Forum Moderators: phranque

Message Too Old, No Replies

Guestbook Exploitation Through CGI Script

Guestbook Exploitation

         

ssvl

7:43 pm on Oct 23, 2006 (gmt 0)

10+ Year Member



I have had a simple guestbook in place on my (tourism) web site for a few years now. About two weeks ago, the guestbook has been exploited by person(s) unknown with random and regular entries being made containing pharmaceutical product names in names, email addresses and message contents. The logged IP addresses change continuously and an IP trace shows them coming from places as diverse as China, Taiwan, Argentina, Poland, etc. - I presume these are not genuine. My question is to anyone who has experienced similar - is this being done 'automatically' directly through the CGI script or is it done via the guestbook web page itself (the speed at which entries are made point toward an automated process)? More importantly, how can one be rid of this exploitation or secure up the script?

Here is an example entry :

Name : <option value= buy keyterm
E-Mail : spamterm@spamterm.com
City : Ohio
Country : Virgin Is. - British
How Found : Web Search Engine
Lodge Visited : Yes

Message : <removed urls>

Any assitance would be greatly appreciated. Thanks.

[edited by: jatar_k at 6:55 am (utc) on Oct. 24, 2006]
[edit reason] removed specifics [/edit]

trillianjedi

10:24 am on Oct 24, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



how can one be rid of this exploitation or secure up the script?

It's almost certainly an automated process, so have you considered using a CAPTCHA?

TJ

ssvl

7:54 pm on Oct 24, 2006 (gmt 0)

10+ Year Member



Hi TJ

Please bear with me - I'm no fundi with these things and the CGI script exploitation on the server. Please give me more info or let me have a procedure to follow.

Is there software to monitor or "catch" this auto-bots?

Thanks for any help.

physics

6:07 am on Oct 25, 2006 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Hi ssvl, welcome to WebmasterWorld.com!

There is some discussion of this here:
How to block a spam bot with changing IP address [webmasterworld.com]

A captcha is an image that you display to the user so the user has to read and enter what's in the image... this in general makes it hard for 'spam bots' to submit your form.

Some of the other suggestions in that thread, such as checking HTTP_REFERER are pretty good also. None of these ideas are foolproof but they might help.

You might also consider 'locking down' (not accepting new posts) on your current guest book program, link to it as the guest book archive, and start using a newer program that implements some sort of spam prevention ... this way you don't have to do any coding and the spam will stop or slow down. Or there might even be an upgrade for your current guest book script that includes some spam-blocking features.