Anti-armenia.ORG - Forumlar - Seditio Təhlükəsizliy gücləndirmə [Azdan Çoxdan]



Istifadəçi
    2012-04-28 20:07 GMT                 

LocaL



Gold
Mesaj Sayı : 141
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   2  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər : Badu Kubə
Ölkə :
Məslək : ....
Yaş :
Mesaj :

Mövzunu Paylaş!


Bu mövzuda Seditio ilə qurduğumuZ saytı azdan çoxdan təhlükəsizliyini gücləndirməyi öyrənəcəyik. İlk öncə admin.php-yə şifrə qoyaq :

.htaccess faylına əlavə edirik:
Kod:
<Files admin.php>
AuthName "passi daxil et eks halda bilirsen neylemek lazimdir)"
AuthType Basic
AuthUserFile /home/saytin/public_html/.htpasswd
Require valid-user
</Files>



Sonra isə

http://www.htaccesstools.com/htpasswd-generator/

istifadə edərək username və pass yarat save elə .htpasswd faylına.
Və upload et saytına .

Təşəkkürlər ~ AkaStep bro

_______________________________________________________________________________

daha sonra admin.php dahada təhlükəsizliyini gücləndirmək üçün "Admin Login" pluginin saytımızda install edirik . admin login pluginin yükləməl üçün:
http://www.share.az/lt3k5mbhchua/adminlogin.rar.html
http://www.boxca.com/bv2zoybmjefb/adminlogin.rar.html

Admin loginin plugininin quraşdırılması:
Kod:
plugins/adminlogin/pass/adminlogin.pass.php
nı açın md5 ilə şifrələdiyiniz şifrəni ilk sətirə yazın.

Misal:
Kod:
//Usage: $user["your_admin_name_here"] = "your md5 hash";
$al_pass["admin"] = "21232f297a57a5a743894a0e4a801fc3"; //password is admin



datas/config.php de altdakı parametrləri tətbiq edin.

Kod:
$cfg['ipcheck'] = TRUE;
$cfg['authmode'] = 3; // (1:cookies, 2:sessions, 3:cookies+sessions) default=1


Kod:
$cfg['authmode'] = 3;


daha sonra htacces faylımızı açırıq aşağdakı kodları əlavə edirik:

Kod:
# Ancaq Bu reguestler handle olunacaq.

RewriteCond %{REQUEST_METHOD} !^(GET|HEAD|POST|PROPFIND|OPTIONS|PUT)$ [NC]
RewriteRule .* - [F,NS,L]



AddDefaultCharset UTF-8


RemoveHandler cgi-script .pl .py  .sh .cgi

Options -ExecCGI
AddHandler cgi-script  .pl .py  .sh .cgi


<IfModule mod_gzip.c>
mod_gzip_on       Yes
mod_gzip_dechunk  Yes
mod_gzip_item_include file      \.(html?|txt|css|js|php|pl|gif)$
mod_gzip_item_include handler   ^cgi-script$
mod_gzip_item_include mime      ^text/.*
mod_gzip_item_include mime      ^application/x-javascript.*
mod_gzip_item_exclude mime      ^image/.*
mod_gzip_item_exclude rspheader ^Content-Encoding:.*gzip.*
</IfModule>


