We have caught 109805 shameful hackers.

Installed On: October 23rd, 2000
Last upDate: April 7th, 2021

How injections are prevented by our NukeSentinel CMS portal addon.

About 17 years ago, full-featured « website/portals » as we called them, were all the craze. PHP-Nuke was something easy to install on the many free Web Hosting accounts that were available. It was the first CMS ever created and/or available and also came with lots of awesome features. But it had a price: It had unprofessional code, it was very unstable, and almost unmaintainable, and then last but not least it was horribly insecure. If you want to know why it has some of the security holes or problems that it had, you would have to take a look under the hood, maybe explore some of the old original source code, you would see right away why someone needed to organize re-write and clean up. During the time of its production and release SQL injection and a few other security risks were a big problem: Search Engine, Contact Form, Forged Cookies, you name it. It was almost impossible to maintain so some folks got togethor and added a security layer, covering every security case you could imagine. Thus the birth of NukeSentinel...

CURRENT FEATURES:
  1. Improved Scripting Attack filters.
  2. Repaired a couple of missing tags in admin pages.
  3. Updated Blocks for titles and compliance.
  4. Moved "Country List" link to the main menu.
  5. 100% W3C XHTML 1.0 Transitional Compliant.
  6. The administrator can define the ability to have blocked users either: a) be forwarded to a page (or) b) be forwarded to an admin-defined URL.
  7. Enhanced Administration Functions.
  8. Writes information to Apache's .htaccess file (for increased security on blocking).
  9. Cleaned up coding and variables.
10. Can now remove blocked ip's from Apache's .htaccess file while removing them from the DB.
11. Can alter blocked ip's in Apache's .htaccess file while altering them in the DB.
12. Improved paging system in the Administration area.
13. Added Remote IP and User-Agent to the "blocked" page display.
14. Added CLIKE protection with an on/off switch.
15. Added UNION protection with an on/off switch.
16. Added Harvester protection with an on/off switch.
17. Added AUTHORS table protection with on/off switch.
18. Improved speed relating to blocked ip checking.
19. Added Page Sorting options for blocked ip pages.
20. Added PC Killer option.
21. Repaired PC Killer loop problem.
22. Added "Last 10 Blocked IPs" block.
23. Reconfigured the nsnst_config table.
24. Repaired language file loading.
25. Updated the lang-english.php file.
26. Updated blockers to allow email only, block and email, and off.
27. Repaired "Edit Blocked IP" routine.
28. Repaired NukeSentinel(tm) Configuration.
29. Now clears user sessions from both Nuke as well as Forums tables.
30. Added a new block that shows IP lookups to the public as well as to admins.
31. Added "blocker type" specific responses.
32. Added the ability for block settings to now show ip lookup link and reason.
33. Enabled Multiple email addresses for notifications. (may need work).
34. Will match db stored IP addresses of xxx.*.*.* as global blocks.
35. When blocking IP's it will use .* as the global range.
36. Enabled Blocker-specific information to be written to Apache's .htaccess file(if your server supports it).
37. Enabled Blocker specific forwarding.
38. Enabled "Protected Admins" functions (Can only be set up by the "God" level Administrator)
39. Enabled "HTTP Auth" function (If your server has PHP compiled as an Apache Module, but not if your server has PHP compiled in CGI Mode).
40. Enabled "Proxy Blocker" capabilities with on/off switch.
41. Enabled DOS (Denial Of Service) Attack Protection.
42. Enabled Mouse-over & Mouse-clicks Options in Help System.
43. Enabled Mouse-clicks for Info System.
44. Corrected problem with sites pulling your backend.php news feed.
45. Reordered blockers for better trapping of attacks.
46. Corrected a bad case for IP2C Searching.
47. Corrected the is_god function. Around line 801 you can allow superusers in but as default, it requires God status.
48. Corrected the blockers error of an empty set.
49. Corrected a missing HELP define.
50. Added Santy Worm protection (Thanks to NSN France)
51. Added check box so you can return to the Add IP/Range screens faster
52. Recoded includes/nukesentinel.php to load and run faster.
53. Rebuilt the Search function to search all IP areas at once and display the results.
54. Added test switch for HTTPAuth and register_globals. Helps prevent admins being locked out of admin.php.
55. Added switch for Santy Worm protection.
56. NEW import system for adding IP 2 Country data and importing Blocked Ranges.
57. Created master globals in includes/nukesentinel.php for easier and faster processing.
58. You can use the new master global by adding to your global lines throughout PHP-Nuke.
59. Adapted for 7.7 WYSIWYG editor. (Thanks to WD-40)
60. Enclosed table and field names with ` marks on SQL queries.
61. Improved the Add IP 2 Country Range failure report page.
62. includes/nukesentinel.php checks for the var and sets it if it isn't set.
63. Added Country Listing page in IP 2 Country management. Now you can easily find the c2c codes.
64. Changed the IP Tracking from a max number of lines to a max number of days.
65. Added the gfx=gfx_little clause to prevent being tracked and wasting DB space.
66. Removed unused code and language defines.
67. Corrected a Search Results error.
68. Re-ordered the lang file to prevent Undefined error.
69. ChatServ updates to replace == "" to empty() in many locations.
70. Updated Edit Instructions (Includes updates by ChatServ for Patched 3.1).
71. Moved import directory out of the admin directory structure so it can be deleted after importing data easier.
72. Added routines to check the range database table for overlaps.
73. Updated import data (ip2country data from the NukeScripts site).
74. NEW Flood Protection on GET and POST requests. (Thanks to Manuel)
75. Added global for SERVER_ADDR as $nsnst_const['server_ip']. Can be useful in
       other scripts to check if the request comes from your server or from a client.