NukeSentinal blocks "none...*" - blocking admins

deadl0ck · Hangin' Around Joined: Apr 09, 2006 Posts: 44

Hi all,
One of the admins on my site keeps getting blocked.

Here's the details that NukeSentinal is reporting:

Code:

Blocked IP: none...*
User: Anonymous
Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Blocked on: 2007-01-23 05:10:46
Notes: Added by NukeSentinel(tm)
Reason: Abuse-Union

Query String:
Get String:
Post String:
Forwarded For: none
Client IP: none
Remote Address: 190.38.180.203
Remote Port: 2612
Request Method: GET

Query String:

Code:

Query String:

Only registered users can see links on this board!
Get registered or login to the forums!

query=& query=loquesea&instory=/* */UNION/* */SELECT/* */0,0,pwd,0,aid/* */FROM/* */nuke_authors

Get String:

Code:

Get String:

Only registered users can see links on this board!
Get registered or login to the forums!

*/UNION/* */SELECT/* */0,0,pwd,0,aid/* */FROM/* */nuke_authors

Post String:

Code:

Post String:

Only registered users can see links on this board!
Get registered or login to the forums!

Any ideas as to why this keeps happening ?

montego · Posted: Tue Jan 23, 2007 7:28 am

If this IP address is truelly that of your admin, then why is he/she attempting to use a UNION attack on your site to show him/her all your admin usernames and passwords?

deadl0ck · Hangin' Around Joined: Apr 09, 2006 Posts: 44

I doubt it's my admin - but I think the "none...*" IP address is blockig him from getting to the site

What is "none...*" ?

evaders99 · Posted: Wed Jan 24, 2007 12:42 am

I'm not sure why it says "none", esp since it is recording an IP under Remote Address
190.38.180.203

What version of Sentinel are you using?

deadl0ck · Hangin' Around Joined: Apr 09, 2006 Posts: 44

AT the top of the NS Admin PAGE I see:

NukeSentinel(tm) 2.4.2pl3

I assume that's the version ?

Guardian2003 · Posted: Wed Jan 24, 2007 3:24 am

You really need to update to the latest version but regardless of that, if that is the IP of your admin (you can cross reference his IP easily enough as its listed in his forum posts - its next to the quote / edit / delete buttons) that string does indicate he was attempting a union attack on your site.

The 'blocked ip= ' might be because the IP is protected - thats purely a guess as I dont have a copy of that specific version of Sentinel to check the code.

deadl0ck · Hangin' Around Joined: Apr 09, 2006 Posts: 44

He's posted from a few different IPs over a period of time, but the one listed above isn'tan address he's ever posted from - the vast majority of his posts are from the same IP.

What verision should I upgrade to ? The latest ?

Guardian2003 · Posted: Wed Jan 24, 2007 3:52 am

Yes you should upgrade to the latest version.
If the IP address in the Sentinel email is not one your user has posted from AND given the fact that the user is listed as 'anonymous' (not logged in) I would be even more included to suspect the user was not an admin.