# MIME Types   Hec neyi Editleme.Server indi butun fayl tiplerini duzgun handle #edir
AddType x-world/x-3dmf 3dm
AddType x-world/x-3dmf 3dmf
AddType application/octet-stream a
AddType application/x-authorware-bin aab
AddType application/x-authorware-map aam
AddType application/x-authorware-seg aas
AddType text/vnd.abc abc
AddType video/animaflex afl
AddType application/postscript ai
AddType audio/x-aiff aif
AddType audio/aiff aif
AddType audio/x-aiff aifc
AddType audio/aiff aifc
AddType audio/x-aiff aiff
AddType audio/aiff aiff
AddType application/x-aim aim
AddType text/x-audiosoft-intra aip
AddType application/x-navi-animation ani
AddType application/x-nokia-9000-communicator-add-on-software aos
AddType application/mime aps
AddType application/octet-stream arc
AddType application/octet-stream arj
AddType application/arj arj
AddType image/x-jg art
AddType video/x-ms-asf asf
AddType text/x-asm asm
AddType text/asp asp
AddType video/x-ms-asf-plugin asx
AddType video/x-ms-asf asx
AddType application/x-mplayer2 asx
AddType audio/x-au au
AddType audio/basic au
AddType video/x-msvideo avi
AddType video/msvideo avi
AddType video/avi avi
AddType application/x-troff-msvideo avi
AddType video/avs-video avs
AddType application/x-bcpio bcpio
AddType application/x-macbinary bin
AddType application/x-binary bin
AddType application/octet-stream bin
AddType application/macbinary bin
AddType application/mac-binary bin
AddType image/bmp bm
AddType image/x-windows-bmp bmp
AddType image/bmp bmp
AddType application/book boo
AddType application/book book
AddType application/x-bzip2 boz
AddType application/x-bsh bsh
AddType application/x-bzip bz
AddType application/x-bzip2 bz2
AddType text/x-c c
AddType text/plain c
AddType text/plain c++
AddType application/vnd.ms-pki.seccat cat
AddType text/x-c cc
AddType text/plain cc
AddType application/clariscad ccad
AddType application/x-cocoa cco
AddType application/x-netcdf cdf
AddType application/x-cdf cdf
AddType application/cdf cdf
AddType application/x-x509-ca-cert cer
AddType application/pkix-cert cer
AddType application/x-chat cha
AddType application/x-chat chat
AddType application/x-java-class class
AddType application/java-byte-code class
AddType application/java class
AddType text/plain com
AddType application/octet-stream com
AddType text/plain conf
AddType application/x-cpio cpio
AddType text/x-c cpp
AddType application/x-cpt cpt
AddType application/x-compactpro cpt
AddType application/mac-compactpro cpt
AddType application/pkix-crl crl
AddType application/pkcs-crl crl
AddType application/x-x509-user-cert crt
AddType application/x-x509-ca-cert crt
AddType application/pkix-cert crt
AddType text/x-script.csh csh
AddType application/x-csh csh
AddType text/plain cxx
AddType application/x-director dcr
AddType application/x-deepv deepv
AddType text/plain def
AddType application/x-x509-ca-cert der
AddType video/x-dv dif
AddType application/x-director dir
AddType video/x-dl dl
AddType video/dl dl
AddType application/msword doc
AddType application/msword dot
AddType application/commonground dp
AddType application/drafting drw
AddType application/octet-stream dump
AddType video/x-dv dv
AddType application/x-dvi dvi
AddType model/vnd.dwf dwf
AddType drawing/x-dwf (old) dwf
AddType image/x-dwg dwg
AddType image/vnd.dwg dwg
AddType application/acad dwg
AddType image/x-dwg dxf
AddType image/vnd.dwg dxf
AddType application/dxf dxf
AddType application/x-director dxr
AddType text/x-script.elisp el
AddType application/x-elc elc
AddType application/x-bytecode.elisp (Compiled ELisp) elc
AddType application/x-envoy env
AddType application/postscript eps
AddType application/x-esrehber es
AddType text/x-setext etx
AddType application/x-envoy evy
AddType application/envoy evy
AddType application/octet-stream exe
AddType text/x-fortran f
AddType text/plain f
AddType text/x-fortran f77
AddType text/x-fortran f90
AddType text/plain f90
AddType application/vnd.fdf fdf
AddType image/fif fif
AddType application/fractals fif
AddType video/x-fli fli
AddType video/fli fli
AddType image/florian flo
AddType text/vnd.fmi.flexstor flx
AddType video/x-atomic3d-feature fmf
AddType text/x-fortran for
AddType text/plain for
AddType image/vnd.net-fpx fpx
AddType image/vnd.fpx fpx
AddType application/freeloader frl
AddType audio/make funk
AddType text/plain g
AddType image/g3fax g3
AddType image/gif gif
AddType video/x-gl gl
AddType video/gl gl
AddType audio/x-gsm gsd
AddType audio/x-gsm gsm
AddType application/x-gsp gsp
AddType application/x-gss gss
AddType application/x-gtar gtar
AddType application/x-gzip gz
AddType application/x-compressed gz
AddType multipart/x-gzip gzip
AddType application/x-gzip gzip
AddType text/x-h h
AddType text/plain h
AddType application/x-hdf hdf
AddType application/x-helpfile help
AddType application/vnd.hp-HPGL hgl
AddType text/x-h hh
AddType text/plain hh
