hi all

we are having an issue with a mirc script that is accessing our web site and performing actions automatically
these actions are meant to be done manually by members (submitting forms, etc)

the script basically simulates a normal user's actions
with all the headers and variables needed, etc.

i have never programmed with these scripts so i can't really tell how it works

it is using these ports to access the site i guess
alias -l var.port { return 80 }
alias -l var.login.port { return 443 }

just wanted to know if anyone knew of a way that i can stop this script from working
without affecting the majority of our good members

we have tried changing variable names, etc
and this has caught some people out, but we have learnt that the script has been updated to work with dynamic variable names
eg. <input name="somevar">

thanks
dave

do you have a copy of the script?

im a very good mirc scripter, socket code isnt all that hard to follow through as mirc has a very high level of automation for its sockets. if your willing to put the script up, i could pick it apart for you and see if theres any obvious ways to stop it. as for your website, is the script actually logging in? if it is, im assuming that just cancelling its logins doesnt have the desired effect.

as an afterthought, im not sure how easy it would be to impliment, but have you considered throttling requests? mirc scripts accessing a service like http tend to be much faster than a human (as any automated process would be, humans have to type out the data, the script process it and sends it). it may be an easy way to stop the script dead, just throttle its requests. i guess whether or not this is viable depends on your web server setup, but its one of those random thoughts that seems to make sense.

`Zidane

hi thanks for your reply
i would love to post the script up, but i don't think we need our web site showing up on search engines with these kinds of issues

yeah, the script is actually logging in
i'm not sure but in our logs we do have session times for some users at 15 seconds or so (which is obviously very unusual)

i'm not sure i understand what you mean by throttling requests though

thanks
dave

if you want to send the script to me personally, i'll still have a look at it for you, if your concerned about putting it on a public thread

as for throttling the requests, you say you have session times for 15 seconds, it may be possible to set a limit on how quickly a user can request specific pages from the server. if the script is hammering through its requests in 15 seconds, if you throttle this, it will break most scripts ( a *lot* of mirc socket scripters dont put in sufficient error handling to cope with throttled servers).

as an example, you say the script is filling out a form and submitting it? say you put a throttle on the form and submission page, so a user can only make 2 requests in 45 seconds (im assuming the form would take a human user longer than 45 seconds to fill out). the script requests would be denied, because they are hitting the throttle too quickly(many requests in 15 seconds, but only allowed 2 requests in 45 seconds), but a normal user (say they take 1 minute to fill out the form) would be allowed, because their requests are comparatively very slow.

im not sure how feasable it is to set up on your server,and unfortunately im not the person to give any specific how-to's on it (i dont know the first thing about webservers, aside from how to install apache to defaults and throw on a private page or two), but from my days writing mirc scripts, i saw quite a few sites that used a throttle to stop automated requests from scripts. (thankfully, though, i actually asked the site owners before i automated any requests, i know how much load that can put on a server if its overused).