3

Lately, some of our clients have had some trouble with report mail spam. When tracing this back, report.php and captcha/refresh were hit alot. My guess is that someone is trying to force errors on our environment (since there is a corebug that triggers an error when captcha/refresh does not receive a form id and report.php well.. yeah :)). Does anyone have an idea why people would try this and how to stop this? Requests have all been made trough Tor.

  • What is the exact error message in the logs? I'm trying to correlate it with other reports i'm getting. – Piotr Kaminski Sep 1 '15 at 6:25
  • When you hit report.php straight there is no error message, when you hit captcha/refresh you get if (!isset($params['formId'])) { throw new Exception('formId is mandatory'); } – Toon Van Dooren Sep 1 '15 at 8:28
3

This could be any automated script run by any users who encounters it. It might not be even specific for your website but can target some random Magento shops.

You should think about putting a WAF (Web Application Firewall) in place that blocks specific requests (for example > POST 10 requests per IP within a certain amount of time). A good hosting provider will be able to investigate and help you with this.

  • The firewall is in place but when people hit from a tor network, the ip changes regularly. Time to block some useragents I guess :). – Toon Van Dooren Sep 1 '15 at 8:28
  • Wat WAF would you use by the way? Naxsi? – Toon Van Dooren Sep 1 '15 at 8:40
  • I tried mod_security some time ago (but I'm not an advanced user). You could also think of some log analysis tools like fail2ban. Guess it's the best to ask your hosting provider what they can offer and have experience with. – Anna Völkl Sep 1 '15 at 8:50
  • An d what the cliënt wants to pay to investigate all this :D. I will accept this answer, alltough I am still wondering if there are vulnerabilities on these 2 places since they are being targeted... – Toon Van Dooren Sep 1 '15 at 9:16
1

I had the same problem lately.

I detected that googlebot had an error while crawling my website with /captcha/refresh error. I also found out that my captcha was missing while registering.

I searched for the error but could not find any relevant answer.

Finally I read this conversation and I started to find all users who tried to link to my page. Finally thanks to google webmaster tool, I identified the external link, two of them who were linking to my customer/account and wishlist page. You can find it in google webmaster search traffic, links to my page.

I went to my admin area, cpanel and blocked these two domains. After which I found that my captcha was working well as well as my /captcha/refresh page. Thanks for this article that made me think like this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.