AddType text/x-script hlb
AddType application/x-winhelp hlp
AddType application/x-helpfile hlp
AddType application/hlp hlp
AddType application/vnd.hp-HPGL hpg
AddType application/vnd.hp-HPGL hpgl
AddType application/x-mac-binhex40 hqx
AddType application/x-binhex40 hqx
AddType application/mac-binhex40 hqx
AddType application/mac-binhex hqx
AddType application/binhex4 hqx
AddType application/binhex hqx
AddType x-conference/x-cooltalk ice
AddType image/x-icon ico
AddType text/plain idc
AddType image/ief ief
AddType image/ief iefs
AddType model/iges iges
AddType application/iges (old) iges
AddType application/iges iges
AddType model/iges igs
AddType application/iges (old) igs
AddType application/iges igs
AddType application/x-ima ima
AddType application/x-httpd-imap imap
AddType application/inf inf
AddType application/x-internett-signup ins
AddType application/x-ip2 ip
AddType video/x-isvideo isu
AddType audio/it it
AddType application/x-inventor iv
AddType i-world/i-vrml ivr
AddType application/x-livescreen ivy
AddType audio/x-jam jam
AddType text/x-java-source jav
AddType text/plain jav
AddType text/x-java-source java
AddType text/plain java
AddType application/x-java-commerce jcm
AddType image/pjpeg jfif
AddType image/jpeg jfif
AddType image/jpeg jfif-tbnl
AddType image/pjpeg jpe
AddType image/jpeg jpe
AddType image/pjpeg jpeg
AddType image/jpeg jpeg
AddType image/pjpeg jpg
AddType image/jpeg jpg
AddType image/x-jps jps
AddType application/x-javascript js
AddType image/jutvision jut
AddType music/x-karaoke kar
AddType audio/midi kar
AddType text/x-script.ksh ksh
AddType application/x-ksh ksh
AddType audio/x-nspaudio la
AddType audio/nspaudio la
AddType audio/x-liveaudio lam
AddType application/x-latex latex
AddType application/x-lha lha
AddType application/octet-stream lha
AddType application/lha lha
AddType application/octet-stream lhx
AddType text/plain list
AddType audio/x-nspaudio lma
AddType audio/nspaudio lma
AddType text/plain log
AddType text/x-script.lisp lsp
AddType application/x-lisp lsp
AddType text/plain lst
AddType text/x-la-asf lsx
AddType application/x-latex ltx
AddType application/x-lzh lzh
AddType application/octet-stream lzh
AddType application/x-lzx lzx
AddType application/octet-stream lzx
AddType application/lzx lzx
AddType text/x-m m
AddType text/plain m
AddType video/mpeg m1v
AddType audio/mpeg m2a
AddType video/mpeg m2v
AddType audio/x-mpequrl m3u
AddType application/x-troff-man man
AddType application/x-navimap map
AddType text/plain mar
AddType application/mbedlet mbd
AddType application/x-magic-cap-package-1.0 mc$
AddType application/x-mathcad mcd
AddType application/mcad mcd
AddType text/mcf mcf
AddType image/vasa mcf
AddType application/netmc mcp
AddType application/x-troff-me me
AddType message/rfc822 mht
AddType message/rfc822 mhtml
AddType x-music/x-midi mid
AddType music/crescendo mid
AddType audio/x-midi mid
AddType audio/x-mid mid
AddType audio/midi mid
AddType application/x-midi mid
AddType x-music/x-midi midi
AddType music/crescendo midi
AddType audio/x-midi midi
AddType audio/x-mid midi
AddType audio/midi midi
AddType application/x-midi midi
AddType application/x-mif mif
AddType application/x-frame mif
AddType www/mime mime
AddType message/rfc822 mime
AddType audio/x-vnd.AudioExplosion.MjuiceMediaFile mjf
AddType video/x-motion-jpeg mjpg
AddType application/x-meme mm
AddType application/base64 mm
AddType application/base64 mme
AddType audio/x-mod mod
AddType audio/mod mod
AddType video/quicktime moov
AddType video/quicktime mov
AddType video/x-sgi-movie movie
AddType video/x-mpeq2a mp2
AddType video/x-mpeg mp2
AddType video/mpeg mp2
AddType audio/x-mpeg mp2
AddType audio/mpeg mp2
AddType video/x-mpeg mp3
AddType video/mpeg mp3
AddType audio/x-mpeg-3 mp3
AddType audio/mpeg3 mp3
AddType video/mpeg mpa
AddType audio/mpeg mpa
AddType application/x-project mpc
AddType video/mpeg mpe
AddType video/mpeg mpeg
AddType video/mpeg mpg
AddType audio/mpeg mpg
AddType audio/mpeg mpga
AddType application/vnd.ms-project mpp
AddType application/x-project mpt
AddType application/x-project mpv
AddType application/x-project mpx
AddType application/marc mrc
AddType application/x-troff-ms ms
AddType video/x-sgi-movie mv
AddType audio/make my
AddType application/x-vnd.AudioExplosion.mzz mzz
AddType image/naplps nap
AddType image/naplps naplps
AddType application/x-netcdf nc
AddType application/vnd.nokia.configuration-message ncm
AddType image/x-niff nif
AddType image/x-niff niff
AddType application/x-mix-transfer nix
AddType application/x-conference nsc
AddType application/x-navidoc nvd
AddType application/octet-stream o
AddType application/oda oda
AddType application/x-omc omc
AddType application/x-omcdatamaker omcd
AddType application/x-omcregerator omcr
AddType text/x-pascal p
AddType application/x-pkcs10 p10
AddType application/pkcs10 p10
