[DBTech] DragonByte Security

[DBTech] DragonByte Security [Paid] 4.7.0

No permission to buy ($14.95)
Overview Updates (45) Reviews (3) History Discussion
Nirjonadda said:
@DragonByte Tech Server error log after update.

Code: 
InvalidArgumentException: json_decode error: Syntax error src/vendor/guzzlehttp/guzzle/src/functions.php:304

Generated by: Unknown account Jul 5, 2019 at 10:41 PM

Stack trace

#0 src/addons/DBTech/Security/Repository/Watcher.php(236): GuzzleHttp\json_decode('', true)
#1 src/addons/DBTech/Security/XF/Service/User/Login.php(50): DBTech\Security\Repository\Watcher->breachCheck(Object(Datio\AllowedEmails\XF\Entity\User))
#2 src/XF/Service/User/Login.php(124): DBTech\Security\XF\Service\User\Login->recordFailedAttempt()
#3 src/XF/Pub/Controller/Login.php(89): XF\Service\User\Login->validate('*****', NULL)
#4 src/XF/Mvc/Dispatcher.php(321): XF\Pub\Controller\Login->actionLogin(Object(XF\Mvc\ParameterBag))
#5 src/XF/Mvc/Dispatcher.php(244): XF\Mvc\Dispatcher->dispatchClass('XF:Login', 'Login', Object(XF\Mvc\RouteMatch), Object(xenMade\LAU\XF\Pub\Controller\Login), NULL)
#6 src/XF/Mvc/Dispatcher.php(100): XF\Mvc\Dispatcher->dispatchFromMatch(Object(XF\Mvc\RouteMatch), Object(xenMade\LAU\XF\Pub\Controller\Login), NULL)
#7 src/XF/Mvc/Dispatcher.php(50): XF\Mvc\Dispatcher->dispatchLoop(Object(XF\Mvc\RouteMatch))
#8 src/XF/App.php(2177): XF\Mvc\Dispatcher->run()
#9 src/XF.php(390): XF\App->run()
#10 index.php(20): XF::runApp('XF\\Pub\\App')
#11 {main}

Request state

array(4) {
  ["url"] => string(12) "/login/login"
  ["referrer"] => string(29) "/login/"
  ["_GET"] => array(0) {
  }
  ["_POST"] => array(5) {
    ["login"] => string(5) "milon"
    ["password"] => string(8) "********"
    ["remember"] => string(1) "1"
    ["_xfRedirect"] => string(49) "/threads/bintub.2578/page-3"
    ["_xfToken"] => string(8) "********"
  }
}
Click to expand...


Same issue here!
 
Request for an additional Function

Fingerprints

LogIn as User1 (Chrome) -> Fingerprint is logged
LogIn as User2 (Chrome Stealth) - No Fingerprint is logged

Fingerprints of a second User loggin into the same browser on the same Computer are not logged.
We would like to use this funktion to track down users with mutiple Accounts ... would it be possible to implement such a funktion?
 
John we said:
Request for an additional Function

Fingerprints

LogIn as User1 (Chrome) -> Fingerprint is logged
LogIn as User2 (Chrome Stealth) - No Fingerprint is logged

Fingerprints of a second User loggin into the same browser on the same Computer are not logged.
We would like to use this funktion to track down users with mutiple Accounts ... would it be possible to implement such a funktion?
Click to expand...
It is not possible to bypass a browser’s refusal to provide fingerprinting data.
 
Sperber said:
Is it possible to include a function to deny access by the fact that a browser refuses to provide fingerprinting data?
Click to expand...
No. What I said was an oversimplification. It's not that browsers "refuse", it's that they deliberately exclude information that is used as part of the fingerprinting process. For instance, if you have a rare font installed on your computer, that would be a part of the fingerprinting process by requesting the list of available fonts. Browsers may choose to only reveal the system fonts, instead letting the rendering engine determine what font to use when actually rendering fonts. This means there is no visual difference to the user, but fingerprinting techniques are less effective by the nature of the fact that it only sees the exact same fonts as every other macOS user or every other Windows user.

