17 ms·
Show HN: “HTTP 419 Never Gonna Give You Up” for bots
- dmitrijbelikov 5y agohttps://en.wikipedia.org/wiki/List_of_HTTP_status_codes#Unofficial_codes https://en.wikipedia.org/wiki/List_of_HTTP_status_codes#Unof... 419 Page Expired (Laravel Framework) Used by the Laravel Framework when a CSRF Token is missing or expired.
- noduerme 5y agohell, let's go up to 10000 response codes and sell them to the highest bidding meme of the year.
- Slade1 5y agoIf you're aware that someone is doing penetration tests on your system, but their probing isn't significantly costing you resources, wouldn't you instead just give some generic response to not clue them into you knowing their intention? There's a lot of people who basically do that with scam callers by just leading them on and wasting the scammers time.
- t0mas88 5y agoYou could but it's extra work to build that into the application while you could use a generic off the shelf WAF / IDS type solution that just blocks them. Won't fully stop a targeted manual attack but it is enough to make bots move on to their next target. And it slows down any manual reconnaissance work.
- saurik 5y agoBlocking someone is still more generic than returning a specific HTTP response code specifically designed to inform the other party of your suspicion.
- LinuxBender 5y agoI used to do something along this line. If I saw a bot then I would use ACL's in haproxy to serve up some static pages from memory that contained strings their request was looking for. This of course attracted more bots. It didn't cost me anything aside from making my logs a bit more noisy, so I disabled logging for the bots. Then I found a funny side effect of shodan showing my nodes being vulnerable to many things. That was a blemish so I disabled the ACL's. In hind-sight and knowing how bot farms work it wasn't really wasting anyone's time or resources but was a fun little learning exercise.
- verdverm 5y agoI wonder if zip bomb like responses will still work for the majority of bots https://blog.haschek.at/post/f2fda https://blog.haschek.at/post/f2fda
- LinuxBender 5y agoMaybe sometimes, but you would just be the reason some random person said "Dammit my machine blue screened again." or "Why is my machine using so much ram?" The C2 machines would detect this node offline and use a different one. On the plus side, maybe a percentage of those people would re-image their machines and patch them.
- hyperman1 5y agoSend them redirects to a russian governemental site. They'll take care of it
- arthurcolle 5y agoThis could be seen as abuse by the .ru and .su folks
- WesolyKubeczek 5y agoThose folks have been actively abusing international laws, sponsoring cybercrime, and responding with “so what?” That’s what. Deal with it. Build your enclosed cheburashka internets or whatever. I couldn’t care less about hurting their feelings.
- Waterluvian 5y agoRedirect to a honeypot as a service that utterly wastes someone’s time.
- zinekeller 5y ago> I’m half joking, but if we can have HTTP 418 I’m a Teapot then there is enough room in the HTTP standard for the more useful HTTP 419 Never Gonna Give You Up error code. Actually, there was a proposal to remove the 418 code formally, but in the end it was grandfathered in. Unfortunately, unless you have convinced a lot of people to allow 419, it would be not allowed anymore (even in a April Fools' RFC) according to the established protocol of IANA controlling the allocation of error codes, and IANA no longer allow "joke" allocations unless there was an RFC clarifying why that particular code must exists in a non-joking manner (see 451, in homage to Fahrenheit 451 but is the recommended code for a informed block). Even 418 was technically only reserved in such a way that allows it to be overridden in case that a good demonstration that 418 should be the code for that error.
- bradgessler 5y agoOne day I will make an IoT teapot. It will have an HTTP API that responds with a 418 and legitimize the code once and for all.
- unanswered 5y agoIANA controls http codes only insofar as no one has told them to knock it off yet. There's no major interop risk from conflicting (200, 400, 500) codes in the way there is for other namespaces because the semantics are essentially contained only in the first digit.
- deleted 5y ago[deleted]
- chrismorgan 5y agoThe thing that really disappoints me is that 418 I'm a Teapot isn’t registered—instead it’s reserved as “(Unused)”: https://www.iana.org/assignments/http-status-codes/http-status-codes.xhtml https://www.iana.org/assignments/http-status-codes/http-stat..., https://www.ietf.org/archive/id/draft-ietf-httpbis-semantics-19.html#section-15.5.19 https://www.ietf.org/archive/id/draft-ietf-httpbis-semantics.... As it stands, I suspect (as one that’s been involved in a couple and examined more back in 2013–2014) that most even vaguely recent HTTP libraries that have some kind of status code enum or constants defined take their data from the HTTP status codes registry, with a single exception for 418 I'm a Teapot. As far as a 419 is concerned, I’d argue that 418 is already suitable anyway as a joke alternative to the more serious 429/503: “wp-admin.php? I’m not WordPress, I’m a teapot!” (Similar style to the joke about one cow warning another about the mad cow disease in the area, and the other responding that it’s not not worried because it’s a helicopter.)
