heh heh Yup!
:-) Stephen Milligan Team Macromedia - ColdFusion Co-author 'Reality Macromedia ColdFusion MX: Intranets and Content Management' http://spikefu.blogspot.com > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf > Of Steve Onnis > Sent: 24 February 2003 16:40 > To: CFAussie Mailing List > Subject: [cfaussie] RE: Dictionary attacks > > > Did you get onto that chick the messaged you spike? > > Regards > > Steve Onnis > Domain Concept Designs > +61 422 337 685 > +61 3 9444 7504 > > http://www.domainconceptdesigns.com > <http://www.domainconceptdesigns.com> > > ("If you think it can't be done, you haven't asked me!") - Steve Onnis > > > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Spike > Sent: Monday, February 24, 2003 4:31 PM > To: CFAussie Mailing List > Subject: [cfaussie] RE: Dictionary attacks > > > Sorry for the delay in responding... > > I was working on something else for the last hour or so. > > I have a loginBombProtector() function that should provide > some level of protection for this sort of attack. > > It accepts 4 parameters: > > persistentScope - Application or server scope in which to > store ip address information for login attempts. > > maxLoginAttempts - An integer indicating the maximum number > of login attempts to permit before locking out the user. > > loginDimer - An integer indicating the amount of time a user > has in which to make less than the permitted number of login attempts. > > lockoutDuration - An integer indicating the amount of time a > user should be locked out for once their IP address is blocked. > > timeUnit - Any of the valid values for the first parameter of the > dateDiff() function. i.e. 's','n','h','d','m' or 'y' > > It returns true if the user has not been locked out, and > false if they have. > > I modified it from some code I used on a restricted search > engine so it hasn't been heavily tested, but it should be ok. > > > Typical usage: > > <cfif loginBombProtector(server,3,1,5,'n')> > <!--- login code goes here ---> > <cfelse> > <!--- error messages, ip logging and other blocked user > stuff goes here ---> > <cfabort> > </cfif> > > Example code below (Watch out for email client wrapping in > the <cfscript> block): > > ############################################## > > > <cfscript> > > function > loginBombProtector(scope,maxLogins,timeInterval,lockoutDuratio > n,timeUnit > ) { > > > var thisUser = ''; > > if (not structKeyExists(scope,'ipList')) { > scope.ipList = structNew(); > } > > /* Set up a structure in the scope scope to > hold login attempt info */ > if (not structKeyExists(scope.ipList,cgi.remote_addr)) { > scope.ipList[cgi.remote_addr] = structNew(); > scope.ipList[cgi.remote_addr]['count'] = 0; > scope.ipList[cgi.remote_addr]['logintimer'] = > Now(); > scope.ipList[cgi.remote_addr]['blocked'] = > false; > } > > thisUser = scope.ipList[cgi.remote_addr]; > > /* Increment the count for this value of cgi.remote_addr > */ > thisUser.count = thisUser.count + 1; > > /* Check to see if this user is currently blocked. If > so, check if they have served > their timeout period and unblock if necessary. */ > > if (thisUser.blocked) { > > if (dateDiff(timeunit,thisUser.loginTimer,Now()) > GT lockoutinterval) { > > thisUser.blocked = false; > thisUser.logintimer = Now(); > thisUser.count = 0; > > } > > } > > /* Check if the count is greater than the maximum > allowed and make sure the user is not currently blocked */ > if (thisUser.count GT maxLoginAttempts AND NOT > thisUser.blocked) { > > /* The count is greater than permitted max. Check if > these login attempts > have occured inside the permitted time period. If so, > block the user. If not, reset the counter and timer */ > > if (datediff(timeunit,thisUser.logintimer,Now()) > GT timeinterval) { > thisUser.blocked = false; > thisUser.count = 1; > thisUser.logintimer = Now(); > } > else { > thisUser.blocked = true; > } > > } > return thisUser.blocked; > } > > > </cfscript> > > <cfset maxLoginAttempts = 10> > <cfset timeinterval = 1> > <cfset lockoutinterval = 5> > > <cfset foo = loginBombProtector(server,10,1,5,'s')> > > <cfoutput>#foo#</cfoutput> > > <cfdump var="#server.ipList#"> > > > ############################################## > > > Spike > > Stephen Milligan > Team Macromedia - ColdFusion > Co-author 'Reality Macromedia ColdFusion MX: Intranets and > Content Management' http://spikefu.blogspot.com > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Adam > > Chapman > > Sent: 24 February 2003 15:38 > > To: CFAussie Mailing List > > Subject: [cfaussie] Dictionary attacks > > > > > > Hey Everyone.. > > > > At the hack-proofing CFMX session at MXDU, Spike > > Mentioned a 'dictionary attack' or something similar > > Where someone will pound your cf templates with lots-o > > Username/password combos.. > > > > What are some of the methods peoples use to try and > > Safeguard against this kind of thing..? > > > > Regards, > > Adam Chapman > > > > Virtualtours.com.au > > mailto:[EMAIL PROTECTED] > > Phone: 1300 366 122 > > (Int: +61 3 9720 5733) > > Fax: +61 3 9720 6377) > > > > > > --- > > You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To > > unsubscribe send a blank email to > > [EMAIL PROTECTED] > > > > MX Downunder AsiaPac DevCon - http://mxdu.com/ > > > > > > > --- > You are currently subscribed to cfaussie as: > [EMAIL PROTECTED] To unsubscribe send a blank email to > [EMAIL PROTECTED] > > MX Downunder AsiaPac DevCon - http://mxdu.com/ > > > --- > You are currently subscribed to cfaussie as: > [EMAIL PROTECTED] To unsubscribe send a blank email to > [EMAIL PROTECTED] > > MX Downunder AsiaPac DevCon - http://mxdu.com/ > > --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/