Sperber said:
When will this feature be available?
Click to expand...
IIRC it is available now, I just didn't update the description yet.
 
DragonByte Tech said:
No. What I said was an oversimplification. It's not that browsers "refuse", it's that they deliberately exclude information that is used as part of the fingerprinting process. For instance, if you have a rare font installed on your computer, that would be a part of the fingerprinting process by requesting the list of available fonts. Browsers may choose to only reveal the system fonts, instead letting the rendering engine determine what font to use when actually rendering fonts. This means there is no visual difference to the user, but fingerprinting techniques are less effective by the nature of the fact that it only sees the exact same fonts as every other macOS user or every other Windows user.
Click to expand...
Makes sense. Thanks for clearification.
DragonByte Tech said:
IIRC it is available now, I just didn't update the description yet.
Click to expand...
IIRC? Seems you´re getting old ;)
 
Sperber said:
IIRC? Seems you´re getting old ;)
Click to expand...
BACK IN MY DAY WE RESPECTED OUR ELDERS! 👴

In all seriousness though; I did look in the account/security page and it does seem like the user agent and ability to kill permanently logged in sessions is there.

Thinking back, the only missing part is the ability to invalidate temporary sessions (sessions without the "Remember Me" checkbox). The old method didn't work very well, and also only worked with cookie sessions. XF2 supports the ability to store cookies in other locations, further complicating the feature.

For that reason I decided to only support killing permanent sessions :)
 
DragonByte Tech said:
For that reason I decided to only support killing permanent sessions :)
Click to expand...

Mhm. That way hijacked sessions would be excluded, right? Aside from that a guy with bad intentions won´t tick the remember me box for obvious reasons. Any plans to think your decision over again? ;)
 
Sperber said:
Mhm. That way hijacked sessions would be excluded, right? Aside from that a guy with bad intentions won´t tick the remember me box for obvious reasons. Any plans to think your decision over again? ;)
Click to expand...
Sorry, I wasn't very clear. It wasn't a decision between "should I bother adding support for these other session storage methods or not", it was "should I add what I can from this feature or should I just drop the feature entirely".

So no, I won't be rethinking it as that would mean eliminating the feature entirely :)
 
@DragonByte Tech Still not fixed this server error log.

Code: 
InvalidArgumentException: json_decode error: Syntax error src/vendor/guzzlehttp/guzzle/src/functions.php:304

Generated by: Unknown account Jul 16, 2019 at 11:18 PM

Stack trace

#0 src/addons/DBTech/Security/Repository/Watcher.php(241): GuzzleHttp\json_decode('<!DOCTYPE ht...', true)
#1 src/addons/DBTech/Security/XF/Service/User/Login.php(50): DBTech\Security\Repository\Watcher->breachCheck(Object(Datio\AllowedEmails\XF\Entity\User))
#2 src/XF/Service/User/Login.php(124): DBTech\Security\XF\Service\User\Login->recordFailedAttempt()
#3 src/XF/Pub/Controller/Login.php(89): XF\Service\User\Login->validate('[B]*[/B]', NULL)
#4 src/XF/Mvc/Dispatcher.php(321): XF\Pub\Controller\Login->actionLogin(Object(XF\Mvc\ParameterBag))
#5 src/XF/Mvc/Dispatcher.php(244): XF\Mvc\Dispatcher->dispatchClass('XF:Login', 'Login', Object(XF\Mvc\RouteMatch), Object(xenMade\LAU\XF\Pub\Controller\Login), NULL)
#6 src/XF/Mvc/Dispatcher.php(100): XF\Mvc\Dispatcher->dispatchFromMatch(Object(XF\Mvc\RouteMatch), Object(xenMade\LAU\XF\Pub\Controller\Login), NULL)
#7 src/XF/Mvc/Dispatcher.php(50): XF\Mvc\Dispatcher->dispatchLoop(Object(XF\Mvc\RouteMatch))
#8 src/XF/App.php(2177): XF\Mvc\Dispatcher->run()
#9 src/XF.php(390): XF\App->run()
#10 index.php(20): XF::runApp('XF\\Pub\\App')
#11 {main}

