Re: Blocking form spam

This WebDNA talk-list message is from

2006

It keeps the original formatting. numero = 67925
interpreted = N
texte = Stuart,My problem was determining what characters to grep for and be confidentthat I am catching the attempts to push email through my forms.Just to be clear there are two things happening to my forms:-1. Contact Form Spam / Comment SpamThis is where a spammer is sending loads of links through the formhoping (I assume) that it may show up on a live web page (like a blog orguestbook) and help their google rating. What I have done here is checkfor the string 'http://' in fields where it is not appropriate and thenblock the form from sending if any are present. Where the field maycontain a link (like a comment textarea) then I count the number oflinks and block if more than say five links or more are in the field.Links : [listwords words=3D[grep search=3D[url]http://[/url]&replace=3D =|][COMMENT][/grep]&delimiters=3D|][text]links=3D[index][/text][/listwords]=[links]2. Email Injection SpamThis is more worrying and is where a spammer tries to hijack a form anduse it as an SMTP proxy to send spam.(http://www.securephpwiki.com/index.php/Email_Injection) They do thisby putting strings like the following into form fields:-sender@anonymous.www%0ACc:recipient@someothersite.xxx%0ABcc:somebloke@grrrr.xxx,someotherbloke@oooops.xxxIf the data from this field is passed on anywhere within a [sendmail]context then the third party will get an email. The headers can bemessed around with more to fully hijack the form. After trial and errorI have found the following grep seems to work:[grep search=3D(%250A|%250D|[cC][cC])&replace=3D][formfield][/grep]It removes linefeeds, carriage returns, and 'Cc' (also effectivelycatching 'Bcc')Sorry if I seem to be going on too much about this but I found a coupleof my forms were exposed and it scared the crap out of me. I haven'tcome across anything in the docs or on this list yet which highlightsthat variables have to be checked and cleaned before being included in asendmail context. Maybe its obvious that this should be done but I hadmissed it nonetheless.- Tom-------------------------------------------------------------This message is sent to you because you are subscribed to the mailing list .To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://webdna.smithmicro.com/ Associated Messages, from the most recent to the oldest:

Re: Blocking form spam ( Stuart Tremain 2006)
Re: Blocking form spam ( Terry Wilson 2006)
Re: Blocking form spam ( Stuart Tremain 2006)
Re: Blocking form spam ( "Tom Duke" 2006)
Re: Blocking form spam ( Stuart Tremain 2006)
Re: Blocking form spam ( WJ Starck 2006)
Re: Blocking form spam ( Gary Krockover 2006)
Re: Blocking form spam ( Donovan Brooke 2006)
Re: Blocking form spam ( "Brian B. Burton" 2006)
Re: Blocking form spam ( WJ Starck 2006)
Re: Blocking form spam ( Terry Wilson 2006)
Re: Blocking form spam ( Stuart Tremain 2006)
Blocking form spam ( "Tom Duke" 2006)

Stuart,My problem was determining what characters to grep for and be confidentthat I am catching the attempts to push email through my forms.Just to be clear there are two things happening to my forms:-1. Contact Form Spam / Comment SpamThis is where a spammer is sending loads of links through the formhoping (I assume) that it may show up on a live web page (like a blog orguestbook) and help their google rating. What I have done here is checkfor the string 'http://' in fields where it is not appropriate and thenblock the form from sending if any are present. Where the field maycontain a link (like a comment textarea) then I count the number oflinks and block if more than say five links or more are in the field.Links : [listwords words=3D[grep search=3D[url]http://[/url]&replace=3D =|][COMMENT][/grep]&delimiters=3D|][text]links=3D[index][/text][/listwords]=[links]2. Email Injection SpamThis is more worrying and is where a spammer tries to hijack a form anduse it as an SMTP proxy to send spam.(http://www.securephpwiki.com/index.php/Email_Injection) They do thisby putting strings like the following into form fields:-sender@anonymous.www%0ACc:recipient@someothersite.xxx%0ABcc:somebloke@grrrr.xxx,someotherbloke@oooops.xxxIf the data from this field is passed on anywhere within a [sendmail]context then the third party will get an email. The headers can bemessed around with more to fully hijack the form. After trial and errorI have found the following grep seems to work:[grep search=3D(%250A|%250D|[cC][cC])&replace=3D][formfield][/grep]It removes linefeeds, carriage returns, and 'Cc' (also effectivelycatching 'Bcc')Sorry if I seem to be going on too much about this but I found a coupleof my forms were exposed and it scared the crap out of me. I haven'tcome across anything in the docs or on this list yet which highlightsthat variables have to be checked and cleaned before being included in asendmail context. Maybe its obvious that this should be done but I hadmissed it nonetheless.- Tom-------------------------------------------------------------This message is sent to you because you are subscribed to the mailing list .To unsubscribe, E-mail to: To switch to the DIGEST mode, E-mail to Web Archive of this list is at: http://webdna.smithmicro.com/ "Tom Duke"

DOWNLOAD WEBDNA NOW!

Re: Blocking form spam

2006

Top Articles:

Related Readings: