Skip to main content
A
Anonymous
February 11, 2008
Question

Someone is Using My Code to Attack Me?

  • February 11, 2008
  • 4 replies
  • 759 views
I am using CF 6.1 on a Windows Server 2003 with Web Services and offer both Web and Email services to my clients on separate servers. Apparently I have not written my Cold Fusion correctly because someone is using my code against me to, what I can guess, bounce off my web server through to my email server.

I check my Log Files>application.log file once a week and had been noticing some really weird entries. I also noticed SPAM was up and am beginning to think this is somehow connected. So, I did a little digging into my Log Files and found the following:

2008-02-11 21:13:05 W3SVC1706141536 22.222.22.222 GET /images/header6.jpg - 80 - 84.48.194.10 Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+nb-NO;+rv:1.8.1.12)+Gecko/20080201+Firefox/2.0.0.12 http://www.cracked.com/forums/topic/29725/a-forum-game-if-you-laugh-you-lose-not-56k-friendly/20 www.mydomainname.org 200 0 0 7337 487 453

2008-02-11 21:16:48 W3SVC1706141536 22.222.22.222 GET /images/header6.jpg - 80 - 128.240.229.66 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.0;+SLCC1;+.NET+CLR+2.0.50727;+Media+Center+PC+5.0;+.NET+CLR+3.0.04506;+.NET+CLR+1.1.4322) http://www.cracked.com/forums/topic/29725/a-forum-game-if-you-laugh-you-lose-not-56k-friendly/20 www.mydomainname.org 200 0 0 7361 548 234

I tried adding the following to the top of each application.cfm file on my web server:

<cfif CGI.QUERY_STRING CONTAINS "http">
<cfabort>
</cfif>

It slowed things down, but now the attack is back and SPAM is crazy again. What is going on? What am I not doing correct? And what do I do to make it stop?

Any help or direction would be greatly appreciated. I am getting hit on every website on my server and have been for days now.

Thank you in advance for your help,

David Moore
UpstateWeb LLC
    This topic has been closed for replies.

    4 replies

    A
    Anonymous
    February 12, 2008
    Well, it looks like I about 2 years behind and things have finanlly trickled down to me in little old Spartanburg. I always hated having to enter those numbers, but I guess I am going to have to add them to all my forms.

    But the question begs to be asked, why? Why is there a need to throw senseless traffic at my server? Who are these people and what do they gain?

    I am now reading throw all the forums and understanding what is going on. Thank you everyone. Yes, things are slower here in the Bible Belt and it takes a little longer - - and frankly, I'm glad.

    But tonight, I am going to be here at the office a while and miss another night with my children, adding letter and number images to all my forms so some misguided Geek can no longer bounce pornographic spam off my server.
    A
    Anonymous
    February 12, 2008
    Could be form spam. We get that a lot here. We solve it by turning those forms into flash based forms. Kills the spam 100%. But your version of CF is a little old for that.

    Might want to look into CAPATCHA type human authenticator type thingy.
    A
    Anonymous
    February 12, 2008
    I simply host websites. Like most websites, I use forms to submit emails and allow exchange of information. The information is sent to my email server for processing using authentication.

    Is there something more I need to be doing to stop someone from using forms against me. Do I need to include something in my code that I don't know about?
    A
    astoneappdev
    Participant
    February 12, 2008
    Try looking at the HTTP_REFERER in your conditional statement. Lets say your site is www.thisismysite.com

    <CFIF #CGI.HTTP_REFERER# DOES NOT CONTAIN "thisismysite.com">

    [ abort or do something like write the requesting data to a seperate text file so you can more easily see where the hit is coming from ]

    <CFFILE ACTION="APPEND"
    FILE="C:\Somefile.txt"
    OUTPUT = "#DateFormat(Now(), "mm/dd/yyy")#..."#TimeFormat(Now(), ""HH:mm:ss")# ...#CGI.HTTP_REFERER#")#"
    >

    <CFELSE>

    [ let the page be diplayed ]

    </CFIF>
    N
    Newsgroup_User
    Inspiring
    February 12, 2008
    JeremysDad wrote:
    > I check my Log Files>application.log file once a week and had been noticing
    > some really weird entries. I also noticed SPAM was up and am beginning to think
    > this is somehow connected. So, I did a little digging into my Log Files and
    > found the following:
    >
    > 2008-02-11 21:13:05 W3SVC1706141536 22.222.22.222 GET /images/header6.jpg - 80
    > - 84.48.194.10
    > Mozilla/5.0+(Windows;+U;+Windows+NT+5.1;+nb-NO;+rv:1.8.1.12)+Gecko/20080201+Fire
    > fox/2.0.0.12
    > http://www.cracked.com/forums/topic/29725/a-forum-game-if-you-laugh-you-lose-not
    > -56k-friendly/20 www.mydomainname.org 200 0 0 7337 487 453

    That is not an attack, that is somebody including the image
    http://www.truthministry.org/images/header6.jpg on the forum page
    http://www.cracked.com/forums/topic/29725/a-forum-game-if-you-laugh-you-lose-not-56k-friendly/20


    > It slowed things down, but now the attack is back and SPAM is crazy again.
    > What is going on? What am I not doing correct? And what do I do to make it
    > stop?

    What service do you provide exactly? Some form to mail service?

    Jochem


    --
    Jochem van Dieten
    Adobe Community Expert for ColdFusion
    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices