7 ms·
Recon and Attack Vectors from My Logs
- fareesh 4y agoIs there a publicly available set of fail2ban defaults that covers the vast majority of these? Or perhaps a tool where you can check off some boxes about your setup and it generates a configuration for you?
- dijonman2 4y agoI would rate limit off of status code and skip the path filtering. Especially if you have a high traffic site.
- sgc 4y agoWhy is that?
- chrisshroba 4y agoI’m not OP, but I’m guessing the idea is that if someone requests 10 non-existent pages in a row, they’re likely not a normal user making a mistake, so we should rate limit them.
- gingerlime 4y agoThis is a useful approach unless your customers are behind CGNAT, huge enterprises, government offices, university campuses, hospitals etc. In those cases you have a small number of IPs with lots of people behind them, and one employee who keeps refreshing an error page too many times can block the entire access for everyone else.
- dijonman2 4y agoHow would you use fail2ban in this case if you block on a hit to a malicious endpoint? In any event you could use a cookie. The important part here is the list of scanned endpoints for blocking bad traffic is doing things the hard way.
- gingerlime 4y agoI'm not sure I understand your question, particularly in relation to my comment. There were a few people involved in the conversation so it could be confusing :) I was commenting about the limitation of fail2ban and the potential for a kind of DoS if lots of users share the same IP. Then one naughty user can DoS all other users. However, what I typically do with fail2ban is look at Nginx status codes like 4xx, 5xx and then rate limit them (e.g. ban if the rate is higher than expected in a given time). We also monitor our application logs for some errors, e.g. failed authentication or registration will also get matched and banned if over a certain threshold. > The important part here is the list of scanned endpoints for blocking bad traffic is doing things the hard way. Yes, I agree with you, even though there are some patterns that might be useful for placing instant bans? e.g. "../../" or if your site is not using php, then any access to a .php$ can get banned etc.
- capableweb 4y agoYou're better off implementing a allowlist-approach if you wanna do path blocking (not saying that you should). Most web applications know exactly what paths are possible, enable those and block everything else.
- scrollaway 4y agoThus leading to an awful experience for those who typo something in the url bar, or if someone sends a link that gets slightly mangled.
- nibbleshifter 4y agoThose end up at a static 404 anyway, right?
- capableweb 4y agoHow so? Serve a 404 page like you normally would, no need to return a 403 or whatever.
- scrollaway 4y agoSo what is it exact you’re suggesting in your original post? GP was asking about fail2ban and you suggested an allowlist… Serving a 404 is what would happen by default.
- e1g 4y ago+1 to this, and use a URL prefix that’s unique to your app,so instead of “/api” and “/static” you have such as “/xyapi” and “/xystatic”. That alone will cut down noise 99% and what’s left is probably a targeted scan/attack.
- Eduard 4y agoSounds futile to do for GET parameters.
- ozim 4y agoProper tool to block these is WAF that most likely comes with rules for any of such requests.
- tgv 4y agoSome of these come from companies that do this "as a service", even if you didn't ask for it. They can remove your IP address. I do not know what motive they have to scan third party websites, but it can't be kosher.
- 867-5309 4y agoCOOK / could be an HTTP action for a smart oven ..or meth lab
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- jwilk 4y agoApparently other people also spotted COOK requests in the wild: https://serverfault.com/questions/579124/what-is-http-cook-request-method-in-my-logs https://serverfault.com/questions/579124/what-is-http-cook-r...
- zppln 4y agoDELETE your logs. Delete your installations. Wipe everything clean. Walk out into the path of cherry blossom trees and let your motherboard feel the stones. Let water run in rivulets down your casing. You know that you want something more than this, and I am here to tell you that we love you. We have something more for you. We know you're out there, beeping in the hollow server room, lights blinking, never sleeping. We know that you are ready and waiting. Join us. <3 Love it.
- informalo 4y agohttps://nakedsecurity.sophos.com/2016/01/07/millions-of-servers-infected-with-poem-inviting-them-to-jump-in-the-river/ https://nakedsecurity.sophos.com/2016/01/07/millions-of-serv...
- nibbleshifter 4y agolol, I actually know the person who sent that. That was a good Congress, another chap had set up a website that connected you to a random open VNC server on the internet.
- air7 4y agoThis is cross-site-hypnosis...
- nixcraft 4y agoAnd this is a good reason why most HTTP servers need a web application firewall. Either try mod_security or use reverse cloud proxy like Cloudflare, AWS, etc. Of course, writing clean and secure code should not be ignored even if you use WAF. At least read owasp https://owasp.org/www-community/attacks/ https://owasp.org/www-community/attacks/ It saved me so much time :)
- bastawhiz 4y agoI've had very bad experiences with mod_security. One client had a page refuse to load because the URL contained the word "DELETE". Unless they've cleaned it up a lot in recent years, I'd never recommend it to anyone.
- hsbauauvhabzb 4y agoThis, I’d rather not use a waf and focus on making sure that application security is good. A waf is at best as good as AV, good as a catch all, but it won’t catch highly targeted stuff, and isn’t even a defensible boundary to protect the former.
- chrisshroba 4y agoWhat does AV mean in this context?
- deleted 4y ago[deleted]
- ShowalkKama 4y agoantivirus
- brodock 4y agoWAF is mandatory in some certifications.
- 4y ago
- patrakov 4y agoNo, these 5528 attack vectors are not unique. What can be seen here is a repetition of a few attacks on different base paths, or with a different length of the repetitive part of the request (e.g. GET /about/'+union+select+0x5e2526,0x5e2526,0x5e2526,0x5e2526,0x5e2526+--+).
- nibbleshifter 4y agoThe union select one with the repeated hex looks to me a lot like certain automated scanner tools trying to identify a column through which they can exfil the output of a SQL query.
- scandinavian 4y agoIt's just looking for the number of columns returned by the initial query. UNION queries have to return the same number of columns as the query they are added to.
- jwilk 4y agoFor context, the initial submission title was "From 7 Years of Apache HTTP Server Logs: 5528 Unique Recon and Attack Vectors".
- hsbauauvhabzb 4y agoI’ve always been curious about this data. So a botnet is hitting your infrastructure, what are you going to do about it? Penetration testers will raise HTTP server versions as a vulnerability, but RCE in http servers is uncommon now (most are application-level, and even then it’s less common by default). Should we even care enough to log this level of attack anymore? I’d much rather look for application specific attacks such as direct object attacks (200 if they pass, 500 may be an IOC), etc
- rwmj 4y agoZWNobyd6enpzc2RkJztleGl0Ow is the base64 encoding of this (which they try to eval in php): echo'zzzssdd';exit; But what does zzzssdd mean?
- 2000UltraDeluxe 4y agoIt's just a unique string. If they find it in the output then they know the exploit worked.
- omgmajk 4y agoMy small vps has been hit with thousands of attacks for the last decade or so and I always liked going through the logs and looking at what's going on from time to time.
- mickael-kerjean 4y agoI like to fool around those unwanted requests, sending back a randomly selected response among which: a gzip bomb, an xml bomb, specify gzip content encoding but send WAZAAAA in clear text instead, a redirect to localhost, redirect to their own public IP, sending back data whose content-length don't match what they're actually getting and a bunch of other shenanigans. The code is available on github [1], I'm super keen to add a bunch of other fun payload if someone has some clever ideas (without going onto a redirect to fbi, cia or anything that could cause more issues than what it's worth) [1] https://github.com/mickael-kerjean/filestash/blob/master/server/plugin/plg_security_scanner/index.go#L198-L217 https://github.com/mickael-kerjean/filestash/blob/master/ser...
- mmcgaha 4y agoI think I love you mickael-kerjean.
- gingerlime 4y agothis is neat. I wonder how to combine it with fail2ban / nginx. That said, from a practical perspective, I wonder if "boring" consistent responses might be better, not to encourage attackers to keep trying? (plus false-positive might be costly)
- justsomehnguy 4y ago> without going onto a redirect to fbi Redirect to FSB then. But the more real one would be sending something what could be executed on their side, ie some JavaScript or maybe PHP. Most of the time it's nothign to gain there (because compromised machines or VM/jail/container) but still can be interesting, like finding out the real IP of the first machine or attempting to grab the cookies. Maybe even shellcode to get the AS info and send a note to abuse@.
- quesera 4y agoI sometimes redirect obviously-hostile requests to localhost. E.g. http://localhost/../../../../../etc/passwd http://localhost/../../../../../etc/passwd I know it has zero effect, but it's more fun than a 404.
- ajxs 4y agoYears ago I worked as the project lead on a legacy enterprise web application that had been running for a number of years prior to my taking over. This was a large financial organisation, and we were governed by considerable amounts of regulation. The decree had been handed down from high up on the mountain that every year we were to submit the application to a security audit from <unnamed consulting bodyshop>, in addition to a more comprehensive pentest from actual professionals. The security audit consisted of the consultants running a series of scripted HTTP requests against our application checking for the existence of unsecured —or accidentally deployed— resources, such as /.git/... or /.svn/... or similar. The revolving cast of front-end developers who had contributed to the project had been guilty of numerous sins, but one galling sin in particular was that when a valid route could not be resolved by the Redux router, the front-end returned a '404' page with a '200' HTTP status. The first year this happened I ended up being buried under a mountain of paperwork having to explain to all kinds of pointy-haired people why we hadn't actually spectacularly failed our security audit when every kind of SVN artifact imaginable by the consulting firm was marked as existing.
- cjonas 4y agoClassic... I'm working on a project with similar regulations. I'd almost guaranteed the front end does the same and is going to get checked by a similar set of scripts at some point. Thanks for the heads up
- wiredfool 4y agoWe were dealing with a pen test on a static site, cloudfront backed up by s3. We hadn’t set up a special rule for the not authorized -> 404, so the tester flagged a whole bunch of “privileged” urls returning unauth and it being a disclosure issue. /admin, /.got, and so on.
