vBulletin LTS

← Back to Management Articles

Preventing Hacking/DDoS Attempts
by iHatton 15 Aug 2009
Rating: (2 votes - 5.00 average)
This guide is copyrighted to Jordan from GFXield.com

This is my first guide, so if you think I am missing anything please don't hesitate to contact me, either by Private Message or replying to this thread.

Introduction
For many years, vBulletin owners have worried about hacking/ddos attempts to their forum. Many have not known what to do, while advanced vBulletin owners have taken a swift action to remove them. This guide is for those who do not know what to do, as I have seen many threads recently about this.
I have recently overcame a ddos attempt, and for me this was not an experience I would like to remember, especially after having my forum open only 2 days. Below, I will explain what hacking/ddosing is, and then explain how to prevent them or stop them if they occur.

Hacking
This is what owners are particularly worried about. Whether it be SQL Injection, brute forcing attempts, port scanning & spoofing, phishing or ransomware, all vBulletin owners will experience this at an early point. You may not even know what some of them are, but even if you dont, it is still something to overcome before actually experiencing it.
Quick note, some people thought that brute forcing a vBulletin account is impossible, we actually, it isn't. They can easily acquire some of the data by just signing up, as navigation around the forum (without vBSEO) will show them links they need etc.

Denial of Service attacks (ddos)
Quote by Wikipedia
A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer resource unavailable to its intended users. Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of the concerted efforts of a person or people to prevent an Internet site or service from functioning efficiently or at all, temporarily or indefinitely. Perpetrators of DoS attacks typically target sites or services hosted on high-profile web servers such as banks, credit card payment gateways, and even root name servers.
Unfortunately, this is what I experienced within my first 2 days of opening.

Now, I'm not saying it is this, but this is my theory. When you post your website in the vBulletin.org section where people review your website, these sites posted here are the priority targets for some. This is because they would be easier to take down, as because your new to the vBulletin world, they may think you have a crappy hosting site. Mine personally is One.com, and with unlimited bandwidth and the help of their support, I overcame this ddos attack on my forum within 10 hours. For most, it would last a few days at least.

So, how do I protect my forum?
Before we start anything, I would like to make sure you change your passwords at least once every two weeks. Jot them down somewhere on a piece of paper.

Firstly, I will tell you a few plugins to install onto your forum. These plugins have been personally tested by me, and I even tried to hack my own forum with some of them installed, and I couldn't do it! (The list will grow eventually, as new mods are released).

vBFirewall; http://www.vbulletin.org/forum/showt...ght=vBFirewall
This will protect you from the most common attacks, but not all of them. It will protect you from URL poisoning, Remote File Inclusion, SQL Injection, XSS and other kinds of attacks.

Track Guests Visiting; Track Guest Visits
This will show you which guests are visiting your forum, their IP address and how many pages they have opened and to which pages were opened.

Defending from attacks, from in the inside.
By this, I mean your most important vBulletin file, .htaccess. This file can just about do anything for your forum, and it will help, especially when being ddossed.

The code below will protect you from the programs people use to hack your forum, whether it be SQL Injection, XSS or something you have never heard of.

Using your FTP client, download your .htaccess file onto your computer.
Then Right Click > Open with... > Notepad/Wordpad or whatever you use.

IMPORTANT: Make sure you backup your .htaccess before editing, just in case something goes wrong and your forum goes down.

Scroll to the bottom of your .htaccess and add the below code in;

