Go Back   vb.org Archive > vBulletin Article Depository > Read An Article > vBulletin 3 Articles
Reload this Page Making your Admincp More secure!
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
Page 2 of 3 1 2 3
 
Thread Tools
Making your Admincp More secure!
iNRoC
Join Date: Jul 2008
Posts: 151

 

Clifton, New Jersey
Show Printable Version Email this Page Subscription
iNRoC iNRoC is offline 11-27-2008, 10:00 PM
Hi guys, over my relatively short time as an administrator of a few forums, I've learned a few "tricks" that will throw off some of the more "Noobish" people who have a desire to hack your forum. I figured I would go ahead and post them

Trick # 1:Rename your admincp folder

This is actually a surprisingly little known feature of vbulletin. Rename the admincp on your hosting space to anything else, the more random, the better. Open up your config.php inside the /includes/ folder, and find the line containing

PHP Code:
$config['Misc']['admincpdir'] = 
and change the variable stored there to the name of your directories new name. Basically, this will make it so anyone who doesn't know the exact location of your admincp, cant find it.

Trick #2: The Dummy Admin Panel

This one goes well with trick #1. Goto your admin panel's login screen,and go to your browsers File-> Save As page, and save the .php file to your HD. Now, open edit out the personal data in that admincp (look around the form data for "hidden" fields), and upload it to a directory on your server. Basically, the idea here is to make a non-functional admincp login page, to fool people into thinking they have the right URL when they really don't.

Trick #3: The IP Deny .htaccess

Now, this trick involve knowing all of your admin's IP addresses. If your administrators do not have "rotating" IP's, then you can use a simple .htaccess file to allow only you and your administrators IP ranges to access the admin panel. Quite an efficient way of safeguarding your admin panel

Trick #4: A Passworded .htaccess

If your admin's do have dynamic IP addresses, there is another .htaccess solution you can use, though this one is a little less secure. Simply create a .htaccess that requires a username and password, this give double password protection on the panel, making it harder to get it. The downside is, if someone gives out the password, its useless :/

Trick #5: The Multi Hash

Now this is one you'll have to figure out on your own, its a little bit tricky to pull off, and PHP/SQL knowledge is required. The current login system for all the users for vbulletin is a MD5 hash, which is encrypted in your sql database itself. Now, to login, the system takes your input, encrypts it, and compares it to the result in the database. When hackers use scripts/exploits to try and pull a password from your database, it comes out as a hash, which they then have to run a dictionary attack against(It takes forever to brute force a MD5 password) Now, a few webmasters have found ways to "multi-hash" the login script, so that it would be something like this user input ->hash ->hash -> hash -Compare result to db. This effectively hinders any hacker from getting your hash and decrypting it, as a dictionary attack would not work on it.

Trick #6 (Though not a trick at all): Picking your staff

Above all, probably the most important thing to ever remember. Don't be generous with giving Moderator/ Admin/ Cpanel/ FTP access. Unless the user is someone you can trust, and has at least a little experience, theres no reason to let anybody in any control panel.

Posted by an administrator by my site. Org post: http://onehitwebdev.com/forum/showthread.php?t=44
Reply With Quote
  #12  
Old 12-09-2008, 10:50 PM
iNRoC iNRoC is offline
 
Join Date: Jul 2008
Location: Clifton, New Jersey
Posts: 151
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Thanks Carlito for adding to this thread. I should have included all of that..
Reply With Quote
  #13  
Old 12-21-2008, 09:19 PM
haxcommunity haxcommunity is offline
 
Join Date: Jun 2008
Location: Virginia
Posts: 23
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Thanks for posting a guide I made everywhere >_<
Real Professional Man
Reply With Quote
  #14  
Old 12-23-2008, 11:04 PM
iNRoC iNRoC is offline
 
Join Date: Jul 2008
Location: Clifton, New Jersey
Posts: 151
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
I credited you though lol
Reply With Quote
  #15  
Old 12-24-2008, 03:15 PM
TheLastSuperman's Avatar
TheLastSuperman TheLastSuperman is offline
Senior Member
  
Join Date: Sep 2008
Location: North Carolina
Posts: 5,844
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by haxcommunity View Post
Thanks for posting a guide I made everywhere >_<
Real Professional Man
Quote:
Originally Posted by iNRoC View Post
I credited you though lol
The point is, both of you helped me so thanks!

