How can i make my all webistes only accessible by browsers and not auto scripts

Question

I have that my websites have been hacked by some auto running libwww-perl BOT/0.1 (BOT for JCE) and Gecko/20100101

Is there any way that my all websites are only avaiable to genuine browsers and not these automated scripts.

Answer 1

No, you cannot ensure that your websites are only available to genuine browsers. This is because the only sources of data you have to determine the client's platform and web browser are the request headers, which can be completely forged by hackers.

For example, a hacker could use a tool like Fiddler to send a custom HTTP request to your website with a forged User-Agent request header that looks just like Internet Explorer, Chrome, Firefox, Googlebot, or some other HTTP client. Thus, it is very difficult, if not impossible, to discern a hacker from a legitimate user based on HTTP request data.

Answer 2

I could give you lists of countless defenses you could put up (limiting user agents, making your content appear using JavaScript from XML files, captchas - what a great way to piss off your audience!) but they're only going to stave off the inevitable while they work out how to get around them.

It would be best to drive a stake through the problem's heart rather than try to put defense after defense in place. If you're able, look at the application and try to find out how they were able to get in, and try to patch the holes. The most obvious places to look are form inputs - do these get passed to SQL strings without being parsed first? Are they generating SQL strings instead of using prepared statements (which kill off SQL injection attempts from the word go)? If it's something you can fix, do. If it's someone else's product, create a patch and send it to them.

The worst thing you can do in security is assume it won't happen to you. Worms, viruses and autobots are usually not smart enough to realise your little site isn't a threat.

Be smart, be safe, be aware.