Code:
# Ultimate htaccess Blacklist from Perishable Press
# Deny domain access to spammers and other scumbags
RewriteEngine on
RewriteBase /
RewriteCond %{HTTP_USER_AGENT} almaden [OR]
RewriteCond %{HTTP_USER_AGENT} ^Anarchie [OR]
RewriteCond %{HTTP_USER_AGENT} ^ASPSeek [OR]
RewriteCond %{HTTP_USER_AGENT} ^attach [OR]
RewriteCond %{HTTP_USER_AGENT} ^autoemailspider [OR]
RewriteCond %{HTTP_USER_AGENT} ^BackWeb [OR]
RewriteCond %{HTTP_USER_AGENT} ^Bandit [OR]
RewriteCond %{HTTP_USER_AGENT} ^BatchFTP [OR]
RewriteCond %{HTTP_USER_AGENT} ^BlackWidow [OR]
RewriteCond %{HTTP_USER_AGENT} ^Bot\ mailto:email [OR]
RewriteCond %{HTTP_USER_AGENT} ^Buddy [OR]
RewriteCond %{HTTP_USER_AGENT} ^bumblebee [OR]
RewriteCond %{HTTP_USER_AGENT} ^CherryPicker [OR]
RewriteCond %{HTTP_USER_AGENT} ^ChinaClaw [OR]
RewriteCond %{HTTP_USER_AGENT} ^CICC [OR]
RewriteCond %{HTTP_USER_AGENT} ^Collector [OR]
RewriteCond %{HTTP_USER_AGENT} ^Copier [OR]
RewriteCond %{HTTP_USER_AGENT} ^Crescent [OR]
RewriteCond %{HTTP_USER_AGENT} ^Custo [OR]
RewriteCond %{HTTP_USER_AGENT} ^DA [OR]
RewriteCond %{HTTP_USER_AGENT} ^DIIbot [OR]
RewriteCond %{HTTP_USER_AGENT} ^DISCo [OR]
RewriteCond %{HTTP_USER_AGENT} ^DISCo\ Pump [OR]
RewriteCond %{HTTP_USER_AGENT} ^Download\ Demon [OR]
RewriteCond %{HTTP_USER_AGENT} ^Download\ Wonder [OR]
RewriteCond %{HTTP_USER_AGENT} ^Downloader [OR]
RewriteCond %{HTTP_USER_AGENT} ^Drip [OR]
RewriteCond %{HTTP_USER_AGENT} ^DSurf15a [OR]
RewriteCond %{HTTP_USER_AGENT} ^eCatch [OR]
RewriteCond %{HTTP_USER_AGENT} ^EasyDL/2.99 [OR]
RewriteCond %{HTTP_USER_AGENT} ^EirGrabber [OR]
RewriteCond %{HTTP_USER_AGENT} email [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^EmailCollector [OR]
RewriteCond %{HTTP_USER_AGENT} ^EmailSiphon [OR]
RewriteCond %{HTTP_USER_AGENT} ^EmailWolf [OR]
RewriteCond %{HTTP_USER_AGENT} ^Express\ WebPictures [OR]
RewriteCond %{HTTP_USER_AGENT} ^ExtractorPro [OR]
RewriteCond %{HTTP_USER_AGENT} ^EyeNetIE [OR]
RewriteCond %{HTTP_USER_AGENT} ^FileHound [OR]
RewriteCond %{HTTP_USER_AGENT} ^FlashGet [OR]
RewriteCond %{HTTP_USER_AGENT} FrontPage [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^GetRight [OR]
RewriteCond %{HTTP_USER_AGENT} ^GetSmart [OR]
RewriteCond %{HTTP_USER_AGENT} ^GetWeb! [OR]
RewriteCond %{HTTP_USER_AGENT} ^gigabaz [OR]
RewriteCond %{HTTP_USER_AGENT} ^Go\!Zilla [OR]
RewriteCond %{HTTP_USER_AGENT} ^Go!Zilla [OR]
RewriteCond %{HTTP_USER_AGENT} ^Go-Ahead-Got-It [OR]
RewriteCond %{HTTP_USER_AGENT} ^gotit [OR]
RewriteCond %{HTTP_USER_AGENT} ^Grabber [OR]
RewriteCond %{HTTP_USER_AGENT} ^GrabNet [OR]
RewriteCond %{HTTP_USER_AGENT} ^Grafula [OR]
RewriteCond %{HTTP_USER_AGENT} ^grub-client [OR]
RewriteCond %{HTTP_USER_AGENT} ^HMView [OR]
RewriteCond %{HTTP_USER_AGENT} ^HTTrack [OR]
RewriteCond %{HTTP_USER_AGENT} ^httpdown [OR]
RewriteCond %{HTTP_USER_AGENT} .*httrack.* [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^ia_archiver [OR]
RewriteCond %{HTTP_USER_AGENT} ^Image\ Stripper [OR]
RewriteCond %{HTTP_USER_AGENT} ^Image\ Sucker [OR]
RewriteCond %{HTTP_USER_AGENT} ^Indy*Library [OR]
