Cracker Tracker Problem!

[Ferryman]

When I try to enter a forum description I get this:

SECURITY ALERT » » » »
CBACK CrackerTracker has detected a potential attack on this site with a worm or exploit script so the Security System stopped the script.


If you can see this page after including a new MOD into your board or after clicking on a link please contact the Board Administrator with this error message and a description what you have done before you could see this page, that the Admin has the possibility to fix the problem.

How do I fix this?

[DjPorkchop]

Hello and welcome to the site.

A few pointers first.

Cracker tracker is a pita, but it is nice once you get it set. You are going to encounter many false positives with it. You will get a headache, but stand firm, this too shall pass.

Next We have been on line for a very long time now and have a vast database of info that can be found by using the search feature. It works real nice. I used it and came up with this http://www.integramod.com/forum/viewtop ... er+Tracker

If you have any more issues CTracker, please do not hesitate to ask.

have a great day.

Ray

[JMS]

All the links in directed forum are broken.

I am now having problems with the Cracker Tracker. it wont let me do anything.
is there a way to add an autorized user so I don't get the error when I change..well anything

[DjPorkchop]

Hi JMS.

Cracker Tracker is a bit fiesty at first until you get it trained the way you need it to be. Teelk has started a great thread years ago that many a users have found very helpful including myself. Cracker Tracker False Positives. Follow the directions to the T and all should go well. If you are having problems with a specific item, read through the various pages on that thread. Many users reported the file changes necessary once they ran in to an issue thus saving people time.

If you have any issues with it after reading that article, please feel free to post back and we will help you get on the right track.

[DjPorkchop]

Well, upon further review, that thread may be a bit hard to follow. If it is, holler back and I will do what I can to help you out.

[JMS]

Will do
Thx

[DjPorkchop]

JMS, I have fixed Teelks post to point to the KB article on how to debug CTracker. Hopefully this is a littl ebit easier for you to follow now. I would make an attempt to fix all the posts in that thread but that would take ages. lol Much easier if you have any issues I can help you fix from here.

[JMS]

Sounds like a plan
thx again

[JMS]

there is no entry in /forums/IM150/admin/admin_faq_editor.php for
include($phpbb_root_path . 'common.'.$phpEx);

my Logmanager view debub entries calls for this Should I add it?

[JMS]

Taking the plunge I can always load the backup I created

[JMS]

Awesome it worked

opened file

/forums/IM150/admin/admin_faq_editor.php

added

define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('answer');
include($phpbb_root_path . 'common.'.$phpEx);

now can add info to the FAQ

and you have the data to amend the install package

[JMS]

Hmm bit of a rub here.
Endless cycle

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forums/IM150/admin/admin_faq_editor.php
----------------

Attack-Time: 16.10.2012 13:49 pm
------------

Request-Method: POST

Matching rule: mail
In variable: answer

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forums/IM150/admin/admin_faq_editor.php

#
#-----[ FIND ]------------------------------------------
#
include($phpbb_root_path . 'common.'.$phpEx);

#
#-----[ BEFORE, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('answer');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

Ok so I do but when I do it says
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Script-Filename: /forums/IM150/admin/admin_faq_editor.php
----------------

Attack-Time: 16.10.2012 13:47 pm
------------

Request-Method: POST

Matching rule: or
In variable: quest_title

Possible solution:
------------------

#
#-----[ OPEN ]------------------------------------------
#
/forums/IM150/admin/admin_faq_editor.php

#
#-----[ FIND ]------------------------------------------
#
include($phpbb_root_path . 'common.'.$phpEx);

#
#-----[ BEFORE, ADD ]------------------------------------------
#
define('CT_SECLEVEL', 'MEDIUM');
$ct_ignorepvar = array('quest_title');

#
#-----[ SAVE/CLOSE ALL FILES ]------------------------------------------
#
# EoM

It will only let me add one define field. how do I combine $ct_ fields
that should work right?

[JMS]

Ah dang
page 3 covered that.
sorry

[Helter]

sometimes 'MEDIUM' is still too strict. If the code does not work as expected, change MEDIUM to LOW