AddType application/x-pkcs12 p12
AddType application/pkcs-12 p12
AddType application/x-pkcs7-signature p7a
AddType application/x-pkcs7-mime p7c
AddType application/pkcs7-mime p7c
AddType application/x-pkcs7-mime p7m
AddType application/pkcs7-mime p7m
AddType application/x-pkcs7-certreqresp p7r
AddType application/pkcs7-signature p7s
AddType application/pro_eng part
AddType text/pascal pas
AddType image/x-portable-bitmap pbm
AddType application/x-pcl pcl
AddType application/vnd.hp-PCL pcl
AddType image/x-pict pct
AddType image/x-pcx pcx
AddType chemical/x-pdb pdb
AddType application/pdf pdf
AddType audio/make.my.funk pfunk
AddType audio/make pfunk
AddType image/x-portable-greymap pgm
AddType image/x-portable-graymap pgm
AddType image/pict pic
AddType image/pict pict
AddType application/x-newton-compatible-pkg pkg
AddType application/vnd.ms-pki.pko pko
AddType text/x-script.perl pl
AddType text/plain pl
AddType application/x-PiXCLscript plx
AddType text/x-script.perl-module pm
AddType image/x-xpixmap pm
AddType application/x-pagemaker pm4
AddType application/x-pagemaker pm5
AddType image/png png
AddType image/x-portable-anymap pnm
AddType application/x-portable-anymap pnm
AddType application/vnd.ms-powerpoint pot
AddType application/mspowerpoint pot
AddType model/x-pov pov
AddType application/vnd.ms-powerpoint ppa
AddType image/x-portable-pixmap ppm
AddType application/vnd.ms-powerpoint pps
AddType application/mspowerpoint pps
AddType application/x-mspowerpoint ppt
AddType application/vnd.ms-powerpoint ppt
AddType application/powerpoint ppt
AddType application/mspowerpoint ppt
AddType application/mspowerpoint ppz
AddType application/x-freelance pre
AddType application/pro_eng prt
AddType application/postscript ps
AddType application/octet-stream psd
AddType paleovu/x-pv pvu
AddType application/vnd.ms-powerpoint pwz
AddType text/x-script.phyton py
AddType applicaiton/x-bytecode.python pyc
AddType audio/vnd.qcelp qcp
AddType x-world/x-3dmf qd3
AddType x-world/x-3dmf qd3d
AddType image/x-quicktime qif
AddType video/quicktime qt
AddType video/x-qtc qtc
AddType image/x-quicktime qti
AddType image/x-quicktime qtif
AddType audio/x-realaudio ra
AddType audio/x-pn-realaudio-plugin ra
AddType audio/x-pn-realaudio ra
AddType audio/x-pn-realaudio ram
AddType image/x-cmu-raster ras
AddType image/cmu-raster ras
AddType application/x-cmu-raster ras
AddType image/cmu-raster rast
AddType text/x-script.rexx rexx
AddType image/vnd.rn-realflash rf
AddType image/x-rgb rgb
AddType audio/x-pn-realaudio rm
AddType application/vnd.rn-realmedia rm
AddType audio/mid rmi
AddType audio/x-pn-realaudio rmm
AddType audio/x-pn-realaudio-plugin rmp
AddType audio/x-pn-realaudio rmp
AddType application/vnd.nokia.ringing-tone rng
AddType application/ringing-tones rng
AddType application/vnd.rn-realplayer rnx
AddType application/x-troff roff
AddType image/vnd.rn-realpix rp
AddType audio/x-pn-realaudio-plugin rpm
AddType text/vnd.rn-realtext rt
AddType text/richtext rt
AddType text/richtext rtf
AddType application/x-rtf rtf
AddType application/rtf rtf
AddType text/richtext rtx
AddType application/rtf rtx
AddType video/vnd.rn-realvideo rv
AddType text/x-asm s
AddType audio/s3m s3m
AddType application/octet-stream saveme
AddType application/x-tbook sbk
AddType video/x-scm scm
AddType text/x-script.scheme scm
AddType text/x-script.guile scm
AddType application/x-lotusscreencam scm
AddType text/plain sdml
AddType application/x-sdp sdp
AddType application/sdp sdp
AddType application/sounder sdr
AddType application/x-sea sea
AddType application/sea sea
AddType application/set set
AddType text/x-sgml sgm
AddType text/sgml sgm
AddType text/x-sgml sgml
AddType text/sgml sgml
AddType text/x-script.sh sh
AddType application/x-shar sh
AddType application/x-sh sh
AddType application/x-bsh sh
AddType application/x-shar shar
AddType application/x-bsh shar
AddType text/x-server-parsed-html shtml
AddType text/html shtml
AddType audio/x-psid sid
AddType application/x-stuffit sit
AddType application/x-sit sit
AddType application/x-koan skd
AddType application/x-koan skm
AddType application/x-koan skp
AddType application/x-koan skt
AddType application/x-seelogo sl
AddType application/smil smi
AddType application/smil smil
AddType audio/x-adpcm snd
AddType audio/basic snd
AddType application/solids sol
AddType text/x-speech spc
AddType application/x-pkcs7-certificates spc
AddType application/futuresplash spl
AddType application/x-sprite spr
AddType application/x-sprite sprite
AddType application/x-wais-source src
AddType text/x-server-parsed-html ssi
AddType application/streamingmedia ssm
AddType application/vnd.ms-pki.certstore sst
AddType application/step step
AddType application/x-navistyle stl
AddType application/vnd.ms-pki.stl stl
AddType application/sla stl
AddType application/step stp
AddType application/x-sv4cpio sv4cpio
AddType application/x-sv4crc sv4crc