Request state

array(4) {
  ["url"] => string(12) "/login/login"
  ["referrer"] => string(34) "/login/login"
  ["_GET"] => array(0) {
  }
  ["_POST"] => array(5) {
    ["login"] => string(21) "@gmail.com"
    ["password"] => string(8) "[B]****[/B]"
    ["remember"] => string(1) "1"
    ["_xfRedirect"] => string(34) "/login/login"
    ["_xfToken"] => string(8) "[B]****[/B]"
  }
}
 
Nirjonadda said:
@DragonByte Tech Still not fixed this server error log.

Code: 
InvalidArgumentException: json_decode error: Syntax error src/vendor/guzzlehttp/guzzle/src/functions.php:304

Generated by: Unknown account Jul 16, 2019 at 11:18 PM

Stack trace

#0 src/addons/DBTech/Security/Repository/Watcher.php(241): GuzzleHttp\json_decode('<!DOCTYPE ht...', true)
#1 src/addons/DBTech/Security/XF/Service/User/Login.php(50): DBTech\Security\Repository\Watcher->breachCheck(Object(Datio\AllowedEmails\XF\Entity\User))
#2 src/XF/Service/User/Login.php(124): DBTech\Security\XF\Service\User\Login->recordFailedAttempt()
#3 src/XF/Pub/Controller/Login.php(89): XF\Service\User\Login->validate('[B]*[/B]', NULL)
#4 src/XF/Mvc/Dispatcher.php(321): XF\Pub\Controller\Login->actionLogin(Object(XF\Mvc\ParameterBag))
#5 src/XF/Mvc/Dispatcher.php(244): XF\Mvc\Dispatcher->dispatchClass('XF:Login', 'Login', Object(XF\Mvc\RouteMatch), Object(xenMade\LAU\XF\Pub\Controller\Login), NULL)
#6 src/XF/Mvc/Dispatcher.php(100): XF\Mvc\Dispatcher->dispatchFromMatch(Object(XF\Mvc\RouteMatch), Object(xenMade\LAU\XF\Pub\Controller\Login), NULL)
#7 src/XF/Mvc/Dispatcher.php(50): XF\Mvc\Dispatcher->dispatchLoop(Object(XF\Mvc\RouteMatch))
#8 src/XF/App.php(2177): XF\Mvc\Dispatcher->run()
#9 src/XF.php(390): XF\App->run()
#10 index.php(20): XF::runApp('XF\\Pub\\App')
#11 {main}

Request state

array(4) {
  ["url"] => string(12) "/login/login"
  ["referrer"] => string(34) "/login/login"
  ["_GET"] => array(0) {
  }
  ["_POST"] => array(5) {
    ["login"] => string(21) "@gmail.com"
    ["password"] => string(8) "[B]****[/B]"
    ["remember"] => string(1) "1"
    ["_xfRedirect"] => string(34) "/login/login"
    ["_xfToken"] => string(8) "[B]****[/B]"
  }
}
Click to expand...


Same problem here
 
If i enable Bad Behaviour Detection forum will "break" and display this error on a white page

Code: 
An exception occurred: [ErrorException] [E_WARNING] getallheaders() has been disabled for security reasons in src/addons/DBTech/Security/3rdParty/bad-behavior/functions.inc.php on line 75

XF::handlePhpError()
getallheaders() in src/addons/DBTech/Security/3rdParty/bad-behavior/functions.inc.php at line 75
bb2_load_headers() in src/addons/DBTech/Security/3rdParty/bad-behavior/core.inc.php at line 87
bb2_start() in src/addons/DBTech/Security/Listener.php at line 215
DBTech\Security\Listener::dispatcherPostRender()
call_user_func_array() in src/XF/Extension.php at line 67
XF\Extension->fire() in src/XF/App.php at line 2648
XF\App->fire() in src/XF/Mvc/Dispatcher.php at line 367
XF\Mvc\Dispatcher->render() in src/XF/Mvc/Dispatcher.php at line 53
XF\Mvc\Dispatcher->run() in src/XF/App.php at line 2178
XF\App->run() in src/XF.php at line 390
XF::runApp() in index.php at line 20