RewriteCond %{HTTP_USER_AGENT} Indy\ Library [NC,OR]
RewriteCond %{HTTP_USER_AGENT} ^InterGET [OR]
RewriteCond %{HTTP_USER_AGENT} ^InternetLinkagent [OR]
RewriteCond %{HTTP_USER_AGENT} ^Internet\ Ninja [OR]
RewriteCond %{HTTP_USER_AGENT} ^InternetSeer.com [OR]
RewriteCond %{HTTP_USER_AGENT} ^Iria [OR]
RewriteCond %{HTTP_USER_AGENT} ^JBH*agent [OR]
RewriteCond %{HTTP_USER_AGENT} ^JetCar [OR]
RewriteCond %{HTTP_USER_AGENT} ^JOC\ Web\ Spider [OR]
RewriteCond %{HTTP_USER_AGENT} ^JustView [OR]
RewriteCond %{HTTP_USER_AGENT} ^larbin [OR]
RewriteCond %{HTTP_USER_AGENT} ^LeechFTP [OR]
RewriteCond %{HTTP_USER_AGENT} ^LexiBot [OR]
RewriteCond %{HTTP_USER_AGENT} ^lftp [OR]
RewriteCond %{HTTP_USER_AGENT} ^Link*Sleuth [OR]
RewriteCond %{HTTP_USER_AGENT} ^likse [OR]
RewriteCond %{HTTP_USER_AGENT} ^Link [OR]
RewriteCond %{HTTP_USER_AGENT} ^LinkWalker [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mag-Net [OR]
RewriteCond %{HTTP_USER_AGENT} ^Magnet [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mass\ Downloader [OR]
RewriteCond %{HTTP_USER_AGENT} ^Memo [OR]
RewriteCond %{HTTP_USER_AGENT} ^Microsoft.URL [OR]
RewriteCond %{HTTP_USER_AGENT} ^MIDown\ tool [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mirror [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mister\ PiX [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mozilla.*Indy [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mozilla.*NEWT [OR]
RewriteCond %{HTTP_USER_AGENT} ^Mozilla*MSIECrawler [OR]
RewriteCond %{HTTP_USER_AGENT} ^MS\ FrontPage* [OR]
RewriteCond %{HTTP_USER_AGENT} ^MSFrontPage [OR]
RewriteCond %{HTTP_USER_AGENT} ^MSIECrawler [OR]
RewriteCond %{HTTP_USER_AGENT} ^MSProxy [OR]
RewriteCond %{HTTP_USER_AGENT} ^Navroad [OR]
RewriteCond %{HTTP_USER_AGENT} ^NearSite [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetAnts [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetMechanic [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetSpider [OR]
RewriteCond %{HTTP_USER_AGENT} ^Net\ Vampire [OR]
RewriteCond %{HTTP_USER_AGENT} ^NetZIP [OR]
RewriteCond %{HTTP_USER_AGENT} ^NICErsPRO [OR]
RewriteCond %{HTTP_USER_AGENT} ^Ninja [OR]
RewriteCond %{HTTP_USER_AGENT} ^Octopus [OR]
RewriteCond %{HTTP_USER_AGENT} ^Offline\ Explorer [OR]
RewriteCond %{HTTP_USER_AGENT} ^Offline\ Navigator [OR]
RewriteCond %{HTTP_USER_AGENT} ^Openfind [OR]
RewriteCond %{HTTP_USER_AGENT} ^PageGrabber [OR]
RewriteCond %{HTTP_USER_AGENT} ^Papa\ Foto [OR]
RewriteCond %{HTTP_USER_AGENT} ^pavuk [OR]
RewriteCond %{HTTP_USER_AGENT} ^pcBrowser [OR]
RewriteCond %{HTTP_USER_AGENT} ^Ping [OR]
RewriteCond %{HTTP_USER_AGENT} ^PingALink [OR]
RewriteCond %{HTTP_USER_AGENT} ^Pockey [OR]
RewriteCond %{HTTP_USER_AGENT} ^psbot [OR]
RewriteCond %{HTTP_USER_AGENT} ^Pump [OR]
RewriteCond %{HTTP_USER_AGENT} ^QRVA [OR]
RewriteCond %{HTTP_USER_AGENT} ^RealDownload [OR]
RewriteCond %{HTTP_USER_AGENT} ^Reaper [OR]
RewriteCond %{HTTP_USER_AGENT} ^Recorder [OR]
RewriteCond %{HTTP_USER_AGENT} ^ReGet [OR]
RewriteCond %{HTTP_USER_AGENT} ^Scooter [OR]