AddType image/x-dwg svf
AddType image/vnd.dwg svf
AddType x-world/x-svr svr
AddType application/x-world svr
AddType application/x-shockwave-flash swf
AddType application/x-troff t
AddType text/x-speech talk
AddType application/x-tar tar
AddType appliation/x-tar tar
AddType application/x-tbook tbk
AddType application/toolbook tbk
AddType text/x-script.tcl tcl
AddType application/x-tcl tcl
AddType text/x-script.tcsh tcsh
AddType application/x-tex tex
AddType application/x-texinfo texi
AddType application/x-texinfo texinfo
AddType text/plain text
AddType application/plain text
AddType application/x-compressed tgz
AddType application/gnutar tgz
AddType image/x-tiff tif
AddType image/tiff tif
AddType image/x-tiff tiff
AddType image/tiff tiff
AddType application/x-troff tr
AddType audio/tsp-audio tsi
AddType audio/tsplayer tsp
AddType application/dsptype tsp
AddType text/tab-separated-values tsv
AddType image/florian turbot
AddType text/plain txt
AddType text/x-uil uil
AddType text/uri-list uni
AddType text/uri-list unis
AddType application/i-deas unv
AddType text/uri-list uri
AddType text/uri-list uris
AddType multipart/x-ustar ustar
AddType application/x-ustar ustar
AddType text/x-uuencode uu
AddType application/octet-stream uu
AddType text/x-uuencode uue
AddType application/x-cdlink vcd
AddType text/x-vCalendar vcs
AddType application/vda vda
AddType video/vdo vdo
AddType application/groupwise vew
AddType video/vnd.vivo viv
AddType video/vivo viv
AddType video/vnd.vivo vivo
AddType video/vivo vivo
AddType application/vocaltec-media-desc vmd
AddType application/vocaltec-media-file vmf
AddType audio/x-voc voc
AddType audio/voc voc
AddType video/vosaic vos
AddType audio/voxware vox
AddType audio/x-twinvq-plugin vqe
AddType audio/x-twinvq vqf
AddType audio/x-twinvq-plugin vql
AddType x-world/x-vrml vrml
AddType model/vrml vrml
AddType application/x-vrml vrml
AddType x-world/x-vrt vrt
AddType application/x-visio vsd
AddType application/x-visio vst
AddType application/x-visio vsw
AddType application/wordperfect6.0 w60
AddType application/wordperfect6.1 w61
AddType application/msword w6w
AddType audio/x-wav wav
AddType audio/wav wav
AddType application/x-qpro wb1
AddType image/vnd.wap.wbmp wbmp
AddType application/vnd.xara web
AddType application/msword wiz
AddType application/x-123 wk1
AddType windows/metafile wmf
AddType text/vnd.wap.wml wml
AddType application/vnd.wap.wmlc wmlc
AddType text/vnd.wap.wmlscript wmls
AddType application/vnd.wap.wmlscriptc wmlsc
AddType application/msword word
AddType application/wordperfect wp
AddType application/wordperfect6.0 wp5
AddType application/wordperfect wp5
AddType application/wordperfect wp6
AddType application/x-wpwin wpd
AddType application/wordperfect wpd
AddType application/x-lotus wq1
AddType application/x-wri wri
AddType application/mswrite wri
AddType x-world/x-vrml wrl
AddType model/vrml wrl
AddType application/x-world wrl
AddType x-world/x-vrml wrz
AddType model/vrml wrz
AddType text/scriplet wsc
AddType application/x-wais-source wsrc
AddType application/x-wintalk wtk
AddType image/xbm xbm
AddType image/x-xbm xbm
AddType image/x-xbitmap xbm
AddType video/x-amt-demorun xdr
AddType xgl/drawing xgz
AddType image/vnd.xiff xif
AddType application/excel xl
AddType application/x-msexcel xla
AddType application/x-excel xla
AddType application/excel xla
AddType application/x-excel xlb
AddType application/vnd.ms-excel xlb
AddType application/excel xlb
AddType application/x-excel xlc
AddType application/vnd.ms-excel xlc
AddType application/excel xlc
AddType application/x-excel xld
AddType application/excel xld
AddType application/x-excel xlk
AddType application/excel xlk
AddType application/x-excel xll
AddType application/vnd.ms-excel xll
AddType application/excel xll
AddType application/x-excel xlm
AddType application/vnd.ms-excel xlm
AddType application/excel xlm
AddType application/x-msexcel xls
AddType application/x-excel xls
AddType application/vnd.ms-excel xls
AddType application/excel xls
AddType application/x-excel xlt
AddType application/excel xlt
AddType application/x-excel xlv
AddType application/excel xlv
AddType application/x-msexcel xlw
AddType application/x-excel xlw
AddType application/vnd.ms-excel xlw
AddType application/excel xlw
AddType audio/xm xm
AddType text/xml xml
AddType application/xml xml
AddType xgl/movie xmz
AddType application/x-vnd.ls-xpix xpix
AddType image/xpm xpm
AddType image/x-xpixmap xpm
AddType image/png x-png
AddType video/x-amt-showrun xsr
AddType image/x-xwindowdump xwd
AddType image/x-xwd xwd
AddType chemical/x-pdb xyz
AddType application/x-compressed z
AddType application/x-compress z
AddType multipart/x-zip zip
AddType application/zip zip
AddType application/x-zip-compressed zip
AddType application/x-compressed zip
AddType application/octet-stream zoo
AddType text/x-script.zsh zsh





