maybe changing the name of the register action script or adding a verification will stunt these bitches...

 

Yeah changing the action to something like nignog or adding verification definitely would.

There aren't updates for this forum?

 

what made the spam ***** come here all of a sudden?? i've been on here for years and never saw spam...but now it's daily

 

It has nothing to do with "here". They just target any board running this particular PHP script. As stated previously, it's quite trivial to put measures into place to prevent it. Any of the "type these obfuscated looking number images" on the registration page would do the trick.

 

There's a forum update that adds verification scripting, but it requires a back up in case things go and get themselves completely fucked. The powers that be haven't had the time, but it's coming in the next couple weeks.

 

Awesome, good luck with it

 

Don't wish me luck, I'm just the resident loudmouth. I think it's a Bliss/Frank collaboration.

 

The bots use expolits in the forum script to run text/ini files as code to register their names and post messages.

The bots scan through IP ranges looking for webservers trying all of the get command exploits they know on a given server
if the server runs the script then it makes the post
the bot probably logs the ip adress of sucessfull connections
all you have to do is find what exploit is allowing access and change the name, or download the scripts they're using on yoru computer and change the action name on the form
say change
https://www.homemadeturbo.com/forum/...ction=register
to
https://www.homemadeturbo.com/forum/...?action=nignog
it wouldn't be able to run its premade register scripts anymore

It looks something like this, sorry for the huge screen shot, but i couldn't paste the text because the forum software was trying to hyperlink all of those IP's and it woudn't post.

The verification warped numbers thing might not do much because the bots dont nessiciaiy go that route to register. they get the server to run code on its self to register.

Whats in the red is the file containing the code of the expolit they're trying to run.
this ---- is easy to counter. most of those get's even in the yellow are attemps to exploit the server, but i just highlighted that one specific thing


edit, piece of ---- photobucket

 

nignog>register

 

https://www.homemadeturbo.com/forum/...3834#msg803834