- nunez 5y agoa part of me is definitely in favor of this, but another part of me wants to avoid turning http error codes into a meme
- dane-pgp 5y agoNo, this is turning a meme into an HTTP error code. You're thinking of: https://i.redd.it/wmwqgt9kbop41.jpg https://i.redd.it/wmwqgt9kbop41.jpg
- gnyman 5y agoI definitely agree bots are underserved, I have a few things I do to keep them entertained, ssh bots are tar-pitted to keep them connected but busy, my hope is that I occupy at least one thread of not the whole process. For wp-login bots I serve them a nice chunk of random (generated by a fuzzer) html in the hopes that 1. It wastes abit of their bandwidth/memory and 2. it crashes their parser In reality I guess bots nowadays are sturdy enough to not get stuck or crash but who knows, feels good to do something :-) Tarpit instructions https://nyman.re/super-simple-ssh-tarpit/ https://nyman.re/super-simple-ssh-tarpit/ Wp-login page https://twitter.com/gnyman/status/1181652421841436672?s=20 https://twitter.com/gnyman/status/1181652421841436672?s=20 And I remembered another nice trick which someone else came up with, zip bomb the bots :-) https://blog.haschek.at/2017/how-to-defend-your-website-with-zip-bombs.html https://blog.haschek.at/2017/how-to-defend-your-website-with...
- SCHiM 5y agoAlthough I think bots should be free to access the same content as humans do, I have a suggestion for your fuzzer anti-bot-spray: It won't work on the more sturdy samples, but maybe try a GZIP bomb on https streams: https://www.infosecmatter.com/metasploit-module-library/?mm=auxiliary/dos/http/gzip_bomb_dos https://www.infosecmatter.com/metasploit-module-library/?mm=...
- rascul 5y agoCould there be legal repercussions for doing this?
- dusted 5y agoPre "guy views html source gets home raided for haxx0ring" I'd have said "you silly!" Now... I'd say "there shouldn't be, it's your server, people can chose to access it or not, but if the right kind of fool comes along, there's no knowing where the stupid ends."
- theshrike79 5y agoIt's your server and someone is accessing it. It's up to you what you serve them. If you want to be clear, you can put the gzip bomb behind a link that says "do not click, gzip bomb". The bot won't know the difference.
- deleted 5y ago[deleted]
- andrethegiant 5y agoIf it redirects then it should be in the 3xx class
- willcipriano 5y ago400's are errors caused by the client, I think that fits better.
- bradgessler 5y agoI was hesitant on the redirect. It would probably be easier to demand the spec displays "Never Gonna Give You Up" in the appropriate requested format.
- ufmace 5y agoProbably shouldn't be made an official thing, but it'd be funny to do this on all the various minor manually-adminned sites out there.
- deleted 5y ago[deleted]
- spiderfarmer 5y agoI would like to target the Brave search crawler/bot, but they’re hiding themselves like every other spambot: https://twitter.com/tinusg/status/1453862793933897729?s=21 https://twitter.com/tinusg/status/1453862793933897729?s=21
- sp332 5y agoThis says that the index is created from users' own web browsing, not from a bot.
- zeepzeep 5y agoWait brave indexes what you browse? How has there not been some bug yet? Can't imagine that going well...
- spiderfarmer 5y agoIt all seems quite scammy. They claim it's opt-in, but as a Brave user I can't find the option to opt-in or opt-out. They look the searches you do at Google and other search engines. The search terms and the results you click on gets sent their way, including metadata from the page. The content itself is downloaded by their bot (more like a fetcher). That bot has the user agent of a regular browser, so you won't see it. You also can't specifically block their fetcher. It only adheres to disallow *.
- _jal 5y agoI like the spirit of the idea, but messing with bots and script kiddies is best kept a highly local thing. You don't need a standardized error code to signal to a red team, you can say "hi" in a number of different ways, depending on what they're poking at. And if everyone is doing the same thing to script kiddies, well, where's the sport in that?
- lliamander 5y agoHTTP 420 - Enhance Your Calm, could also be useful here if you are going to be explicitly rate-limiting the client.
- omgitsabird 5y agoMethod Failure in Spring. "Shut The Fuck Up" in my framework.
- ChrisMarshallNY 5y agoI'll vote for that (but no one asked me). I usually use 418 for similar stuff.
- throwaway81523 5y ago419 error is a Rick roll? Ridiculous. It obviously has to be a once in a lifetime opportunity from a Nigerian prince.
- oshiar53-0 5y agoScammer prank calls, but for bots
- omgitsabird 5y agoLaravel uses 419 as Page Expired: https://github.com/laravel/framework/blob/a2c557a1b697c462927e10b248c6911ce9415079/src/Illuminate/Foundation/Exceptions/Handler.php#L389 https://github.com/laravel/framework/blob/a2c557a1b697c46292...
- zeepzeep 5y agoJust return random status codes that still render html on every page to troll bots. https://www.youtube.com/watch?v=I3pNLB3Cq24 https://www.youtube.com/watch?v=I3pNLB3Cq24
- DeathArrow 5y agoWhy not redirect the bot to fbi.gov and let them scan that?
- zhte415 5y agoLimit request rate and be done with it other than reviewing 429s, 404s, 401s etc?
- grodes 5y agoI prefer to just return a 404 if I know for sure that it is a bot to try to cheat them
- hoppla 5y agoIf the requirement is that client should follow the redirect, one should not use a 4xx status code. I think “319 never gonna give you up” is more adequate
- pull_my_finger 5y agoNGINX has a very nice status 444 that silently closes the connection, I think serves as a great way to deal with uninvited connections.
- bencollier49 5y agoI mean, technically, wouldn't this make bot scanning more efficient?
- dusted 5y agoSuperficially a fun idea.. Side efffects may include: * Helping bot authors improve their bot so it won't be identified. * Revealing how good you are at detecting bots.