# Prevent viewing of evilscript0
<Files ~ "^\.php.fla">
order allow,deny
deny from all
satisfy all
</Files>

# Prevent viewing of evilscript1
<Files ~ "^\.PhP.gif">
order allow,deny
deny from all
satisfy all
</Files>



# Disable directory listing from this point
Options -Indexes

Redirect 301 /robot.txt http://sayt.com/
Redirect 301 /robots.txt http://sayt.com/
Redirect 301 /error_log http://sayt.com/
Redirect 301 /shell.php http://sayt.com/
Redirect 301 /c99.php http://sayt.com/
Redirect 301 /r57.php http://sayt.com/
Redirect 301 /root.php http://sayt.com/
Redirect 301 /c100.php http://sayt.com/





# Rewrite engine options
Options FollowSymLinks -Indexes
RewriteEngine On
# Server-relative path to seditio:
RewriteBase /
# Engine Shortcuts
RewriteRule ^user__(.+)\.html(#.*)?$ users.php?rwr=m-details__ual-$1$2 [NC,NE,L]
RewriteRule ^c-(.+)\.html(#.*)?$ list.php?rwr=c-$1$2 [NC,NE,L]
RewriteRule ^i-([0-9]+)-[^_]+(.*)\.html(#.*)?$ page.php?rwr=id-$1$2$3 [NC,NE,L]
RewriteRule ^i-(.+)\.html(#.*)?$ page.php?rwr=id-$1$2 [NC,NE,L]
RewriteRule ^a-(.+)\.html(#.*)?$ page.php?rwr=al-$1$2 [NC,NE,L]
RewriteRule ^p-(.+)\.html(#.*)?$ plug.php?rwr=e-$1$2 [NC,NE,L]
RewriteRule ^o-(.+)\.html(#.*)?$ plug.php?rwr=o-$1$2 [NC,NE,L]
RewriteRule ^s-([0-9]+)-[^_]+(.*)\.html(#.*)?$ forums.php?rwr=m-topics__s-$1$2$3 [NC,NE,L]
RewriteRule ^s-(.+)\.html(#.*)?$ forums.php?rwr=m-topics__s-$1$2 [NC,NE,L]
RewriteRule ^q-([0-9]+)-[^_]+(.*)\.html(#.*)?$ forums.php?rwr=m-posts__q-$1$2$3 [NC,NE,L]
RewriteRule ^q-(.+)\.html(#.*)?$ forums.php?rwr=m-posts__q-$1$2 [NC,NE,L]
RewriteRule ^t-([0-9]+)-[^_]+(.*)\.html(#.*)?$ forums.php?rwr=m-posts__p-$1$2$3 [NC,NE,L]
RewriteRule ^t-(.+)\.html(#.*)?$ forums.php?rwr=m-posts__p-$1$2 [NC,NE,L]
RewriteRule ^u-(.*)\.html(#.*)?$ users.php?rwr=m-details__id-$1$2 [NC,NE,L]
# Main
RewriteRule ^(chat|forums|index|list|message|page|pfs|plug|pm|polls|rss|users|view|captcha)__(.+)\.html(#.*)?$ $1.php?rwr=$2$3 [NC,NE,L]
RewriteRule ^(chat|forums|index|list|message|page|pfs|plug|pm|polls|rss|users|view|captcha)\.html(#.*)?$ $1.php$2 [NC,NE,L]
# Fixes
RewriteRule ^.+/favicon.ico$ favicon.ico [NC,NE,L]





