scanners to your trap. Now edit the index file in your root directory and add this piece of code at the bottom :
Code
<a href="/trap/"><img src="images/pix.JPG" border="0" alt=" " width="1" height="1"></a>Since the bots or scanners checks for links while crawling, they will see this line of code and immediately travel to our /trap/ folder and get trapped in it. When a bot or scanner tries to access the directory, they would get an access denied message.You could also use this in various situations. You can use this in your admin directory where you have the ACP so that no one will access it.
Hope you like my tutorial
Thanks for reading.
Peace
* - darksrc - Aug 31, 2012
Brilliant idea there bro, implementing it now. May want to fix a couple of the spelling errors during the echos though
~Ultim8um 🤝
* - Sheldon Lee Cooper - Aug 31, 2012
Thank you for dropping the comment ;)
* - Antigen - Aug 31, 2012
I think this post deserves more attention,Great tutorial for web masters,Thanks
* - Sheldon Lee Cooper - Aug 31, 2012
Thanks for the comment Operator. Maybe its because more people are interested in hacking and some of them might not have understood or cared for reading it whole. It's alright all right as long as I get a few comments :)
* - evolutionroh - Sep 1, 2012
awesome tutorial !! going to implement it !! thanks for sharing
* - Sheldon Lee Cooper - Sep 1, 2012
You're welcome evolutionroh.. Thanks for dropping the valuable comment ;)
* - Jasjj - Sep 1, 2012
Really nice, it works.
Thanks for this!!
* - Tenacious - Sep 1, 2012
That's a pretty good idea, thanks for that.
* - Sheldon Lee Cooper - Sep 1, 2012
Thank you both for dropping comments on my thread :D
* - VeriFy - Sep 1, 2012
Good and useful tutorial, but I think it should be in White hat section.
Thanks anyway.
* - Sheldon Lee Cooper - Sep 1, 2012
Thanks for the comment Verify. ;) And I guess this is the right section.
* - Zaligo - Sep 1, 2012
Very nice thread, will come in handy :)
* - Sheldon Lee Cooper - Sep 1, 2012
Thank you both for dropping the +ve comments :D
* - bockwurst - Sep 3, 2012
thank you for this simple and nice tutorial, looked around awile and found this