miz
04-15-2004, 10:00 PM
ok , this is the first hack i post around here so i hope im doing it ok
if not mods please fix me :P
ok, this hack is ment for closed comunity of vbulltien forums that want exstra security against unwelcome guests
this hack adds HTTP Authentication which change acording to username / password
to make the security bit higher i added ip ranges part - mean every users got ip range and if his ip is not wellcome then its not let him in
(can help abit against shared account).
ok so lets start
// run this db query
ALTER TABLE user ADD ipmasks varchar(250) NOT NULL default '';
// open the file admincp/user.php
find :
print_input_row($vbphrase['email'], 'user[email]', $user['email'], 0);
below it add :
print_input_row('ip masks', 'user[ipmasks]', $user['ipmasks'], 0);
save the file and upload it back to your server
ok, now u got 2 options :
option1 - put it only in root dir
option2 - put itin root and on admincp/modcp dir
ok
if option 1 then
// open root/global.php
find :
require_once('./includes/init.php');
Below it add :
//HTACCESS Hack + IP restriction
if (!isset($_SERVER['PHP_AUTH_USER'])) {
header('WWW-Authenticate: Basic realm="Restricted area"');
header("HTTP/1.0 401 Unauthorized");
echo "Unauthorized login attempts are logged.\n";
echo "bla";
exit;
} else {
//checking database
$userinf=$DB_site->query_first("SELECT user.password,user.userid,user.salt FROM user WHERE username='$_SERVER[PHP_AUTH_USER]'");
$isvalidip=0;
if($userinf['userid']){
// if user exists check if ip is valid $REMOTE_ADDR
$validip=$DB_site->query_first("SELECT ipmasks FROM user WHERE userid='$userinf[userid]'");
$validip=explode(" ",$validip['ipmasks']);
foreach($validip as $testip){
if ($testip=='') { continue; }
if (strstr($REMOTE_ADDR,$testip)==$REMOTE_ADDR || stristr(gethostbyaddr($REMOTE_ADDR),$testip)==$tes tip){
$isvalidip=1;
break;
}
}
}
//checking if the user login is ok & that he connects from a valid ip
$salt = $userinf['salt'];
$pass = $userinf['password'];
$userp = md5(md5($_SERVER['PHP_AUTH_PW']) . $salt);
if ($pass != $userp) {
//we have a looser:)
header('WWW-Authenticate: Basic realm="Restricted area"');
header('HTTP/1.0 401 Unauthorized');
echo "Unauthorized login attempts are logged.\n";
exit;
}elseif(!$isvalidip){
header('HTTP/1.0 401 Unauthorized');
echo "Your Ip is not allowed here...Unauthorized login attempts are logged.\n";
exit;
}
}
//HTACCESS Hack + IP restriction (end)
save the file and upload it back to your server
now if u want option 2 then :
open includes/init.php
find :
$DB_site->connect($servername, $dbusername, $dbpassword, $usepconnect);
Below it add :
//HTACCESS Hack + IP restriction
if (!isset($_SERVER['PHP_AUTH_USER'])) {
header('WWW-Authenticate: Basic realm="Restricted area"');
header("HTTP/1.0 401 Unauthorized");
echo "Unauthorized login attempts are logged.\n";
echo "bla";
exit;
} else {
//checking database
$userinf=$DB_site->query_first("SELECT user.password,user.userid,user.salt FROM user WHERE username='$_SERVER[PHP_AUTH_USER]'");
$isvalidip=0;
if($userinf['userid']){
// if user exists check if ip is valid $REMOTE_ADDR
$validip=$DB_site->query_first("SELECT ipmasks FROM user WHERE userid='$userinf[userid]'");
$validip=explode(" ",$validip['ipmasks']);
foreach($validip as $testip){
if ($testip=='') { continue; }
if (strstr($REMOTE_ADDR,$testip)==$REMOTE_ADDR || stristr(gethostbyaddr($REMOTE_ADDR),$testip)==$tes tip){
$isvalidip=1;
break;
}
}
}
//checking if the user login is ok & that he connects from a valid ip
$salt = $userinf['salt'];
$pass = $userinf['password'];
$userp = md5(md5($_SERVER['PHP_AUTH_PW']) . $salt);
if ($pass != $userp) {
//we have a looser:)
header('WWW-Authenticate: Basic realm="Restricted area"');
header('HTTP/1.0 401 Unauthorized');
echo "Unauthorized login attempts are logged.\n";
exit;
}elseif(!$isvalidip){
header('HTTP/1.0 401 Unauthorized');
echo "Your Ip is not allowed here...Unauthorized login attempts are logged.\n";
exit;
}
}
//HTACCESS Hack + IP restriction (end)
thats all
*WARNING - IN ANY WAY DONT USE BOTH OPTIONS
its will cuse to the page ask for several time the user/pass
and its will be very buggy.
note :
if user got dynamic ips for exsample :
143.229.64.58
143.229.78.99
145.88.45.68
just add it like that
143.229 145.88
with 1 space between each ip range
dont user * as wildcard.
thats all :P
if u got some qustions or anything , then im here to suport u guys.