RewriteEngine on
# Rewrite-Code | by dvdbil www.seditio-tr.com
RewriteCond %{QUERY_STRING} (\"|%22).*(\>|%3E|<|%3C).* [NC]
RewriteRule ^(.*)$ 404.shtml [NC]
RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC]
RewriteRule ^(.*)$ 404.shtml [NC]
RewriteCond %{QUERY_STRING} (\;|\'|\"|\%22).*(union|insert|where|select|update|drop|md5|or|and|if).* [NC]
RewriteRule ^(.*)$ 404.shtml [NC]
RewriteRule (,|;|<|>|'|`) index.php [NC]


bu kodlarda sayt.com yerlərinə öz saytınızın adın yazın.
htacces kodlarına görə Ales broya təşəkkürlər.

Əlbəttə bunlar bəlkədə 1%-dir))) amma nədə olsa heç yoxdan yaxşıdır. həmçinin işlətdiyniz pluginlərə diqqət eləməlisiniz. plugində shell,backdoor və s. kimi "ziyanverici həşəratlar" olmasın

və bəzi açıq və bugları bağlamaq üçün http://redhatz.org/page.php?id=9 bu linkdən faydalana bilərsiniz.





Çakıl taşlı yollar yordu beni, keşke yürüse yanımda bişr-i hafi...
Anti-armenia.ORG
    

Istifadəçi
    2012-04-28 20:29 GMT                 

M4NY3TIK



Gold
Mesaj Sayı : 606
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   7  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər : Naxçıvan
Ölkə :
Məslək :
Yaş :
Mesaj :

Mövzunu Paylaş!


Təşəkkürlər Məlumata Görə.

http://s017.radikal.ru/i404/1202/c6/a2947080a3c4.png
Anti-armenia.ORG
    

Istifadəçi
    2012-05-01 21:40 GMT                 

BlackMinD



Pr0grammer
Mesaj Sayı : 1677
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   62  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər : KARABAKH IS AZERBAIJAN!
Ölkə :
Məslək :
Yaş :
Mesaj :

Mövzunu Paylaş!


Təşəkkürlər Local.Gəlki

Kod:
$ourLogin = "loginin";
$ourPassword = "parolun";
session_start();
if ($_SESSION[login]!=$ourLogin && $_SESSION[password]!=$ourPassword) {

if ($_POST[login]==$ourLogin && $_POST[password]==$ourPassword) {

$_SESSION[login] = $_POST[login];
$_SESSION[password] = $_POST[password];
header("Location: index.php");

}
else {

echo "
<form action=admin.php method=post>

Login:<br>
<input type=text name=login value=><br>
Password:<br>
<input type=password name=password value=><br>
<input type=submit value= - ok - >

</form>
";
exit;
}
}


Bərbad vəziyyətdədir.

A)session_start(); həmişə skriptin lap başlanğıcında olmalıdır.Əks halda output olsa skriptdə bu funksiyadan əvvəl
header already sent by output
error verəcək.
B)Heç vaxt sessiya fayllarına sensitive məlumatı olmaz vermək.Shared hostingdə xüsusilə bu passın fırladılmasına gətirib çıxarır.
Bundan danışıram:

$_SESSION[login] = $_POST[login];
$_SESSION[password] = $_POST[password];

C) ' və " sız yazma məsələn:
$_SESSION[login] = $_POST[login];
Əslində isə
$_SESSION['login'];
$_POST['login'];

bax belə yazılmalıdır.

Əks halda Notice verə bilər bu da olacaq information disclosure.
Əksər vaxtları Production serverlərdə NOTİCE-lar supress edilir php.ini dən (server admin)
yenə də elə yazmaq məsləhət deyil.

Pass $ourPassword = "parolun"; açıq plaintext şəkildədir.Məsləhət deyil bu.
MD5() funksiyası istəsəniz SHA1(MD5($pass) . md5($salt))
metodları ilə edinki pass ələ keçməsin.

