Sep 20, 2011

Pick Color From Image & Matching PMS colors (Pantone color)


Sometimes client give me a logo picture , and i have to confirm with them what PMS color we will use , here is my experience .

some friends have Photoshop , they can open the picture and use color picker to get a PMS color code . how ever sometimes i feel the Photoshop give a PMS code is not very close to what i think. if fact i think the color is very far away , i don't know why is this code .

another problem is i don't have Photoshop on my notebook, so i can not use it to get an advice .

i made a web page to solve this problem, i can get some advice online free , very easy, simple. here is what i do.
  1. go http://www.ginifab.com/feeds/pms/pms_color_in_image.php
  2. upload my logo image
  3. pick the pixel, click a point on the image
  4. if any close code, it will show some PMS codes advice.
now i know what Pantone code can be used :)

Sep 4, 2011

oscommerce script attacks - admin/banner_manager.php/login.php

Recently i found a script attack my web sites from many IPs , below is the small part of my log . you can check your raw access log or error log to see if you are under attack. i got about 1000~2000 attacks everyday from over 100 IPs. today i banned 200 IPs. :(

friends , do you have same problem like me . let's see how to solve it . i don't have admin folder , and i don't have banner_manager.php , but they still try to access , everyday .

===========================================
85.17.171.87 - - [01/Sep/2011:22:05:39 -0700] "GET /admin/banner_manager.php/
login.php HTTP/1.1" 403 1244 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:39 -0700] "GET /admin/categories.php/login.php HTTP/1.1" 403 444 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:39 -0700] "GET /catalog/admin/banner_manager.php/login.php HTTP/1.1" 403 456 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:39 -0700] "GET /catalog/products_new.php?page=2/admin/banner_manager.php/login.php HTTP/1.1" 200 66745 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:39 -0700] "GET /catalog/products_new.php?page=2/admin/categories.php/login.php HTTP/1.1" 200 66796 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:40 -0700] "GET /admin/file_manager.php/login.php HTTP/1.1" 403 446 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:40 -0700] "GET /catalog/admin/categories.php/login.php HTTP/1.1" 403 452 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:40 -0700] "GET /catalog/admin/file_manager.php/login.php HTTP/1.1" 403 454 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"
85.17.171.87 - - [01/Sep/2011:22:05:40 -0700] "GET /catalog/products_new.php?page=2/admin/file_manager.php/login.php HTTP/1.1" 403 438 "-" "Mozilla/5.0 (compatible;Baiduspider/2.0;+http://www.baidu.com/search/spider.html)"

================================================

here is what i do ,

1.banned this ip by a script , auto filter , i use modified a addon http://addons.oscommerce.com/info/7509 to myself .

even i banned the IP , it still access my site so this should be a script attack , so ...

2,i got to find out who is the host owner , i use http://whois.domaintools.com/ and http://who.is/ , then i will got some owner email and host name , check their site, then try to write email to notify them . this is a funny job , it make me feel like i got told somebody ,
"Hei , your dog shit everywhere , could you please check it" lol

anyway my host company don't do this , they just complain my CUP usage too much , then tell me they will suspended my account , so i got do this by my self .....

some people will reply you , John Sinteur is a nice guy , he reply me friendly , welcome to visit his site http://www.sinteur.com/ , his site is funny . he give me a solution of his . list below

=============================================
can you tell me how do you solve this ?

Check the full processlist on my server for weird processes ("ps aux")
Check the output of lsof (which is usually very long) and eleminate everythibg I know about, what's left is investigated.

Kill everything found.

That eliminates the outbound attacks, and it gives you hints which files are doing the bad things. This time I found them in /tmp

The user id that owns the files is an indication what process was hacked. In this case it ran as the webserver user.

I have only a few websites at that IP address, so I checked all the recently written or modified files and directories in those website where the website owner could write.

That way I found the enclosed file. I removed the write privilieges of the diectories and told the owner of the OSCommerce shop the directory belonged to that uploading images for products was disabled until the exploit that was used to penetrate OSCommerce was fixed.

Next, I checked the webserver log to see which IP addresses accessed those files and blacklisted those as well.
=============================================

Your Supplier New Products

Your Supplier New Articles

China Direct New Products

China Direct New Articles