Today's Posts Follow Us On Twitter! TFL Members on Twitter  
Forum search: Advanced Search  
Navigation
Marketplace
  Members Login:
Lost password?
  Forum Statistics:
Forum Members: 24,254
Total Threads: 80,792
Total Posts: 566,472
There are 1562 users currently browsing (tf).
 
  Our Partners:
 
  TalkFreelance     TalkFreelance Information     General Discussion :

Do you sell digital goods on your website? If so, read this

Thread title: Do you sell digital goods on your website? If so, read this
Reply    
    Thread tools Search this thread Display Modes  
04-28-2012, 01:28 AM
 #1
Impluo is offline Impluo
Status: We're all mad here
Join date: Aug 2005
Location: Missouri
Expertise: programming
Software: Notepad
 
Posts: 1,606
iTrader: 0 / 0%
 

Impluo is on a distinguished road

  Old  Do you sell digital goods on your website? If so, read this

I've noticed a problem that still seems to exist within the web for digital goods like themes, scripts, ebooks, and other assorted turnkey stuff...

It would seem that there are still A LOT of people out there that host their websites without hiding directory listings on their folders that don't have an index.html/index.php file.

Is your site one of them? try going to a url on your website that goes to a folder that doesn't have the index.html file. IE: http://www.yoursitebcndcvblah.com/images/
If it lists the contents of your folder then you are at risk of people finding your downloadable files by attempting to go to folders like /uploads/ /upload/ /downloads/ /download/ /dl/ etc . In this scenario, directory buster could also be used to easily find folders that weren't meant to be seen by the public. Beyond that point people could find your zipped products and download them without paying if they locate the folder you are storing them in.

Fix your .htaccess files!! I took a look through some of the users posts in the marketplace and I've noticed that many of those have directory listings enabled on their sites which turns into a loss of potential customers if those same people know how to get to your zipped products through the directories. This is a problem that really shouldn't exist for people in this kind of business but it is still alarming how prevalent the issue is.

Documentation on Options -Indexes
http://httpd.apache.org/docs/2.0/mod/core.html#options

Or dare I say on top of doing the htaccess change you could even put a php script as an index file in your downloads / uploads folders that logs IP addresses so you have a way to block theives or atleast identify who is trying to get to your files without paying for them

Thanked by:
Artashes (04-28-2012)
04-28-2012, 02:41 AM
 #2
Krazeeh is offline Krazeeh
Status: I'm new around here
Join date: Apr 2012
Location: California
Expertise:
Software:
 
Posts: 9
iTrader: 0 / 0%
 

Krazeeh is on a distinguished road

  Old

Yup be sure that you change the access. There are several ways that blackhatters can fish your product out using strings such at /upload and the such.

Thanks for the indepth share mate!
Reply With Quote
04-28-2012, 05:43 AM
 #3
.Nick is offline .Nick
.Nick's Avatar
Status: Request a custom title
Join date: Feb 2005
Location:
Expertise:
Software:
 
Posts: 1,159
iTrader: 3 / 100%
 

.Nick is on a distinguished road

  Old

On a similar note, don't leave setup scripts for common applications sitting around. I get hit with a block of requests like this almost weekly:

Code:
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:20 -0500] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:20 -0500] "GET /3rdparty/phpMyAdmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:24 -0500] "GET /admin/phpmyadmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:24 -0500] "GET /admin/pma/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:24 -0500] "GET /_admin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:24 -0500] "GET /admin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:25 -0500] "GET admin/scripts/setup.php HTTP/1.1" 400 1025
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:25 -0500] "GET /admm/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:25 -0500] "GET /admn/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:26 -0500] "GET /backup/phpmyadmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:26 -0500] "GET /backup/phpMyAdmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:26 -0500] "GET /bbs/data/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:26 -0500] "GET /bkup/phpmyadmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:27 -0500] "GET /bkup/phpMyAdmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:27 -0500] "GET /cpadmindb/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:27 -0500] "GET /cpadmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:27 -0500] "GET /cpanelmysql/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:40 -0500] "GET /databaseadmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:40 -0500] "GET /dbadmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:41 -0500] "GET /db/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:41 -0500] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:41 -0500] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:41 -0500] "GET /mysqladminconfig/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:42 -0500] "GET /mysql-admin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:42 -0500] "GET /mysqladmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:42 -0500] "GET /MySQLAdmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:49 -0500] "GET /phpadmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:49 -0500] "GET /phpmanager/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:49 -0500] "GET /phpm/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:49 -0500] "GET /phpmyadmin1/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:50 -0500] "GET /phpMyAdmin1/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:50 -0500] "GET /_phpmyadmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:50 -0500] "GET /php-my-admin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:50 -0500] "GET /php-myadmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:51 -0500] "GET /phpmy-admin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:51 -0500] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:51 -0500] "GET /_phpMyAdmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:52 -0500] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:52 -0500] "GET /pHpMyAdMiN/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:52 -0500] "GET /PHPMYADMIN/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:52 -0500] "GET /phpMyAdmi/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:53 -0500] "GET /phpmyad/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:53 -0500] "GET /phpMyAds/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:53 -0500] "GET /phpmyad-sys/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:53 -0500] "GET /phpmya/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:54 -0500] "GET /phpMyA/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:54 -0500] "GET /phpmy/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:54 -0500] "GET /pHpMy/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:54 -0500] "GET /php/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:55 -0500] "GET /pma2005/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:55 -0500] "GET /PMA2005/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:55 -0500] "GET /p/m/a/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:56 -0500] "GET /pma/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:56 -0500] "GET /pMA/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:56 -0500] "GET /~/PMA/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:56 -0500] "GET /PMA/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:57 -0500] "GET /roundcube/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:57 -0500] "GET /scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:57 -0500] "GET /sl2/data/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:57 -0500] "GET /sqladmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:58 -0500] "GET /sqlmanager/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:58 -0500] "GET /sql/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:59 -0500] "GET /SQL/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:59 -0500] "GET /sqlweb/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:59 -0500] "GET /SSLMySQLAdmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:30:59 -0500] "GET /typo3/phpmyadmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:31:00 -0500] "GET /vhcs2/tools/pma/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:31:00 -0500] "GET /webadmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:31:00 -0500] "GET /webdb/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:31:01 -0500] "GET /web/phpmyadmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:31:01 -0500] "GET /web/phpMyAdmin/scripts/setup.php HTTP/1.1" 404 1092
xxx.xxx.xxx.xxx - - [22/Apr/2012:22:31:01 -0500] "GET /web/scripts/setup.php HTTP/1.1" 404 1092
Reply    

« Previous Thread | Next Thread »

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 

  Posting Rules  
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump:
 
  Contains New Posts Forum Contains New Posts   Contains No New Posts Forum Contains No New Posts   A Closed Forum Forum is Closed  

Home   |     |   News   |   Rules   |   FAQ   |  


Powered by HandsOnWebHosting.com

The time is now 07:37 AM (GMT).


Powered by: vBulletin Version 3.8.4 Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.