Ana VƏTƏN!
Anti-armenia.ORG
    

Istifadəçi
    2012-05-01 21:49 GMT                 

LocaL



Gold
Mesaj Sayı : 141
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   2  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər : Badu Kubə
Ölkə :
Məslək : ....
Yaş :
Mesaj :

Mövzunu Paylaş!


aha qaqa başa düşdüm. bəs indi aşağıda verdiyim nə dərəcədə doğrudur? bu aşağdakın işlətmək məsləhətlidir ya sənin düzəlişlərini edib yuxardakın?

Kod:
<?PHP
function GirisSifresi($login,$sifre) {
     if(empty($_SERVER['PHP_AUTH_USER']) || empty($_SERVER['PHP_AUTH_PW']) || $_SERVER['PHP_AUTH_USER'] != "$login" || $_SERVER['PHP_AUTH_PW'] != "$sifre")
     {
         header('WWW-Authenticate: Basic realm="Login ve Sifreni Yazib Giris Edin"');
         die(header('HTTP/1.0 401 Unauthorized'));
     }
}

//Giris Melumatlari
$login = 'localizm';
$sifre = '12345';

//Funksiya
GirisSifresi($login,$sifre);
?>

Çakıl taşlı yollar yordu beni, keşke yürüse yanımda bişr-i hafi...
Anti-armenia.ORG
    

Istifadəçi
    2012-05-01 22:43 GMT                 

BlackMinD



Pr0grammer
Mesaj Sayı : 1677
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   62  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər : KARABAKH IS AZERBAIJAN!
Ölkə :
Məslək :
Yaş :
Mesaj :

Mövzunu Paylaş!


Daha secure:


.htaccess

<Files admin.php>
AuthName "passi daxil et eks halda bilirsen neylemek lazimdir)"
AuthType Basic
AuthUserFile /home/saytin/public_html/.htpasswd
Require valid-user
</Files>


Bunu save elə .htaccess-ə



Sonra isə

http://www.htaccesstools.com/htpasswd-generator/

istifadə edərək username və pass yarat save elə .htpasswd faylına.
Və upload et saytına .
&& Enjoy)

Yadda saxla əsaski bu tipli protectionlar kənar girişin qarşısını alır amma CSRF tipli vulnlar varsa adminkada (istənilən CMS-ə aiddir bu)
və əgər adminkaya girmisənsə sonra isə forumda link,şəkil və s browse edirsənsə CSRF vura bilər səni problemsiz olaraq.
Məsələn elə bu yaxınlarda tapdığım adminkadakı SQL inj 170 -də yaxud uninstall plugins CSRF də bura daxildir.
Əsas çalışınki böyük privilegiyalı akkauntdan oturmayın.O halda risk azalmış olacaq.
İn eg:
http://packetstormsecurity.org/files/111814/Seditio-170-Cross-Site-Request-Forgery-SQL-Injection.html
http://packetstormsecurity.org/files/111684/Seditio-165-Cross-Site-Request-Forgery-Backup-Disclosure.html

və s.

Ana VƏTƏN!
Anti-armenia.ORG
    

Istifadəçi
    2012-05-01 23:07 GMT                 

LocaL



Gold
Mesaj Sayı : 141
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   2  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər : Badu Kubə
Ölkə :
Məslək : ....
Yaş :
Mesaj :

Mövzunu Paylaş!


aha qaqa təşəkkürlər. sənin verdiyin üsul əsas mövzuya əlavə olundu. və öz yazdığımı sildim )) çünki düzəliş etsəmdə özüm verdiyimə artıq sən verən sayta tətbiq olunubsa ona ehtiyac yoxdur ona görə. birdaha təşəkkür qaqa vaxtını ayırdığına görə.

Çakıl taşlı yollar yordu beni, keşke yürüse yanımda bişr-i hafi...
Anti-armenia.ORG
    

Istifadəçi
    2012-05-26 21:01 GMT                 

MetaizM



Gold
Mesaj Sayı : 175
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   5  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər :
Ölkə :
Məslək :
Yaş :
Mesaj :

Mövzunu Paylaş!


BlackMinD and Local Əla təşəkkürlər Step`in fikri ilədə razıyam yaxud admin paneldə csrf var
http://packetstormsecurity.org/files/111684/Seditio-165-Cross-Site-Request-Forgery-Backup-Disclosure.html
götürək bunu əgər burda GET zaprosdan gələn məlumata x=TOKEN atsa inaniramki CSRF fixlənər amma düşünülməyib.

DIPNOTeməli belə qısaca deyəcəmki seditionu uninstall ederem hostum`nan sözün əsl mənasında
seditio bu dəqiqə başdan ayağa vulnerabilities ilə doludur

Anti-armenia.ORG