Error log on admin panel:
Code: 
ErrorException: [E_WARNING] getallheaders() has been disabled for security reasons src/addons/DBTech/Security/3rdParty/bad-behavior/functions.inc.php:75
Generated by: Unknown account Jul 29, 2019 at 7:08 PM



Stack trace
#0 [internal function]: XF::handlePhpError(2, '[E_WARNING] get...', '/share/www/forum...', 75, Array)
#1 src/addons/DBTech/Security/3rdParty/bad-behavior/functions.inc.php(75): getallheaders()
#2 src/addons/DBTech/Security/3rdParty/bad-behavior/core.inc.php(87): bb2_load_headers()
#3 src/addons/DBTech/Security/Listener.php(215): bb2_start(Array)
#4 [internal function]: DBTech\Security\Listener::dispatcherPostRender(Object(XF\Mvc\Dispatcher), '<!DOCTYPE html>...', Object(XF\Mvc\Reply\View), Object(XF\Mvc\Renderer\Html), Object(XF\Http\Response))
#5 src/XF/Extension.php(67): call_user_func_array(Array, Array)
#6 src/XF/App.php(2648): XF\Extension->fire('dispatcher_post...', Array, NULL)
#7 src/XF/Mvc/Dispatcher.php(367): XF\App->fire('dispatcher_post...', Array)
#8 src/XF/Mvc/Dispatcher.php(53): XF\Mvc\Dispatcher->render(Object(XF\Mvc\Reply\View), 'html')
#9 src/XF/App.php(2178): XF\Mvc\Dispatcher->run()
#10 src/XF.php(390): XF\App->run()
#11 index.php(20): XF::runApp('XF\\Pub\\App')
#12 {main}


Request state
array(4) {
  ["url"] => string(77) "/threads/randomthread.1766/page-13"
  ["referrer"] => bool(false)
  ["_GET"] => array(1) {
    ["/threads/randomthread/page-13"] => string(0) ""
  }
  ["_POST"] => array(0) {
  }
}
 
siONtI said:
If i enable Bad Behaviour Detection forum will "break" and display this error on a white page

Code: 
An exception occurred: [ErrorException] [E_WARNING] getallheaders() has been disabled for security reasons in src/addons/DBTech/Security/3rdParty/bad-behavior/functions.inc.php on line 75

XF::handlePhpError()
getallheaders() in src/addons/DBTech/Security/3rdParty/bad-behavior/functions.inc.php at line 75
bb2_load_headers() in src/addons/DBTech/Security/3rdParty/bad-behavior/core.inc.php at line 87
bb2_start() in src/addons/DBTech/Security/Listener.php at line 215
DBTech\Security\Listener::dispatcherPostRender()
call_user_func_array() in src/XF/Extension.php at line 67
XF\Extension->fire() in src/XF/App.php at line 2648
XF\App->fire() in src/XF/Mvc/Dispatcher.php at line 367
XF\Mvc\Dispatcher->render() in src/XF/Mvc/Dispatcher.php at line 53
XF\Mvc\Dispatcher->run() in src/XF/App.php at line 2178
XF\App->run() in src/XF.php at line 390
XF::runApp() in index.php at line 20

Error log on admin panel:
Code: 
ErrorException: [E_WARNING] getallheaders() has been disabled for security reasons src/addons/DBTech/Security/3rdParty/bad-behavior/functions.inc.php:75
Generated by: Unknown account Jul 29, 2019 at 7:08 PM



