Return to Answer

The carrot before the word "author" means that the QUERY_STRING must start with author= and this can be easily avoided with a URL like "?test&author=1 ... I also added 3 options after the = that must be present for enumeration.

Source Link

edit approved May 13 at 17:26

Del tree

I want to post my own vision:

RewriteCond %{REQUEST_URI} ^/$
RewriteCond %{QUERY_STRING} ^author=author=(\%|\+|\d) [NC]
RewriteRule (.*) $1? [L]

First line detects only home page. I'll explain why. This "user-enumeration" feature works only on home page, so no need to rewrite all urls.

Next we look for author= query string. It's obvious.

Finally, we just show original page without any blocks, redirects (301, 302) or bans (403). Shouldn't it act like a page with any other useless parameter?

I want to post my own vision:

RewriteCond %{REQUEST_URI} ^/$
RewriteCond %{QUERY_STRING} ^author= [NC]
RewriteRule (.*) $1? [L]

First line detects only home page. I'll explain why. This "user-enumeration" feature works only on home page, so no need to rewrite all urls.

Next we look for author= query string. It's obvious.

Finally, we just show original page without any blocks, redirects (301, 302) or bans (403). Shouldn't it act like a page with any other useless parameter?

I want to post my own vision:

RewriteCond %{REQUEST_URI} ^/$
RewriteCond %{QUERY_STRING} author=(\%|\+|\d) [NC]
RewriteRule (.*) $1? [L]

First line detects only home page. I'll explain why. This "user-enumeration" feature works only on home page, so no need to rewrite all urls.

Next we look for author= query string. It's obvious.

Finally, we just show original page without any blocks, redirects (301, 302) or bans (403). Shouldn't it act like a page with any other useless parameter?

Source Link

created Jun 19, 2019 at 16:13

vladkras

I want to post my own vision:

RewriteCond %{REQUEST_URI} ^/$
RewriteCond %{QUERY_STRING} ^author= [NC]
RewriteRule (.*) $1? [L]

First line detects only home page. I'll explain why. This "user-enumeration" feature works only on home page, so no need to rewrite all urls.

Next we look for author= query string. It's obvious.

Finally, we just show original page without any blocks, redirects (301, 302) or bans (403). Shouldn't it act like a page with any other useless parameter?