Sorry for my very bad english.
if not mods please fix me :P
ok, this hack is ment for closed comunity of vbulltien forums that want exstra security against unwelcome guests
this hack adds HTTP Authentication which change acording to username / password
to make the security bit higher i added ip ranges part - mean every users got ip range and if his ip is not wellcome then its not let him in
(can help abit against shared account).
ok so lets start
// run this db query
ALTER TABLE user ADD ipmasks varchar(250) NOT NULL default '';
// open the file admincp/user.php
find :
print_input_row($vbphrase['email'], 'user[email]', $user['email'], 0);
below it add :
print_input_row('ip masks', 'user[ipmasks]', $user['ipmasks'], 0);
save the file and upload it back to your server
ok, now u got 2 options :
option1 - put it only in root dir
option2 - put itin root and on admincp/modcp dir
ok
if option 1 then
// open root/global.php
find :
require_once('./includes/init.php');
Below it add :
//HTACCESS Hack + IP restriction
if (!isset($_SERVER['PHP_AUTH_USER'])) {
header('WWW-Authenticate: Basic realm="Restricted area"');
header("HTTP/1.0 401 Unauthorized");
echo "Unauthorized login attempts are logged.\n";
echo "bla";
exit;
} else {
//checking database
$userinf=$DB_site->query_first("SELECT user.password,user.userid,user.salt FROM user WHERE username='$_SERVER[PHP_AUTH_USER]'");
$isvalidip=0;
if($userinf['userid']){
// if user exists check if ip is valid $REMOTE_ADDR
$validip=$DB_site->query_first("SELECT ipmasks FROM user WHERE userid='$userinf[userid]'");
$validip=explode(" ",$validip['ipmasks']);
foreach($validip as $testip){
if ($testip=='') { continue; }
if (strstr($REMOTE_ADDR,$testip)==$REMOTE_ADDR || stristr(gethostbyaddr($REMOTE_ADDR),$testip)==$tes tip){
$isvalidip=1;
break;
}
}
}
//checking if the user login is ok & that he connects from a valid ip
$salt = $userinf['salt'];
$pass = $userinf['password'];
$userp = md5(md5($_SERVER['PHP_AUTH_PW']) . $salt);
if ($pass != $userp) {
//we have a looser:)
header('WWW-Authenticate: Basic realm="Restricted area"');
header('HTTP/1.0 401 Unauthorized');
echo "Unauthorized login attempts are logged.\n";
exit;
}elseif(!$isvalidip){
header('HTTP/1.0 401 Unauthorized');
echo "Your Ip is not allowed here...Unauthorized login attempts are logged.\n";
exit;
}
}
//HTACCESS Hack + IP restriction (end)
save the file and upload it back to your server
now if u want option 2 then :
open includes/init.php
find :
$DB_site->connect($servername, $dbusername, $dbpassword, $usepconnect);
Below it add :
//HTACCESS Hack + IP restriction
if (!isset($_SERVER['PHP_AUTH_USER'])) {
header('WWW-Authenticate: Basic realm="Restricted area"');
header("HTTP/1.0 401 Unauthorized");
echo "Unauthorized login attempts are logged.\n";
echo "bla";
exit;
} else {
//checking database
$userinf=$DB_site->query_first("SELECT user.password,user.userid,user.salt FROM user WHERE username='$_SERVER[PHP_AUTH_USER]'");
$isvalidip=0;
if($userinf['userid']){
// if user exists check if ip is valid $REMOTE_ADDR
$validip=$DB_site->query_first("SELECT ipmasks FROM user WHERE userid='$userinf[userid]'");
$validip=explode(" ",$validip['ipmasks']);
foreach($validip as $testip){
if ($testip=='') { continue; }
if (strstr($REMOTE_ADDR,$testip)==$REMOTE_ADDR || stristr(gethostbyaddr($REMOTE_ADDR),$testip)==$tes tip){
$isvalidip=1;
break;
}
}
}
//checking if the user login is ok & that he connects from a valid ip
$salt = $userinf['salt'];
$pass = $userinf['password'];
$userp = md5(md5($_SERVER['PHP_AUTH_PW']) . $salt);
if ($pass != $userp) {
//we have a looser:)
header('WWW-Authenticate: Basic realm="Restricted area"');
header('HTTP/1.0 401 Unauthorized');
echo "Unauthorized login attempts are logged.\n";
exit;
}elseif(!$isvalidip){
header('HTTP/1.0 401 Unauthorized');
echo "Your Ip is not allowed here...Unauthorized login attempts are logged.\n";
exit;
}
}
//HTACCESS Hack + IP restriction (end)
thats all
*WARNING - IN ANY WAY DONT USE BOTH OPTIONS
its will cuse to the page ask for several time the user/pass
and its will be very buggy.
note :
if user got dynamic ips for exsample :
143.229.64.58
143.229.78.99
145.88.45.68
just add it like that
143.229 145.88
with 1 space between each ip range
dont user * as wildcard.
thats all :P
if u got some qustions or anything , then im here to suport u guys.
Sorry for my very bad english.