Stack trace
#0 [internal function]: XF::handlePhpError(2, '[E_WARNING] get...', '/share/www/forum...', 75, Array)
#1 src/addons/DBTech/Security/3rdParty/bad-behavior/functions.inc.php(75): getallheaders()
#2 src/addons/DBTech/Security/3rdParty/bad-behavior/core.inc.php(87): bb2_load_headers()
#3 src/addons/DBTech/Security/Listener.php(215): bb2_start(Array)
#4 [internal function]: DBTech\Security\Listener::dispatcherPostRender(Object(XF\Mvc\Dispatcher), '<!DOCTYPE html>...', Object(XF\Mvc\Reply\View), Object(XF\Mvc\Renderer\Html), Object(XF\Http\Response))
#5 src/XF/Extension.php(67): call_user_func_array(Array, Array)
#6 src/XF/App.php(2648): XF\Extension->fire('dispatcher_post...', Array, NULL)
#7 src/XF/Mvc/Dispatcher.php(367): XF\App->fire('dispatcher_post...', Array)
#8 src/XF/Mvc/Dispatcher.php(53): XF\Mvc\Dispatcher->render(Object(XF\Mvc\Reply\View), 'html')
#9 src/XF/App.php(2178): XF\Mvc\Dispatcher->run()
#10 src/XF.php(390): XF\App->run()
#11 index.php(20): XF::runApp('XF\\Pub\\App')
#12 {main}


Request state
array(4) {
  ["url"] => string(77) "/threads/randomthread.1766/page-13"
  ["referrer"] => bool(false)
  ["_GET"] => array(1) {
    ["/threads/randomthread/page-13"] => string(0) ""
  }
  ["_POST"] => array(0) {
  }
}
Click to expand...
Talk to your host so they can unblock getallheaders or move to a better host if they refuse.
 
DragonByte Tech updated [DBTech] DragonByte Security with a new update entry:

4.2.6

Update highlights

This version makes changes to the way API lookups are handled in order to protect against invalid responses from APIs such as HaveIBeenPwned.

The new privacy-focused API calls made the response data more susceptible to invalid data being parsed, but hopefully these changes should resolve that permanently.


Complete Change Log

Change: Add protection from invalid responses from various API lookups
Fix: Fixed an issue where...
Click to expand...

Read the rest of this update entry...
 
@DragonByte Tech Getting lot of this type Server error log.

Code: 
ErrorException: Received unexpected response code 403 (Forbidden) src/XF/Error.php:75

Generated by: Unknown account Aug 17, 2019 at 1:11 AM

Stack trace

#0 src/XF.php(187): XF\Error->logError(Object(XF\Phrase), false)
#1 src/addons/DBTech/Security/Repository/Watcher.php(272): XF::logError(Object(XF\Phrase))
#2 src/addons/DBTech/Security/XF/Service/User/Login.php(50): DBTech\Security\Repository\Watcher->breachCheck(Object(Datio\AllowedEmails\XF\Entity\User))
#3 src/XF/Service/User/Login.php(124): DBTech\Security\XF\Service\User\Login->recordFailedAttempt()
#4 src/XF/Pub/Controller/Login.php(93): XF\Service\User\Login->validate('*****', NULL)
#5 src/XF/Mvc/Dispatcher.php(321): XF\Pub\Controller\Login->actionLogin(Object(XF\Mvc\ParameterBag))
#6 src/XF/Mvc/Dispatcher.php(244): XF\Mvc\Dispatcher->dispatchClass('XF:Login', 'Login', Object(XF\Mvc\RouteMatch), Object(xenMade\LAU\XF\Pub\Controller\Login), NULL)
#7 src/XF/Mvc/Dispatcher.php(100): XF\Mvc\Dispatcher->dispatchFromMatch(Object(XF\Mvc\RouteMatch), Object(xenMade\LAU\XF\Pub\Controller\Login), NULL)
#8 src/XF/Mvc/Dispatcher.php(50): XF\Mvc\Dispatcher->dispatchLoop(Object(XF\Mvc\RouteMatch))
#9 src/XF/App.php(2178): XF\Mvc\Dispatcher->run()
#10 src/XF.php(390): XF\App->run()
#11 index.php(20): XF::runApp('XF\\Pub\\App')
#12 {main}