RewriteCond %{HTTP_USER_AGENT} ^Seeker [OR]
RewriteCond %{HTTP_USER_AGENT} ^Siphon [OR]
RewriteCond %{HTTP_USER_AGENT} ^sitecheck.internetseer.com [OR]
RewriteCond %{HTTP_USER_AGENT} ^SiteSnagger [OR]
RewriteCond %{HTTP_USER_AGENT} ^SlySearch [OR]
RewriteCond %{HTTP_USER_AGENT} ^SmartDownload [OR]
RewriteCond %{HTTP_USER_AGENT} ^Snake [OR]
RewriteCond %{HTTP_USER_AGENT} ^SpaceBison [OR]
RewriteCond %{HTTP_USER_AGENT} ^sproose [OR]
RewriteCond %{HTTP_USER_AGENT} ^Stripper [OR]
RewriteCond %{HTTP_USER_AGENT} ^Sucker [OR]
RewriteCond %{HTTP_USER_AGENT} ^SuperBot [OR]
RewriteCond %{HTTP_USER_AGENT} ^SuperHTTP [OR]
RewriteCond %{HTTP_USER_AGENT} ^Surfbot [OR]
RewriteCond %{HTTP_USER_AGENT} ^Szukacz [OR]
RewriteCond %{HTTP_USER_AGENT} ^tAkeOut [OR]
RewriteCond %{HTTP_USER_AGENT} ^Teleport\ Pro [OR]
RewriteCond %{HTTP_USER_AGENT} ^URLSpiderPro [OR]
RewriteCond %{HTTP_USER_AGENT} ^Vacuum [OR]
RewriteCond %{HTTP_USER_AGENT} ^VoidEYE [OR]
RewriteCond %{HTTP_USER_AGENT} ^Web\ Image\ Collector [OR]
RewriteCond %{HTTP_USER_AGENT} ^Web\ Sucker [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebAuto [OR]
RewriteCond %{HTTP_USER_AGENT} ^[Ww]eb[Bb]andit [OR]
RewriteCond %{HTTP_USER_AGENT} ^webcollage [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebCopier [OR]
RewriteCond %{HTTP_USER_AGENT} ^Web\ Downloader [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebEMailExtrac.* [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebFetch [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebGo\ IS [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebHook [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebLeacher [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebMiner [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebMirror [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebReaper [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebSauger [OR]
RewriteCond %{HTTP_USER_AGENT} ^Website [OR]
RewriteCond %{HTTP_USER_AGENT} ^Website\ eXtractor [OR]
RewriteCond %{HTTP_USER_AGENT} ^Website\ Quester [OR]
RewriteCond %{HTTP_USER_AGENT} ^Webster [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebStripper [OR]
RewriteCond %{HTTP_USER_AGENT} WebWhacker [OR]
RewriteCond %{HTTP_USER_AGENT} ^WebZIP [OR]
RewriteCond %{HTTP_USER_AGENT} ^Wget [OR]
RewriteCond %{HTTP_USER_AGENT} ^Whacker [OR]
RewriteCond %{HTTP_USER_AGENT} ^Widow [OR]
RewriteCond %{HTTP_USER_AGENT} ^WWWOFFLE [OR]
RewriteCond %{HTTP_USER_AGENT} ^x-Tractor [OR]
RewriteCond %{HTTP_USER_AGENT} ^Xaldon\ WebSpider [OR]
RewriteCond %{HTTP_USER_AGENT} ^Xenu [OR]
RewriteCond %{HTTP_USER_AGENT} ^Zeus.*Webster [OR]
RewriteCond %{HTTP_USER_AGENT} ^Zeus
RewriteRule ^.* - [F,L]
Then save. Go to your FTP, delete .htaccess and upload the new one. You MUST delete the .htaccess already on your server before uploading your new one, otherwise it will not overwrite it in some cases.
Before trying this, make sure you close your forum as user traffic can make it a bit harder, just in case something does go wrong.

