Register Arama Bugünkü Mesajlar Tüm Forumu Okundu Say

Thread Tools
vB3: Making your Admincp More secure!
vB.Org Poster
vB.Org Poster has disabled reputation
Kayıt Tarihi: Jul 2018
Mesajlar: 298

Show Printable Version Email this Page
yazan vB.Org Poster 20 Nov 2017, 13:10

Hi guys, over my relatively short time as an administrator of a few forums, I've learned a few "tricks" that will throw off some of the more "Noobish" people who have a desire to hack your forum. I figured I would go ahead and post them

Trick # 1:Rename your admincp folder

This is actually a surprisingly little known feature of vbulletin. Rename the admincp on your hosting space to anything else, the more random, the better. Open up your config.php inside the /includes/ folder, and find the line containing

Kod Blok Kilitli:      (Kayıt veya giriş yapmalısın)  
Engellenmiş, kayıtlı olmayan veya onay bekleyen kişiler kodlara erişemezler.

and change the variable stored there to the name of your directories new name. Basically, this will make it so anyone who doesn't know the exact location of your admincp, cant find it.

Trick #2: The Dummy Admin Panel

This one goes well with trick #1. Goto your admin panel's login screen,and go to your browsers File-> Save As page, and save the .php file to your HD. Now, open edit out the personal data in that admincp (look around the form data for "hidden" fields), and upload it to a directory on your server. Basically, the idea here is to make a non-functional admincp login page, to fool people into thinking they have the right URL when they really don't.

Trick #3: The IP Deny .htaccess

Now, this trick involve knowing all of your admin's IP addresses. If your administrators do not have "rotating" IP's, then you can use a simple .htaccess file to allow only you and your administrators IP ranges to access the admin panel. Quite an efficient way of safeguarding your admin panel

Trick #4: A Passworded .htaccess

If your admin's do have dynamic IP addresses, there is another .htaccess solution you can use, though this one is a little less secure. Simply create a .htaccess that requires a username and password, this give double password protection on the panel, making it harder to get it. The downside is, if someone gives out the password, its useless :/

Trick #5: The Multi Hash

Now this is one you'll have to figure out on your own, its a little bit tricky to pull off, and PHP/SQL knowledge is required. The current login system for all the users for vbulletin is a MD5 hash, which is encrypted in your sql database itself. Now, to login, the system takes your input, encrypts it, and compares it to the result in the database. When hackers use scripts/exploits to try and pull a password from your database, it comes out as a hash, which they then have to run a dictionary attack against(It takes forever to brute force a MD5 password) Now, a few webmasters have found ways to "multi-hash" the login script, so that it would be something like this user input ->hash ->hash -> hash -Compare result to db. This effectively hinders any hacker from getting your hash and decrypting it, as a dictionary attack would not work on it.

Trick #6 (Though not a trick at all): Picking your staff

Above all, probably the most important thing to ever remember. Don't be generous with giving Moderator/ Admin/ Cpanel/ FTP access. Unless the user is someone you can trust, and has at least a little experience, theres no reason to let anybody in any control panel.

Posted by an administrator by my site. Org post:

Views: 113
Reply With Quote

Thread Tools

Şunları Yapabilirsin
Yeni Konu Açmak
Konuya Cevap Yazmak
Eklenti Eklemek
Düzenleme Yapabilmek

Forum Atla

LD'de Yeni misin? Yardıma mı ihtiyacın var?

All times are GMT +3. The time now is 12:04.

Tasarım Özelliği | Genişlik: Geniş Renk: vB3: Making your Admincp More secure! vB3: Making your Admincp More secure! vB3: Making your Admincp More secure! vB3: Making your Admincp More secure! vB3: Making your Admincp More secure!