S-MAN
Reply With Quote
  #16  
Old 02-09-2009, 06:46 AM
ehabfouad22 ehabfouad22 is offline
 
Join Date: Oct 2007
Posts: 22
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by iNRoC View Post
Trick #2: The Dummy Admin Panel

This one goes well with trick #1. Goto your admin panel's login screen,and go to your browsers File-> Save As page, and save the .php file to your HD. Now, open edit out the personal data in that admincp (look around the form data for "hidden" fields), and upload it to a directory on your server. Basically, the idea here is to make a non-functional admincp login page, to fool people into thinking they have the right URL when they really don't.
Hi guys,
Any further details on how to perform that trick? (#2)
After saving the php file as complete webpage, what should be editted and uploaded?
Many thanks!
:up:
Reply With Quote
  #17  
Old 02-18-2009, 06:53 PM
bc641990 bc641990 is offline
 
Join Date: Apr 2007
Posts: 59
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
lol most of the ideas in this were from me inroc :-/ unbelieveable
Reply With Quote
  #18  
Old 06-17-2009, 01:47 AM
mme42 mme42 is offline
 
Join Date: Feb 2009
Posts: 101
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by iNRoC View Post
Trick #2: The Dummy Admin Panel

This one goes well with trick #1. Goto your admin panel's login screen,and go to your browsers File-> Save As page, and save the .php file to your HD. Now, open edit out the personal data in that admincp (look around the form data for "hidden" fields), and upload it to a directory on your server. Basically, the idea here is to make a non-functional admincp login page, to fool people into thinking they have the right URL when they really don't.
A few questions. First, exactly what personal data would be edited out? This is going to be an html file then, not php? And, is the idea to use this page as your listed admincp page in the config.php? Or do you have the real ACP in the newly renamed directory in the config and put the fake page in the /admincp folder in case somebody navigates directly to that path?

Quote:
Originally Posted by jca2112 View Post
For example, a Fake Admin Login page that writes the IP addresses of login attempts to a file and/or email sent to the admin? That would make it easy to be alerted to login attempts and make it easy to ban users/IPs/etc. that go snooping for the Admin Panel.
Quote:
Originally Posted by iNRoC View Post
Ill make you a page for it soon.
It would be helpful if anybody could do this.

Thanks
Reply With Quote
  #19  
Old 10-26-2009, 12:36 PM
Barteh Barteh is offline
 
Join Date: Aug 2006
Posts: 113
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Slight bump. There's a simpler way to confuse bots, just add empty admincp and modcp dirs, then copy a .htaccess file to both that contains a single line:
Code:
deny from all
Alternatively you could provide access to this (empty) dir with .htpasswd and an extremely long and completely random username and password, which they're of course quite welcome to try to bruteforce

All of this assuming you've moved your *real* admincp and modcp dirs of course.
Reply With Quote
  #20  
Old 01-09-2010, 06:47 AM
lycheepassion lycheepassion is offline
 
Join Date: Aug 2009
Posts: 224
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by jca2112 View Post
The Dummy Admin Panel seems like a really good idea.

Has anyone made a mod/hack/script along these lines?

For example, a Fake Admin Login page that writes the IP addresses of login attempts to a file and/or email sent to the admin? That would make it easy to be alerted to login attempts and make it easy to ban users/IPs/etc. that go snooping for the Admin Panel.

Unfortunately that very same idea is essentially an exploit -- it could be used to do harm to the real vBulletin admin. Redirecting legitimate login attempts to the Fake Admin Login page in order to capture REAL username and passwords.

Is there something like this available that also couldn't be used to do evil things?


I really dont get how to do the dummy admin panel, maybe im just a dummy? Any help
Reply With Quote
  #21  
Old 11-27-2010, 11:14 PM
kootta kootta is offline
 
Join Date: May 2009
Posts: 19
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
that's so nice informative post keep it up
Reply With Quote
Reply
Page 2 of 3 1 2 3

« Previous Thread | Next Thread »
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT. The time now is 09:29 AM.

Contact Us - Archive - Top

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2024, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.07013 seconds
  • Memory Usage 2,311KB
  • Queries Executed 25 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (1)bbcode_code
  • (1)bbcode_php
  • (7)bbcode_quote
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)modsystem_article
  • (1)navbar
  • (4)navbar_link
  • (120)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (2)pagenav_pagelink
  • (11)post_thanks_box
  • (2)post_thanks_box_bit
  • (11)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (1)post_thanks_postbit
  • (11)post_thanks_postbit_info
  • (10)postbit
  • (11)postbit_onlinestatus
  • (11)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 
Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • fetch_musername
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • post_thanks_function_fetch_thanks_bit_start
  • post_thanks_function_show_thanks_date_start
  • post_thanks_function_show_thanks_date_end
  • post_thanks_function_fetch_thanks_bit_end
  • post_thanks_function_fetch_post_thanks_template_start
  • post_thanks_function_fetch_post_thanks_template_end
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • pagenav_page
  • pagenav_complete
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete