Error: False Script Attack Using Google Search Block

New Member Joined: Apr 17, 2006 Posts: 19

Hi Everyone:

I own a rather large and popular forum and get about 20 attacks a day.

The rarest and most important one to me is always a script attack.

I must say, NukeSentinel is great. I would not have a site right now without it.

However, today I installed a Google site search block. I had it coded to return the results onsite, a new feature from Google by using an iframe on the results page.

But within minutes, I recieved a script attack from it, here is the string:
(I removed the users IP from the string:)

Code:

Date &amp; Time: 2007-02-06 13:40:59 EST GMT -0500 Blocked IP: REMOVED User ID: Anonymous (1)


Reason: Abuse-Script


--------------------


User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322; InfoPath.1) Query String: [ Only registered users can see links on this board! Get registered or login! ]


Get String: [ Only registered users can see links on this board! Get registered or login! ] is not receiving calls\" &sitesearch=vonage-forum.com&sa=Google Search&client=pub-9384837557811734&forid=1&channel=4538040223&ie=ISO-8859-1&oe=ISO-8859-1&flav=0001&sig=83V_cJGVnc5JtshI&cof=GALT:#008000;GL:1;DIV:#336699;VLC:663399;AH:center;BGC:FFFFFF;LBGC:336699;ALC:0000FF;LC:0000FF;T:000000;GFNT:0000FF;GIMP:0000FF;FORID:11&hl=en


Post String: [ Only registered users can see links on this board! Get registered or login! ]


Forwarded For: none


Client IP: none


Remote Address: REMOVED


Remote Port: 37866


Request Method: GET

Any ideas what is causeing this?

Thank you,

Dan

Posted: Tue Feb 06, 2007 10:31 pm

Perhaps there's a way to pass variables using POST instead of GET? That may allow it to pass through the Sentinel filters

Posted: Tue Feb 06, 2007 10:43 pm

evaders99 wrote:

Perhaps there's a way to pass variables using POST instead of GET? That may allow it to pass through the Sentinel filters

Thank you my old freind Smile

We are looking into it right now, I will post you an update.

BTW, the track referer and track agent is wonderful!

Dan