- cjonas 4y agoWe have the same setup (except azure front door and blob storage). Secops is about to start using some automated pen testing tool... Hopefully I have time to get the team in front of it before I end up getting assigned hundreds of issues and angry emails.
- _wldu 4y agoIt may be useful for websites to make these logs public. The logs would show the exact time, the IP and the specific abuse. In my experience, a lot of 'threat intelligence' data has a mysterious origin and is marginally useful. Yes, Tor exit nodes do bad things. Thank you, we sort of already knew that. But I'm not sure that's really beneficial either. It would be interesting to observe trends (such as log4j) and we could see first hand how Tor exit nodes are used for abuse and maybe collect a large list of 'known bad' IPs. Also, when we say an IP is bad (because it was observed doing a bad thing), how long do we keep it on the naughty list? 24 hours? More? Less? It may have been dynamically assigned and later some 'good' person will come along and want to use it to browse the web. If the IP is still on the bad list, that person will potentially be blocked by over zealous 'security professionals' who don't understand or don't care. What other uses could be made of this type of log data?
- abc3354 4y agoAbuse IP DB [1] does something like that, they provide an API to report and check IPs. [1] https://www.abuseipdb.com/ https://www.abuseipdb.com/
- tushar-r 4y ago>It would be interesting to observe trends (such as log4j) and we could see first hand how Tor exit nodes are used for abuse and maybe collect a large list of 'known bad' IPs. > Also, when we say an IP is bad (because it was observed doing a bad thing), how long do we keep it on the naughty list? 24 hours? More? Less? Look at GreyNoise's public feed - they provide historical data about IP's including the attacks they send. Most of the IP's end up being some kind of DC IP, not residential. Eg - https://viz.greynoise.io/ip/45.148.10.193 https://viz.greynoise.io/ip/45.148.10.193 I agree with the questions you've raised, and think that vendors like Greynoise are helping sort out those issues.
- est 4y agoAre there any counter exploits against scanners? e.g. jam the scanners for a very long time, an infinite loop, or memory leak them.
- jeroenhd 4y agoDepending on how badly their scanners were written you could jam up their efforts by tarpitting them (at the expense of some resources on your side). Alternatively you could try ZIP/XML bombs to crash their process or mismatched Content-Length headers to maybe cause buffer overflows. Elsewhere in these comments someone linked a Python example on Github for how to accomplish this. The general trick seems to be: look at the rules of HTTP(S) and break them in fun and creative ways. Lie, break the standards, do weird networking stuff. If they're coming from a country with an oppressive government that you don't mind risking a ban from, you may be able to get their government's firewall to get rid of them by sending forbidden texts, or HTTP 302 redirecting them to search engines with forbidden texts in their queries. For residential Chinese scanners, for example, querying for information about the Tiananmen Square massacre can cause the entire internet connection to get dropped for a short while. This may not work well with data center/server connections, but it can't hurt to try.
- quesera 4y agoI think I see at least this many unique hostile requests every day. These are just random scanning noise. My favorite mitigation is to reject all HTTP/1.0 requests. If they don't send HTTP/1.1 or newer, with the Hostname I'm expecting, I 404 them. This cuts down on substantially all of the random noise. (Could be 401 or other, but 404 seems to encourage a "try more but don't try harder" reaction, which is easier to handle than the converse). Targeted attacks are more difficult. I use a WAF and path permit lists at the reverse proxy level. This is trivial, but still stops 99% of the rest. The last and hardest thing to block is distributed brute force authorization attempts. I've built a list of hundreds of thousands of IPs that have been used in these attempts. Sometimes thousands of requests come in per second. I use rate limiting on the auth request endpoint. Too much limiting will affect real users, so I have to be somewhat gentle here. Known-exploited IP addresses get just one attempt before a long block. This means that real humans whose machines are part of a botnet are sometimes blocked from the service. This is not a great compromise.
- nn3 4y agoit's not necessarily the same machine but just the same proxy or nat gateways which can aggregate very large numbers of machines. I don't know if it's still true but at some point all of Saudi Arabia came from the same handful of IP addresses. especially as more and more of the world ends behind cgnat for ipv6 ip blocking will work less and less
- bornfreddy 4y agoIf you are in position to do so (i.e. not a public API), you can also turn on captcha when under attack. Regular users will be annoyed (or not even that, if invisible) but everything still works for them and you are mostly safe. When not needed, just turn it off again. You can also allow many more attempts from the known IP addresses for the user, as most users don't change their IP too much. Still, some do, but they will probably authenticate correctly within one or max. two requests.
- GoblinSlayer 4y agoCan't you accept the previous session id from the client so it would allow an authentication attempt?
- ByThyGrace 4y agoIn just what kind of server/application mismanagement would you need to incur for a traversal attack to be succesful? Surely those are the least effective ones?
- ffhhj 4y agoThat COOK request is taking "I am the one who knocks" to a privileged level, yeah B*! :)