Re: [tlug] Blocking unknown and unclear bots

[Edward Middleton <edward.middleton@example.com>]

eredicatorx@example.com wrote:
> On 02/23/2010 07:37 PM, Stephen J. Turnbull wrote:
>   
>> Curt Sampson writes:
>>
>>   >  I don't understand. So if a "good" bot and a "bad" bot swop IP
>>   >  addresses, you start blocking the (presumably ex-) "good" bot, and now
>>   >  allow the (presumably ex-) "bad" bot?   
>>     
>
> How would one sensor a bot based on these kind of queries it makes?
>
> A brief example is all I am looking for. Frequently Drupal becomes 
> vulnerable to Cross Site Scripting attacks, and if I found a bot that 
> was searching for that, how would I stop, delay or other wise thwart 
> their evil.
>   

Use a web application firewall WAF like mod_security[1][2].

Edward

1. http://tlug.jp/wiki/Meetings:2008:09#.3C.3C_Presentation_.281.29_.3E.3E
2. http://www.modsecurity.org/