And what if I am being ddossed?
If someone is really determined, no amount of IP blocking on the server-side will stop the DDoS. If the "pipe" to the server can be filled, IP blocking will not do much. Your best bet would be to contact your host in many circumstances.

If your being ddossed, you can use your newly acquired .htaccess knowledge in conjunction with your Track Guest Visitors mod.
After installing the mod, scroll to the bottom of your forum to see;
Total guests that have visited the forum in the last 24 hours: 15
You can click on that text, and up will come the IPs of guests, and how may pages they have loaded.

If you are being ddossed, it may look a little something like this;
08-14-2009, 09:12 PM Visitor Yes (50) index 66.249.xx.xxx Viewing Home Page
Of course, the IP address will be different. Where it says 'Yes (50), that is how many pages the ddosser has loaded. If you are experiencing a massive ddoss attack like I did, you will see a lot of IP addresses, each loading around 60-300 pages at once. You can tell this will dramatically slow your forum, or even crash it.

Now, to use this in conjunction with .htaccess? Well, it's simple, you ban the IP addresses with .htaccess, not with your forum banning options. But what if you have around 70 IP addresses, all ddossing you? Then in that case, the first two sections will be the same, the rest will be different. For example, it would be like this; (the below IPs are made up)
97.68.233.244
97.68.123.213
97.68.211.176

So instead of banning each and every IP address, you would ban a range. But banning every IP address one by one will still not stop them, banning a range would.

You would do this the following way. Go back into your .htaccess (where you would edit it), and add the following lines at the bottom;
PHP Code:
order allow,deny
deny from 97.68.
allow from all 
The code above would ban the entire 97.68. range, therefore not allowing ddoss attack from any 97.68. IP address, banning them all at once. But in some cases, you will have various IP addresses. I had around 5 different types from 5 different ranges, mine looked like this;

PHP Code:
order allow,deny
deny from 97.68.
deny from 77.132.
deny from 68.8.
deny from 97.66.
deny from 233.233.
allow from all 
The above will stop all users coming from 97.68 and the others. So if a users IP address was "97.68.233.211", and another users was "97.68.53.222", then they both would not be able to access the site.

NOTE: You do this through .htaccess and NOT the vBulletin banning, as if you do this through .htaccess it will stop them from entering your website completely. Doing it through vBulletin will still allow them to access your site, just not register. And for a ddoss attack to take place, they don't need to register anyway.

You can add as many IP addresses as you want, just by adding "deny from" on a new line, followed by the IP address. Now you may be thinking, "This will stop a lot of users coming on to my website". This just might do that, but allowing them to continue the ddoss attack will stop all users from coming onto your website. You simply unban the IP addresses after a few days, once you think the ddoss attack has worn off.

I hope you understand the above, and if you would like further assistance, simply contact me via PM.

Most ddoss attackers come from a huge server, where they have around 1000 computers. So banning the IP address range will stop them all from accessing.
For heads up, my ddoss attack came from the US, Florida from two separate locations, location right next door to each other so they would have different IP addresses.
You can follow my guide above and rid of the ddossers immediately, or you can wait it out, which I suggest you DON'T do.

Conclusion
I hope you have learnt a thing or two from my guide above, and if I have missed anything out, please contact me via this thread or Private Message. Both will be read as quick as each other. By reading the above, you learnt how to protect your forum from the most common and rare cases of hacking, and protected it against ddoss attacks.

vblts.ru supports vBulletin®, 2022-2024