obey-robots.txt
View Thread
pHp-Fusion.Org | Open Source PHP + MySQL Powered Website » PHP-Fusion v7 protection mods & tips » Modifications to protect your website
Keep spammers and bots out.
 Print Thread
Slow down brute force attackers on login.php
Fusioneer
Top  #1 Print Post
Posted on 21-09-2012 16:18
This very simple mod uses the php sleep function. It slows down brute force attackers on login.php.
The delay only occurs when a wrong user/pass combination is given.
Correct login is not affected.

Open login.php
Find
Download source  GeSHi: PHP
  1. switch ($_GET['error'])
Parsed in 0.022 seconds, using GeSHi 1.0.8.10

Directly below you wil find
Download source  GeSHi: PHP
  1. 			case 1:
  2. 				echo $locale['global_196'];
  3. 				break;
  4.  
Parsed in 0.009 seconds, using GeSHi 1.0.8.10


Now you can do two things
1 step modification or a two step modification

1 step modification:
Download source  GeSHi: PHP
  1. 			case 1:
  2. 				echo $locale['global_196'];
  3. 				echo "You had to wait 15 seconds because your login was incorrect."; sleep(15); // mod Wanabo
  4. 				break;
  5.  
Parsed in 0.009 seconds, using GeSHi 1.0.8.10


2 step modification:
Download source  GeSHi: PHP
  1. 			case 1:
  2. 				echo $locale['global_196'];
  3. 				echo $locale['wanabo_010']; sleep(15); // mod Wanabo
  4. 				break;
  5.  
Parsed in 0.008 seconds, using GeSHi 1.0.8.10

and add to locale\English\global.php just before ?> at the end of the file:
Download source  GeSHi: PHP
  1. $locale['wanabo_010'] = "You had to wait 15 seconds because your login was incorrect.";
  2.  
Parsed in 0.008 seconds, using GeSHi 1.0.8.10


Because I administer several websites with different languages I opted for the 2 step modification. And put the correct translation in the corresponding global.php language folder. This makes bulk updates easier.
Warning about ParkingCrew.com! Case: ParkingCrew.com acquires NameDrive.com but earnings are not transferred despite assurances and promises. Inquiries about this are ignored! It's just a con compagny. Don't do business with them!
 
Jump to Forum
New Thread Post Reply
Use BBcode or HTML to refer to; 'Slow down brute force attackers on login.php'
BBcode:
HTML: