Register Members List Search Today's Posts Mark Forums Read

Reply
 
Mod Options
How to stop CloudFlare / Incapsula bypass for vBulletin. Details »
How to stop CloudFlare / Incapsula bypass for vBulletin.
Mod Version: 1.00, by MentaL (Designer) MentaL is offline
Developer Last Online: Sep 2019 I like it Show Printable Version Email this Page

vB Version: 4.2.2 Rating: (1 vote - 5.00 average) Installs: 10
Released: 30 Jul 2014 Last Update: Never Downloads: 0
Supported Code Changes Re-usable Code  

Hi,

There are a few methods to bypass CloudFlare and Incapsulas protection to get the originating server ip, the first being mail server headers (so what I do is use a third party server with modified mail headers that remove the sender IP which would be the server we are trying to protect) and the second is vBulletins image retrieval.

At the moment vBulletin has the following ;
  • avatar image retrieval
  • profile image retrieval
  • album image retrieval
  • ... etc

This is bad! Anyone could simply use an ip logger such as this and then could insert the fake image into the URL field to download it would grab the source ip and bypassing CF/Incapsula. What originally I was doing was editing the template and removing option 1 (the ability to retrieve image url) but as it turns out this is no good, because you can just inject the original code using firebug or element inspector and pretend nothing was ever gone! I did this for months until it was brought to my attention two days ago!

The work around.

We need to disable the following in php.ini (really only the fopen but include stops offsite injections).


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

And secondly we need to disable CURL, we could use the disable_function and add curl_init but then this would disable the facebook integration that's pre-built within vBulletin ! Not good! So , to combat this we do the following;

Edit includes/class_upload.php

find


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

replace with


Block Disabled:      (Update License Status)  
Suspended or Unlicensed Members Cannot View Code.

Sorted! since all vBulletin base upload and image retrievals are based through this class its effectively side wide stopping any automatic retrievals and disabling the usage of ip image loggers.

Download Now

Only licensed members can download files, Click Here for more information.

Show Your Support

  • To receive notifications regarding updates -> Click to Mark as Installed.
  • This modification may not be copied, reproduced or published elsewhere without author's permission.
Comments
  #2  
Old 31 Jul 2014, 23:35
gilakunters gilakunters is offline
 
Join Date: Feb 2012
nice to share your fixes
Reply With Quote
  #3  
Old 02 Aug 2014, 01:01
MentaL's Avatar
MentaL MentaL is offline
 
Join Date: Jan 2003
Happy to help
__________________
RaGEZONE
Reply With Quote
  #4  
Old 13 Aug 2014, 16:16
fxdigi-cash fxdigi-cash is offline
 
Join Date: Jul 2012
Great share.

Thanks a lot.
__________________
Shoot me a PM if I didn't reply in your post when you needed help. I can't remember things easily
Reply With Quote
  #5  
Old 16 Aug 2014, 06:44
fxdigi-cash fxdigi-cash is offline
 
Join Date: Jul 2012
by the way, if we turned off the Curl php function the image insertion property won't work anymore. it will give you an error saying " remove upload has been disabled" or similar message...

is there a fix for this because Curl php is important function for vb board...
__________________
Shoot me a PM if I didn't reply in your post when you needed help. I can't remember things easily
Reply With Quote
  #6  
Old 16 Aug 2014, 15:51
MentaL's Avatar
MentaL MentaL is offline
 
Join Date: Jan 2003
Originally Posted by fxdigi-cash View Post
by the way, if we turned off the Curl php function the image insertion property won't work anymore. it will give you an error saying " remove upload has been disabled" or similar message...

is there a fix for this because Curl php is important function for vb board...
You want all forms of image retrieval disabled or else ip loggers are used. Embedding and direct uploading is fine but the other methods are not.
__________________
RaGEZONE
Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Mod Options

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 06:55.

Layout Options | Width: Wide Color: