vBFirewall v1.0
 

This is my first mod for vBulletin and I have tried to make it as better as I could.

Click Install If You Use it!!

What is vBFirewall?
Its a PHP script which blocks all kinds of attacks on your vBulletin Forum! Like: URL Poisoning, Remote File Inclusion, SQL Injection, XSS and other kinds of attacks.

I have tested each and every function of this mod before releasing it and have used it myself for 1 month

It has a attacker logger, which logs the IP and many details of the attacker so that you can reach him :)

This is still in beta version and I will add more features in it to make your vBulletin more secure :D Suggestions are always welcome.


How to install?

1) Go to Admin and Import the xml file product-firewall_vb_rs.xml using the plugin manager.
2) Keep an eye on the log file which can be found here: www.yourvbforumurl.com/logfile_worms.txt (This file will only be created when a attack occour)
3) Your website is now secure from hackers :)



Thanks

Reserved For Future! :)

Thanks for this mod ;)
I sent you a pm last week :'(

Replied, Sorry for late reply..:cool:

does this really work?

Do you will phrase the mail for a next version?

Yea, test yourself :P

Yes, within a day or two I will add more features.

OK, so I wait ;)

Guys, Test it and lemme know if you have any suggestion for future version :)

Sounds very interesting, different and a real asset to have! I'll wait and see how this goes... :)

Great man.. I will test

I was hacked more or less 10 times this year... NOW LET MET TRY THIS.

Thank you so much in advanced.

Aprrciated Thankyou :up:

My path of the Forum www.7lanet.com/vb
Do I make file logfile_worms.txt in the folder of (vb)
Do give file logfile_worms.txt the license logfile_worms.txt 666

works for 3.7 too :confused: ?

Looks very interesting. Gonna keep an eye on this one :D

*tagged*

Looks nice, I´ll wait for the phrased version though.

sound very good ... does it work on 3.6.8?

does this work with 3.7?
will this slow down server or forum?

X2 Im using 3.7.2 SP2

When a attack occours it will be created itself.

All Versions

Yes, all versions

Yes, and it doesnt slow down the forum

OK i get a error when click to check subscriptions:

PM me the plugin you are using, I will check it out

Check subscriptions errors for me as well.

I do not understand what this log to say, please help me to understand it:

i tried that hack and support it , in the past ,,,,,,,,,,

https://vborg.vbsupport.ru/showthread.php?t=110030


P.S Befor secureing your Vbulletin you need to know on What SErVer you are running your fourm or scripts ,

coz what ever your old vbulletin where haveing some security holes ,,,, the server security will prevent all the attempt what ever it was .,

So this hack just filters query input through an array of known hacker attacks phrases. How can you be sure your array is complete or that "attack" isn't a legitimate request? I don't see any checks, just a blanket replace ?

vbulletin might not need this but I need this in my other mods which may or might be attacked by hackers

Nominated for MOTM.

Thanks,
Do I need change CHMOD 777 of Root Directory?

I have also the mistake with the subscriptions... please correct it ! :(

Mark as installed :)

In the next release these problems will be solved. :)

Thanks I will install on my test forum

looks good. nominated

Ownage! Thanks mate
This deserves a Exelent rating and a MOTM Nomination :)

I'm so scared of being hacked

Wow this is a great mod for vBulletin my defense manager will be very please with this addition. Will begin testing immediately with my defense manager.

Thanks and nominated for MOTM

Any ETA on the next release invisiblea?

Good mod, fantastic idea, however the subscription issue is something of a show stopper. So I decided to look into it.

The reason the "firewall" kicks in on the subscription page is that one of the security rules is 'script', and quiet rightly so. However due to the checking method used, the firewall kicks in when it sees:

do=viewsubscription

Notice the bold/underlined part

The good news is that this can be resolved, but it is a hack to the mod. The following instructions explain what needs to be done, if you want to implement it then I strongly recommend first testing it on an test server. Hopefully this will help the mod dev makes this mod one of the best available here:

Right, you need to goto:

ACP -> Plugins & Products -> Plugin Manager

Once there look for the entries for "Product : vBFirewall", this should only have one plugin called 'vBFirewall' which uses the 'init_startup' plugin. Click edit

Copy all the text in 'Plugin PHP Code' into notepad.

Now follow these steps:

• Find the line that reads:
  
  
  Code:

  ---

  'st=-', 'cat%20', 'include', '_path=');

  ---

• On a new line immediately after this paste in:
  
  
  Code:

  ---

  $securityexclusions = array(
        'do=viewsubscription'
);

  ---

• Find the line that reads:
  
  
  Code:

  ---

  $cracker = strtolower($cracker);

  ---

• On a new line immediately after this paste in:
  
  
  Code:

  ---

  $cracker= str_replace($securityexclusions, '', $cracker);

  ---

Once done, copy all the edited text in notepad back into the 'Plugin PHP Code' in ACP, then click save

What this is actually doing is creating an extendible security rule exclusion list, so if any other VB queries string invoke the vbFirewall you can add another exclusion.

IMPORTANT : I have only run this on a basic test server I have, do not try this unless you are absolutely comfortable with plugins/php etc.

A here are some suggestions for the next version:

• Rather than add the logs to a flat file on the server store this in the DB and then create an ACP page to view/search/manage logs
• Add option to send a PM or Email or both
• If a specific IP invokes the firewall more than X times in Y seconds/minutes auto place this IP on the vBulletin ban list.
• If a specific IP can be associated to an actual forum user account auto ban that user.

One other teeny weeny little thing, you need to mention that this is based on the GPL licensed code found here : http://www.cback.de/cback_software/standalonect.php ;)

EDIT: Later in this thread I have posted an additional fix for vbAnonymizer users

Those suggestions are great especially the auto ban and the view in the admin panel. Hope he adds them and checks those exceptions out.