Request state

array(4) {
  ["url"] => string(12) "/login/login"
  ["referrer"] => string(34) "/login/login"
  ["_GET"] => array(0) {
  }
  ["_POST"] => array(5) {
    ["login"] => string(12) "portechai123"
    ["password"] => string(8) "********"
    ["remember"] => string(1) "1"
    ["_xfRedirect"] => string(37) "/threads/57225/"
    ["_xfToken"] => string(8) "********"
  }
}
 
Nirjonadda said:
@DragonByte Tech Getting lot of this type Server error log.

Code: 
ErrorException: Received unexpected response code 403 (Forbidden) src/XF/Error.php:75

Generated by: Unknown account Aug 17, 2019 at 1:11 AM

Stack trace

#0 src/XF.php(187): XF\Error->logError(Object(XF\Phrase), false)
#1 src/addons/DBTech/Security/Repository/Watcher.php(272): XF::logError(Object(XF\Phrase))
#2 src/addons/DBTech/Security/XF/Service/User/Login.php(50): DBTech\Security\Repository\Watcher->breachCheck(Object(Datio\AllowedEmails\XF\Entity\User))
#3 src/XF/Service/User/Login.php(124): DBTech\Security\XF\Service\User\Login->recordFailedAttempt()
#4 src/XF/Pub/Controller/Login.php(93): XF\Service\User\Login->validate('*****', NULL)
#5 src/XF/Mvc/Dispatcher.php(321): XF\Pub\Controller\Login->actionLogin(Object(XF\Mvc\ParameterBag))
#6 src/XF/Mvc/Dispatcher.php(244): XF\Mvc\Dispatcher->dispatchClass('XF:Login', 'Login', Object(XF\Mvc\RouteMatch), Object(xenMade\LAU\XF\Pub\Controller\Login), NULL)
#7 src/XF/Mvc/Dispatcher.php(100): XF\Mvc\Dispatcher->dispatchFromMatch(Object(XF\Mvc\RouteMatch), Object(xenMade\LAU\XF\Pub\Controller\Login), NULL)
#8 src/XF/Mvc/Dispatcher.php(50): XF\Mvc\Dispatcher->dispatchLoop(Object(XF\Mvc\RouteMatch))
#9 src/XF/App.php(2178): XF\Mvc\Dispatcher->run()
#10 src/XF.php(390): XF\App->run()
#11 index.php(20): XF::runApp('XF\\Pub\\App')
#12 {main}

Request state

array(4) {
  ["url"] => string(12) "/login/login"
  ["referrer"] => string(34) "/login/login"
  ["_GET"] => array(0) {
  }
  ["_POST"] => array(5) {
    ["login"] => string(12) "portechai123"
    ["password"] => string(8) "********"
    ["remember"] => string(1) "1"
    ["_xfRedirect"] => string(37) "/threads/57225/"
    ["_xfToken"] => string(8) "********"
  }
}
Click to expand...
That's not a bug, it means HaveIBeenPwned is having problems. That being said, the v2 of their API seems to be blocking more requests, I'll look into changing it to support v3.
 
You must log in or register to reply here.

Similar threads

DragonByte Tech
[DBTech] DragonByte Stripe Checkout
Replies
18
Views
561
Alpha1
Alpha1
DragonByte Tech
[DBTech] DragonByte WebP
Replies
16
Views
1K
DragonByte Tech
DragonByte Tech
DragonByte Tech
[DBTech] DragonByte Social Groups [Paid]
3 4 5
Replies
92
Views
6K
Chernabog
Chernabog
Painbaker
[OzzModz] Russian languge for [DBTech] DragonByte Security
Replies
2
Views
654
Ozzy47
Ozzy47
Sado Yasashii
Russian language for [DBTech] DragonByte eCommerce
Replies
0
Views
493
Sado Yasashii
Sado Yasashii
Top Bottom