Misc File Skip/Bypass Rule

Yep, Custom Code requires manual editing. Edit your custom code in the 11. CUSTOM CODE TIMTHUMB FORBID RFI and MISC FILE SKIP/BYPASS RULE text box, click the Save Root Custom Code button and click the Root Folder BulletProof Mode Activate button.

May I know what’s the purpose of whitelisting our own domain, as since it is our own domain, why it needs to be manually whitelisted?

Secondly, is the following the correct input to whitelist my own domain?

# Example: Whitelist additional website domains: RewriteCond %{HTTP_REFERER} ^.*(YourWebsite.com|AnotherWebsite.com).*
RewriteCond %{HTTP_REFERER} ^.*mydomain.com.*
RewriteRule . - [S=1]

That section of BPS htaccess code protects against the old Tim Thumb hack and more importantly RFI hacking attempts > https://www.owasp.org/index.php/Testing_for_Remote_File_Inclusion

The code works like this > If the referring domain is your own domain then skip [S-1] the BPS Query String section of code, which contains RFI security rules that will block RFI hacking attempts against your website. Since Requests using your own website domain are Local and not Remote Requests then the Skip Rule allows simulated RFI hacking attempts: https://your-website-domain.com/?file=https://your-website-domain.com/some-safe-file-on-your-website-domain.php. RFI stands for Remote File Inclusion.

• This reply was modified 5 years, 10 months ago by AITpro.

Hi BPS,

Very sorry, I can understand this:

That section of BPS htaccess code protects against the old Tim Thumb hack and more importantly RFI hacking attempts > https://www.owasp.org/index.php/Testing_for_Remote_File_Inclusion

But not this:

The code works like this > If the referring domain is your own domain then skip [S-1] the BPS Query String section of code, which contains RFI security rules that will block RFI hacking attempts against your website. Since Requests using your own website domain are Local and not Remote Requests then the Skip Rule allows simulated RFI hacking attempts: https://your-website-domain.com/?file=https://your-website-domain.com/some-safe-file-on-your-website-domain.php. RFI stands for Remote File Inclusion.

Do you mean that With the following block of codes, mydomain.com is 1) protected from external RFI hacking attempts and 2) whitelisted from internal RFI hacking attempts (RFI hacking attempts sent out from mydomain.com)?

# Example: Whitelist additional website domains: RewriteCond %{HTTP_REFERER} ^.*(YourWebsite.com|AnotherWebsite.com).*
RewriteCond %{HTTP_REFERER} ^.*mydomain.com.*
RewriteRule . - [S=1]

Please advise, thank you!

The keyword to focus on is “remote” in the Remote File Inclusion hacking method. If the referring website is local (your website) then the Request cannot be a Remote File Inclusion attack against your website.

Understood ??

Thank you for the great invention and kind response!