what is this

[Statham]

php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP866.CSUNICODE|convert.iconv.CSISOLATIN5.ISO_6937-2|convert.iconv.CP950.UTF-16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|c

 

what is this someone trying to login by using this what is this ?

cann somebody explain ?

[Statham]

they made several attemtp to use base64 char but with strange char 

 

[Randy Calvert]

They look to be ATTEMPTING brute force logins and switched to trying to look for a PHP exploit.  

Each of these would have failed, but it looks like a malicious actor.  You might want to just block their IP itself in your firewall if you have one or have your host block them.  

[Statham]

7 minutes ago, Randy Calvert said:

They look to be ATTEMPTING brute force logins and switched to trying to look for a PHP exploit.  

Each of these would have failed, but it looks like a malicious actor.  You might want to just block their IP itself in your firewall if you have one or have your host block them.  

Hi thanks

 

Edited March 16, 2023 by xTheBoss

[Randy Calvert]

IPB's systems are already smart enough to reject those kinds of activities.  You don't need to code anything if you're using the suite.  The fact that it was attempted though is still logged even though it's stopped.  

But if that IP itself is doing that sort of activity, why allow them to even try?  Just block the IP itself from even reaching your server.  

[Statham]

Man using a vpn will take 30 second to change IP o_O

[Stuart Silvester]

You should probably ask whoever writes that software, that is not an Invision Community table structure.

[Statham]

Im using it trough IPB i srsly don't want to risk to lose IPB forum ... and being hacked