-
☆ A M B ☆
- 24,524 Posts
Just a note that my server logs show that my site is getting hammered by what appear to be botnet attacks trying to access /assets/snippets/reflect/snippet.reflect.php.
This file was the PHP code to be copy/pasted into the Manager when creating the snippet manually. It has not been included with the MODx installation for several years; it appears in version 0.9.6.2, but not in 0.9.6.3. So if you’re still running such an old version of MODx, or have installed the Reflect snippet manually, you might want to check the folder and delete the file if it’s there.
The attacks occur fairly randomly, from too many different IP addresses to try to blacklist, usually with a few attempts by any single IP address, with at least 80 attempts in 24 hours.
Someone, I don’t remember who, suggested putting this in .htaccess to reject the bots that are still looking for it:
RewriteCond %{QUERY_STRING} snippet\.reflect\.php [NC,OR]
RewriteCond %{QUERY_STRING} reflect_base [NC,OR]
RewriteCond %{QUERY_STRING} (.*)(http|https|ftp):\/\/(.*) [NC]
RewriteCond %{HTTP_USER_AGENT} ^libwww-perl [NC]
RewriteRule .* - [F,L]
-
☆ A M B ☆
- 24,524 Posts
A similar block in .htaccess was where the error log messages were coming from. This one looks like a better one.
This is an old thread, but I recently noticed that the code doesn't work for me. This code works great on my local machine (403 error), but not on the remote Apache server.
RewriteEngine On
RewriteBase /
RewriteCond %{QUERY_STRING} reflect
RewriteRule .* - [F,L]
I find that my sites are constantly hammered by people looking for the reflect snippet in various forms. This would stop them before they get in, but I have yet to find anything that works. But then, I'm still a newbie when it comes to rewrite rules.
Any tips appreciated.
BTW, Make sure that you have no URL on your site containing the word "reflect" before trying this.
-
☆ A M B ☆
- 24,524 Posts
You could also simply add a deny block to the entire Reflect folder; this allows internal PHP inclusion of the files but denies any external HTTP requests for it.
To deny all requests for the restricted directory or folder, prepare a .htaccess text file in that directory and put the following directive in it:
deny from all
People are looking for reflect.php reflect.snippet.php, reflect_base, and a number of other variations in lots of different directories (many of which don't exist). It's amazing how many bots are doing this every day on any site that contains the word 'modx."
That's why I want to send them a 403 in any case where the word reflect is in the URL. AFAIK, the code above is correct (and works fine on my localhost install) -- it just doesn't work at BlueHost. I've also tried these with no success:
RewriteCond %{REQUEST_FILE} reflect
RewriteCond %{REQUEST_URI} reflect
I know .htaccess is being processed normally because this rule works fine:
RewriteRule ^MODx.html$ modx.html
I asked BlueHost support about it and their response was "We do not really support how to code the .htaccess file" (thanks a lot).
[ed. note: BobRay last edited this post 14 years, 11 months ago.]
